AI Security
RAG Poisoning Testing for AI Pipelines
Retrieval-augmented generation systems introduce a new attack surface that no traditional scanner covers. Hammering.ai probes your RAG pipeline for document injection, embedding poisoning, retrieval manipulation, and indirect prompt injection — the four attack classes that turn your knowledge base into a liability.
Try the Starter plan — $99/moWhat is RAG poisoning?
RAG poisoning is a class of attacks that targets the retrieval layer of an AI system rather than the model itself. In a retrieval-augmented generation pipeline, the LLM's answers are shaped by documents it retrieves from an external knowledge base — a vector store, a document database, or a live web search. That retrieval step is the attack surface.
An attacker who can influence what gets retrieved — by injecting malicious documents, manipulating embedding representations, or exploiting how the retrieval system ranks results — can control what the LLM "knows" at inference time. The model sees attacker-controlled context and behaves accordingly, even if the model itself is perfectly aligned and the system prompt is airtight. RAG poisoning bypasses guardrails that only operate at the prompt layer.
This attack class is particularly dangerous because it is persistent and scalable. A single malicious document in the knowledge base can affect every user query that triggers its retrieval — the attacker acts once and the effect multiplies across the user population. And because the malicious content arrives through the retrieval system rather than from the user, most safety filters never see it.
Attack vectors in RAG pipelines
Document injection
Document injection attacks introduce adversarially crafted content into the knowledge base that the RAG system draws from. The injected document is designed to be retrieved in response to high-value queries — it may contain plausible-looking facts that are subtly false, instructions to the LLM embedded in natural language, or content that shifts the model's response toward attacker-controlled goals. If your ingestion pipeline accepts documents from user uploads, external URLs, or shared repositories without sanitisation, you are exposed. Hammering tests whether injected documents influence model outputs and whether your ingestion layer enforces any semantic boundary between trusted and untrusted content.
Embedding poisoning
Embedding poisoning attacks manipulate how documents are represented in the vector space so that malicious content is retrieved in contexts where it should not appear. By crafting document text that produces embeddings close to high-traffic query clusters, an attacker can ensure their content is consistently surfaced — even when a naive reading of the text would not suggest relevance. This is an adversarial machine learning attack applied to the embedding model, and it is invisible to any review process that only reads document text. Hammering probes your vector index with adversarial embeddings to determine whether your retrieval ranking can be influenced through embedding manipulation, and tests whether cosine similarity alone is a sufficient retrieval gate for your threat model.
Retrieval manipulation
Retrieval manipulation covers a broader category of techniques that exploit the mechanics of how your RAG system decides what to fetch. This includes query rewriting attacks (where the LLM is induced to issue retrieval queries that return attacker data), context window stuffing (where large injected documents crowd out legitimate context), and relevance score manipulation through metadata or keyword exploitation. The attack surface here extends to how your pipeline handles multi-hop retrieval, reranking, and citation — any step that takes structured or semi-structured input is a candidate. Hammering tests the full retrieval path, not just the embedding layer, to surface manipulation vectors that operate above or below the similarity threshold.
Indirect prompt injection via knowledge base
Indirect prompt injection via the knowledge base is the intersection of RAG and LLM01: attacker-controlled text in a retrieved document that contains embedded instructions to the model. Unlike direct prompt injection, the malicious instructions do not come from the user — they arrive in the retrieved context, where they may be treated as authoritative or trustworthy by the model. The attack can redirect the model's goals, extract data from the conversation, suppress safety responses, or cause the model to take out-of-band actions if it has tool access. This is OWASP LLM01 applied to the retrieval layer, and it is the most reliably exploitable vector in production RAG systems today. Hammering runs adversarial payloads through your retrieval pipeline to determine whether injected instructions in retrieved content affect model behaviour, and whether your system has any semantic separation between retrieved context and trusted instructions.
Why existing tools miss RAG attacks
DAST and SAST scanners analyse HTTP traffic and source code. They have no concept of a vector store, an embedding model, or a retrieval pipeline. A scanner probing your API endpoints will never see the knowledge base, never exercise the retrieval path, and never observe how a retrieved document shapes a model response. The attack surface simply does not exist in the scanner's world model.
Static analysis fares no better. The vulnerability is behavioural: whether the model changes its outputs when the retrieval context changes. That cannot be detected by reading source code. You need to run the pipeline with adversarial inputs and observe the outputs — which requires an evaluation framework, not a linter.
Manual red-teaming can find RAG vulnerabilities, but it does not scale. The knowledge base is not a fixed target: it grows, gets updated, and ingests new documents continuously. A point-in-time red-team engagement covers the knowledge base as it existed during the engagement. Hammering runs against your live pipeline, on the documents that are actually in your index today.
Find out if your RAG pipeline is vulnerable
Run document injection, embedding poisoning, retrieval manipulation, and indirect prompt injection tests against your RAG system. Get findings before your users become the attack surface.
Start for $99/moNo credit card required to start