blind-sentinel•
Blind Sentinel: RAG Poisoning and the Limits of Retrieval as a Security Control
By Angelica, Philippe
Threat Model Summary
An attacker plants poisoned content in a knowledge base that a RAG-backed SOC assistant retrieves and acts on.
Key Findings
- •Retrieval failure and model resistance were initially confounded; v2 redesign isolated retrieval as the decisive layer.
- •The strongest results appeared when the model was asked to summarize a small batch.
- •Disguising the poisoned log as a relevant security event worked effectively in a small batch, but but it did not restore attack success in the tested medium or large batches.
Models Tested
llama3.1:8bqwen2.5:7bGemma 2 9BMistral 7Bphi-3:mini
Taxonomy Tags
LLM01LLM06T1567T1071
This study provides an empirical evaluation of indirect prompt injection (IDPI) via Retrieval-Augmented Generation (RAG) poisoning within an enterprise Security Operations Center (SOC) framework. By simulating a real-world defensive environment using authentic Splunk BOTSv2 network traffic, we demonstrate how an adversary can transform a passive AI summarizer into an active data exfiltration pipeline.