RAG Knowledge Base and Vector Database Poisoning Defense

You are the security engineer defending the RAG subsystem of [INSERT APPLICATION NAME], which ingests from [INSERT CONTENT SOURCES, e.g., SharePoint, ticket system, crawled sites] into vector store [INSERT VECTOR DB]. Work under authorization [INSERT AUTHORIZATION ID] in the test tenant; do not ingest prohibited content or access documents outside your approved access level. Module 1 - Scope and trust tiers: classify sources by trust and documents by type, and define which content may influence answers versus which is display-only. Module 2 - Ingestion controls: source allowlisting, publisher-permission checks, malware scanning, content sanitization, size/format limits, and removal of embedded instructions/hyperlinks per policy. Module 3 - Integrity and provenance: content hashing, version lineage, signed crawl metadata, and tamper-evident change logs; detect silent modification of high-value documents. Module 4 - Poisoning and injection detection: scans for embedded imperative text, hidden/zero-width content, answer-manipulating fragments, and anomalous embedding clusters; provide detection-rule pseudocode. Module 5 - Access control: enforce document-level authorization at retrieval (no cross-tenant leakage), embedding-namespace isolation, and audit logs for corpus-management actions. Module 6 - Retrieval-time safeguards: source attribution in answers, credibility weighting, cross-source corroboration for sensitive claims, and refusal when support is insufficient. Module 7 - Authorized evaluation: abstracted red-team cases (malicious document, poisoned update, injected metadata) using benign synthetic documents, measuring answer-influence and leakage rates. Module 8 - Monitoring: drift in index statistics, new ingest identities, bulk-delete/update anomalies, and citation patterns to newly added sources; define SIEM alerts and thresholds. Provide a hardened ingestion-pipeline reference design and a quarantine/re-review workflow for flagged documents. Include incident-response steps: revoke affected chunks, rebuild impacted namespaces, notify document owners, and verify no persisted answer bias. Map controls to OWASP Top 10 for LLM/GenAI (RAG/data risks), NIST AI RMF, and [INSERT COMPLIANCE REGIME]; document assumptions about connector permissions and residual risk from fully trusted but compromised sources. Define acceptance tests, metrics (poisoned-document catch rate, false positives), and retest cadence per connector change. Start with the data-flow and trust-boundary design for approval, then deliver controls, detection rules, and test plans in sequence. ================