The insertion of malicious or misleading content into a retrieval index before a query ever occurs. In RAG systems, this can happen through compromised sources, connector abuse, or manipulated embeddings, creating a dormant risk that only appears later at runtime.
Expanded Definition
Index-time poisoning is a supply-chain style attack on retrieval systems where harmful or false content is inserted into the knowledge index before any user query is made. In Retrieval-Augmented Generation, the index may include documents, chunks, metadata, or vector embeddings, so poisoning can occur through compromised content sources, insecure connectors, weak ingestion validation, or manipulated embedding pipelines. The result is not immediate model failure; instead, the corrupted material can remain dormant until a later search or prompt causes it to surface.
For NHI Management Group, the key distinction is that this is not the same as prompt injection, which attacks the live interaction layer. Index-time poisoning targets the upstream retrieval layer, so the defensive problem is provenance, integrity, and trust in what the system has stored. Industry usage is still evolving, and some vendors group this with data poisoning or retrieval poisoning, but the operational risk is the same: bad content becomes a trusted source. NIST’s NIST Cybersecurity Framework 2.0 is a useful governance lens because it emphasises protection of information assets across the lifecycle.
The most common misapplication is treating the issue as a model problem only, which occurs when teams ignore ingestion controls and focus solely on prompt filtering.
Examples and Use Cases
Implementing index-time poisoning defences rigorously often introduces ingestion friction, requiring organisations to weigh retrieval quality and automation speed against provenance checks and source vetting.
- A malicious actor alters a public knowledge source that a RAG system regularly syncs, causing the index to store misleading procedural guidance that later appears in answers.
- A compromised connector pulls in tainted internal documents from a shared repository, and the ingestion pipeline indexes them without content reputation checks.
- Embedding manipulation changes how a poisoned document clusters in vector search, making it more likely to be retrieved for sensitive queries.
- A third-party data feed includes fabricated policy updates, and the retrieval layer treats the feed as authoritative because no source attestation is enforced.
- An internal NHI with excessive write permissions injects false records into a search corpus, showing how poor machine identity governance can become a retrieval compromise.
Defenders commonly pair provenance validation with content hashing, connector allowlisting, and review workflows for high-risk sources. Guidance from OWASP Top 10 for Large Language Model Applications is relevant because poisoned retrieval sources can indirectly shape downstream model behaviour, even when the model weights remain unchanged.
Why It Matters for Security Teams
Index-time poisoning matters because it turns the retrieval layer into a long-lived trust boundary. Once malicious content is indexed, every downstream query may inherit the corruption, which can lead to misinformation, policy bypass, unsafe recommendations, or exposure of sensitive internal material. Security teams should treat the index as governed data, not a passive cache. That means validating source integrity, monitoring ingestion paths, reviewing connector permissions, and documenting which content is allowed to influence responses.
This is especially important in agentic AI and NHI-heavy environments, where autonomous systems may query the index without human review. If a compromised agent, pipeline identity, or external feed can write to the retrieval store, then index-time poisoning becomes an access-control problem as much as a content problem. The broader resilience lens in NIST SP 800-53 is helpful for mapping ingestion governance to control discipline, even when the attack itself is specific to AI retrieval.
Organisations typically encounter the business impact only after an answer cites poisoned content in production, at which point index-time poisoning becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF, NIST SP 800-53 Rev 5 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST AI RMF | AI RMF addresses managing data and system risks across the AI lifecycle. | |
| NIST SP 800-53 Rev 5 | SI-4 | System monitoring supports detection of abnormal ingestion and retrieval activity. |
| OWASP Agentic AI Top 10 | Agentic AI guidance covers retrieval and tool-chain risks that enable poisoned context. | |
| OWASP Non-Human Identity Top 10 | NHI guidance is relevant where machine identities can write to retrieval stores. | |
| NIST Zero Trust (SP 800-207) | Zero trust supports continuous verification of source and pipeline trust. |
Monitor connectors and indexing pipelines for suspicious content changes and source anomalies.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 20, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
