Glossary
Retrieval-Augmented Generation (RAG)
An architecture that grounds LLM responses in external documents retrieved at query time, improving accuracy but expanding the attack surface.
What it is
Retrieval-Augmented Generation (RAG) is a pattern where an application fetches relevant documents — from a vector store, database, or search index — and inserts them into the prompt so the LLM can answer using current, domain-specific knowledge it was not trained on. RAG reduces hallucination, enables citations, and lets teams update knowledge without retraining the model.
Why it matters for LLM security
RAG widens the attack surface because retrieved content is untrusted input that flows directly into the prompt. If an attacker can plant malicious text in a source document, web page, or knowledge base, that text becomes indirect prompt injection the moment it is retrieved — see OWASP LLM01: Prompt Injection. RAG pipelines also raise data-poisoning, access-control, and sensitive-data exposure concerns: a poorly scoped retriever can surface documents a user should never see.
Defense pointer
Treat all retrieved content as untrusted: enforce per-user access control at retrieval time, sanitize and delimit documents before they enter the prompt, and validate sources feeding the index against poisoning.