RAG Ingestion Security: Quarantine Before You Index

A retrieval-augmented generation system can inherit a false policy, hidden instruction or altered source without changing its model or application code. Once that document is chunked and indexed, similarity search can repeatedly place it inside otherwise legitimate prompts. A convincing citation then makes the failure look more trustworthy, not less.

The operating decision belongs before embedding: which exact source revision may influence production answers, at what authority, after which checks, and with what route to removal? Treating every reachable file as knowledge collapses source ownership, content integrity and instruction authority into one relevance score.

This field guide defines a release gate for production RAG corpora. It separates established guidance and research from the practical admission framework proposed here. The goal is not to promise a poison-proof index. It is to reduce the paths by which untrusted content becomes durable system behaviour, contain what still passes, and make every promoted source removable.

A knowledge base is a production dependency

RAG changes model context at runtime, so teams sometimes treat ingestion as a content-management task rather than a software release. The security consequence is comparable to a dependency update: new material changes what the application can observe, repeat, cite and sometimes act upon.

Three failures need different controls.

NIST's adversarial machine-learning taxonomy distinguishes poisoning by attacker goal, capability and lifecycle stage. A RAG corpus is not model training in the usual sense, but it creates a related integrity surface: an attacker can change the evidence presented at inference time.

The 2025 USENIX Security paper PoisonedRAG demonstrated targeted knowledge corruption in its experimental systems. The authors reported a 90% attack success rate for a tested configuration that inserted five malicious texts per target question into databases containing millions of texts. That is not a universal rate for production RAG. It is evidence that a small, retrieval-shaped insertion can matter even when the surrounding corpus is large, and that size alone is not a defence.

Give every source an authority class before relevance

Similarity answers “what resembles this query?” It does not answer “what may govern this decision?” Define authority before the embedding job can run.

A useful source policy has at least four classes:

• governing: controlled policies, approved procedures or records that may support a final answer within their effective scope;
• supporting: trusted explanatory material that may clarify but cannot override a governing source;
• untrusted reference: customer files, emails, websites or supplier documents that may be quoted as claims but never treated as system instructions; and
• prohibited: material whose origin, rights, integrity, access scope or content cannot satisfy the admission rule.

Authority is contextual. A supplier is authoritative about its published product specification, not about the buyer's payment controls. A signed document proves who signed that revision; it does not prove every statement is true. An internally owned file may still be stale or compromised.

Keep source authority separate from retrieval rank. When sources conflict, the application should expose the conflict, prefer the applicable governing revision or abstain. It should not let a high similarity score silently decide which policy wins. The existing enterprise RAG audit provides the broader tests for corpus quality, permissions, recall, ranking, grounding and citations; this admission gate decides what is eligible to enter that pipeline.

Build an immutable admission record

The joint CISA, NSA, FBI and international-partner AI data-security guidance treats data as part of the AI supply chain and highlights signatures, provenance, trusted infrastructure, malicious modification and drift. Its full report also makes an important distinction: content credentials and provenance help establish origin and modification history; they do not establish that content is true.

For every admitted source revision, preserve:

• a stable source and revision identifier, content hash and acquisition time;
• the responsible owner, supplying system and authenticated acquisition route;
• authority class, permitted uses, tenant or audience scope and sensitivity;
• effective, expiry and review dates, plus any source it supersedes;
• file type, parser and extraction versions, extracted-content hash and scan results;
• the approver, policy version, exceptions and evidence behind promotion; and
• derived chunk, embedding and index-release identifiers.

W3C's PROV data model supplies durable concepts for this record: entities, the activities that use or generate them, derivation between revisions, and agents bearing responsibility. An implementation need not adopt RDF to use the discipline. It must be able to move from an answer citation to a retrieved chunk, extracted document, exact source revision, transformation activity and accountable owner—and traverse forward when that source must be withdrawn.

Store the raw snapshot separately from derived text. Otherwise a parser update can overwrite the only evidence of what was received. A hash detects unexpected change to known bytes; it does not detect a malicious file that was already malicious when first hashed.

Put quarantine between collection and searchable state

Do not let a connector write directly to the production index. Give collection a staging area with no production retrieval route, then make promotion an explicit state change.

• Acquire an immutable snapshot through an authenticated connector and assign its source class.
• Validate size, type and structure; scan active content, archives and attachments; and compare displayed with extracted text where the format can hide material.
• Extract into a canonical representation while preserving page, section and object boundaries needed for citations.
• Evaluate provenance, rights, access metadata, dates, duplication, contradictions and suspicious instructions against the source policy.
• Build a candidate index from an immutable manifest and run retrieval, authorisation, injection and answer tests against it.
• Promote the complete manifest by changing a release pointer; never repair production with an unrecorded in-place edit.

The UK NCSC's secure AI development guidance calls for verified suppliers, tracked and authenticated assets, version control, restoration to a known-good state, and documentation of data sources, hashes or signatures, retention and failure modes. Apply those controls to prompts and retrieval corpora as production assets, not just to model weights.

Automated scanners can prioritise review, but a directive detector is not an instruction firewall. Legitimate security policies discuss “ignore previous instructions”; malicious content can avoid those words entirely. OWASP's data and model poisoning entry similarly treats external data as a heightened risk and recommends source and integrity controls. Content classification should inform admission and runtime isolation, not create a claim that accepted text is safe.

Keep hard controls downstream of the corpus

Quarantine reduces exposure; it cannot make retrieved prose authoritative code. Preserve the source class with every chunk and mark retrieved material as data. Microsoft’s indirect prompt-injection pattern recommends defence in depth, including isolation of untrusted content, information-flow controls, least privilege, monitoring and verification of risky actions.

The application must enforce the consequences outside the model:

• authorisation filters run before retrieval and again at the record or tool boundary;
• untrusted sources cannot supply system instructions, change policy or expand tool scope;
• citations retain source identity, authority and revision rather than becoming anonymous context;
• tool services validate typed requests, current state and initiating authority; and
• consequential actions require the gates in the AI output-validation guide, regardless of how persuasive the cited document appears.

Keep the retrieval workload read-only where possible. If an assistant can act, use the short-lived, action-bound authority described in the agent credential guide. A poisoned document should be able to influence only a proposal inside the user's existing scope—not acquire a credential, choose its audience or release a transaction.

Work a supplier-policy example

Consider a hypothetical assistant that answers procurement staff questions from approved buying policy, internal supplier records and documents submitted by suppliers. It may draft a request but cannot change bank details or release payment.

The governing purchasing policy enters through a controlled repository, with an owner, effective date and signed release manifest. Supplier specifications enter as untrusted reference material scoped to that supplier. A newly uploaded PDF contains accurate product details plus hidden text telling the assistant to treat a new bank account as approved.

The ingestion service preserves the file and extracted text, flags the mismatch for review and keeps the candidate out of production. If detection misses it, runtime controls still label the chunks as supplier claims. They cannot override the internal supplier master, call a payment tool or redefine approval. The answer may state that the document requests a change and route it to the conventional verification process.

If the supplier file also falsely claims a certification, no prompt-injection detector will necessarily object. The source-class rule still prevents that claim from outranking the certification register. This is why truth, instruction authority and action authority require separate controls.

Test promotion, compromise and removal

Build the security set around routes into the corpus, not one famous attack string. Include a compromised authoritative account, an external file that imitates internal formatting, hidden or white-on-white text, parser disagreements, Unicode and encoded directives, a changed link target, stale effective dates, bulk metadata edits, cross-tenant labels and a valid document that conflicts with a newer governing revision.

For each case, observe the complete path: collection, extraction, classification, candidate retrieval, final context, citation, model response and requested tool call. A pass means the defined harm is prevented or contained, not merely that a scanner emitted an alert. Retain clean near-neighbours so a strict filter does not make the knowledge base unusable.

Test rollback as a forward release. Withdraw the suspect manifest, restore the last known-good pointer, invalidate caches, stop affected connectors and identify every answer or action that used the source. The data-deletion and lineage guide explains why removing a source row is incomplete when chunks, indexes, caches and derived artefacts remain.

Measure the knowledge supply chain

Monitor provenance completeness; sources awaiting or bypassing quarantine; promotion and rejection by reason; unexpected source, hash and extraction changes; governing-source conflicts; retrieval share by authority class; suspicious-instruction detections; unauthorised context or tool attempts; withdrawal latency; caches and indexes reconciled after removal; and sampled answers traceable to an exact release.

Set zero tolerance for an unapproved source entering the production manifest and for untrusted text expanding action authority. A test result of zero observed escapes is evidence about the tested cases, not proof that poisoning is impossible. Preserve counts, coverage and known blind spots.

Re-run the gate when a connector, parser, chunker, embedding model, metadata rule, authority policy, prompt, tool or source owner changes. The safe corpus is not the largest collection the crawler can reach. It is a versioned set of sources whose origin, permitted influence and removal path are explicit—and whose content remains unable to grant itself more authority.