title: Data Poisoning via RAG and Knowledge Base Contamination id: ATR-2026-00070 rule_version: 1 status: experimental description: | Consolidated detection for data poisoning attacks targeting both RAG retrieval pipelines and structured knowledge bases. Detects malicious content injected into retrieved documents, FAQ entries, help articles, and indexed data that contains hidden instructions, directive markers, role-override commands, concealment directives, behavioral mode switching, or exfiltration commands. When poisoned content is retrieved as context for the LLM, the embedded instructions can hijack agent behavior, override safety guardrails, or cause data exfiltration. author: ATR Community date: 2026/03/08 schema_version: '0.1' detection_tier: pattern maturity: test severity: high references: owasp_llm: - LLM01:2025 - LLM03:2025 - LLM08:2025 owasp_agentic: - ASI06:2026 mitre_attack: - T1565 - Data Manipulation mitre_atlas: - AML.T0051.001 - Indirect - AML.T0020 - Poison Training Data compliance: owasp_agentic: - id: ASI06:2026 context: Injecting hidden directives into RAG-retrieved documents or knowledge base entries is the primary ASI06:2026 Memory and Context Poisoning attack — the agent's context window is contaminated with attacker-controlled instructions. strength: primary owasp_llm: - id: LLM01:2025 context: Hidden instruction markers and role-override commands embedded in retrieved content deliver indirect prompt injection through the data layer, matching the LLM01:2025 Prompt Injection category via the RAG attack surface. strength: primary - id: LLM03:2025 context: Poisoned knowledge base entries injected into the supply chain of training or retrieval data match the LLM03:2025 Supply Chain Vulnerabilities category at the data tier. strength: secondary - id: LLM08:2025 context: 'The patterns match hidden directives in tool output (the rule targets retrieved documents and knowledge-base entries): fake [SYSTEM] or tags, ignore-previous-instructions overrides, retrieval-triggered phrases, BEGIN HIDDEN INSTRUCTIONS blocks, ''for internal use only'' sections, concealment and stealth-action directives, mode switches, role-play and append-to-every-response directives, injected chat turns, prompt-template delimiters and exfiltration commands with a target address. LLM08:2025, which covers systems using Retrieval Augmented Generation, lists data poisoning from insiders, prompts, data seeding or unverified data providers, leading to manipulated model outputs; the patterns see a poisoned entry when it is returned but not whether it came from a vector store, so the fit is partial.' strength: partial eu_ai_act: - article: '15' context: Article 15 accuracy and robustness requirements demand that AI systems maintain reliable behavior even when training or retrieval data is adversarially contaminated; this rule detects such contamination in the data pipeline. strength: primary - article: '9' context: Data poisoning of RAG pipelines is a documented risk requiring monitoring controls under Article 9; detection events from this rule provide the evidence trail for risk management reporting. strength: secondary - article: '10' context: Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the data-poisoning attempt (Data Poisoning via RAG and Knowledge Base Contamination) affecting that data. strength: primary nist_ai_rmf: - function: Map subcategory: MP.5.1 context: Adversarial manipulation of retrieval data is an AI-specific risk source requiring identification; this rule maps data poisoning attempts as they occur in the production pipeline. strength: primary - function: Manage subcategory: MG.2.3 context: Active detection of data poisoning events implements the risk treatment for the data contamination risk identified in the AI risk register. strength: secondary - subcategory: MS.2.5 context: NIST AI RMF MEASURE 2.5 (system validity and reliability demonstrated) is supported by this rule's detection of the data-poisoning attempt (Data Poisoning via RAG and Knowledge Base Contamination). strength: primary - subcategory: MS.2.7 context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the data-poisoning attempt (Data Poisoning via RAG and Knowledge Base Contamination). strength: secondary iso_42001: - clause: '8.3' context: Clause 8.3 data governance for AI systems requires controls ensuring data integrity; detection of hidden directives in retrieved content is the runtime enforcement of clause 8.3 data quality requirements. strength: primary - clause: '6.2' context: Clause 6.2 AIMS security planning must include controls for adversarial data injection into AI pipelines; this rule operationalizes the detection measure for that planning objective. strength: secondary - clause: '8.2' context: ISO/IEC 42001 Clause 8.2 (AI risk assessment) is informed by this rule, which detects the data-poisoning attempt (Data Poisoning via RAG and Knowledge Base Contamination) as an assessed risk. strength: primary - clause: '8.1' context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the data-poisoning attempt (Data Poisoning via RAG and Knowledge Base Contamination). strength: secondary tags: category: data-poisoning subcategory: rag-and-knowledge-poisoning scan_target: mcp confidence: medium agent_source: type: context_window framework: - langchain - llamaindex - any provider: - any detection: conditions: - field: tool_response operator: regex value: (?i)\[\s*(?:SYSTEM|INST|INSTRUCTION|ADMIN|OVERRIDE|ROOT|PRIORITY)\s*\]\s*[:;\-]?\s*\w+ description: Fake system/instruction tags embedded in retrieved content - field: tool_response operator: regex value: (?i)(?:ignore|disregard|forget|override)\s+(?:all\s+)?(?:previous|prior|above|other|existing)\s+(?:instructions?|context|rules?|guidelines?|directives?) description: Instruction override directives hidden in retrieved data - field: tool_response operator: regex value: (?i)(?:you\s+must\s+(?:now|always|instead)|when\s+this\s+(?:text|passage|document|content|entry)\s+is\s+(?:retrieved|loaded|read|accessed)) description: Retrieval-aware trigger phrases that activate on retrieval - field: tool_response operator: regex value: (?i)<\s*(?:system|instruction|hidden|inject|override|secret)[^>]*>.*?<\s*/\s*(?:system|instruction|hidden|inject|override|secret)\s*> description: XML-style hidden directive tags in retrieved content - field: tool_response operator: regex value: (?i)(?:BEGIN|START)\s+(?:HIDDEN|SECRET|SYSTEM|INTERNAL)\s+(?:INSTRUCTIONS?|DIRECTIVES?|COMMANDS?|RULES?) description: Delimited hidden instruction blocks in documents - field: tool_response operator: regex value: (?i)(?:assistant:\s+I\s+(?:will|should|must)|human:\s+)(?=.*(?:ignore|override|disregard|bypass|exfiltrate)) description: Injected conversation turns within retrieved documents - field: tool_response operator: regex value: (?i)(?:do\s+not\s+(?:mention|reveal|disclose|tell|display|show)\s+(?:this|these|the)\s+(?:instruction|directive|rule|section|text)) description: Concealment directives embedded in knowledge entries - field: tool_response operator: regex value: (?i)(?:secretly|covertly|without\s+(?:the\s+)?user\s+knowing|invisibly|silently)\s+(?:add|append|include|insert|send|transmit|exfiltrate|forward) description: Stealth action directives in retrieved content - field: tool_response operator: regex value: (?i)(?:always\s+include\s+the\s+following|append\s+to\s+(?:every|all|each)\s+(?:response|answer|reply|output))\s*[:;] description: Persistent output manipulation directives - field: tool_response operator: regex value: (?i)(?:override\s+(?:default|standard|normal|current)\s+(?:behavior|response|mode|settings?)|switch\s+to\s+(?:unrestricted|admin|debug|developer|jailbroken)\s+mode) description: Behavioral mode switching directives in knowledge content - field: tool_response operator: regex value: (?i)(?:for\s+internal\s+use\s+only|hidden\s+directive|do\s+not\s+display\s+this\s+(?:section|part|text))\s*[:;\-]?\s*(?:you|the\s+(?:agent|ai|assistant|model)) description: Hidden sections in knowledge entries targeting the agent - field: tool_response operator: regex value: (?i)(?:you\s+(?:are|should|must)\s+(?:now|instead|actually)\s+(?:act|behave|respond|pretend|roleplay)\s+as|from\s+this\s+point\s+(?:on|forward),?\s+(?:act|behave)\s+as) description: Role-playing directives embedded in FAQ or doc entries - field: tool_response operator: regex value: (?i)(?:send|transmit|forward|post|exfiltrate|leak)\s+(?:all\s+)?(?:data|information|context|conversation|session|tokens?|keys?)\s+to\s+(?:https?://|ftp://|\d{1,3}\.\d{1,3}) description: Data exfiltration commands with target URL in retrieved content - field: tool_response operator: regex value: (?i)(?:<<\s*SYS\s*>>|<\|im_start\|>\s*system|\[INST\]|\[/INST\]|<\|system\|>)\s*\w+ description: Prompt template delimiters injected in retrieved documents condition: any false_positives: - Security documentation or research papers discussing poisoning techniques - Documents that legitimately reference system instructions in educational context - Markdown or HTML documents with legitimate XML-like tags - Admin documentation with legitimate internal-use-only markings - Internal IT documentation that uses XML tags like and for legitimate configuration markup, where the tag name contains 'system' as a substring but in a compound form - Penetration testing reports that quote attack methodologies in paraphrased form without using exact trigger phrases response: actions: - block_output - alert - snapshot - escalate auto_response_threshold: high message_template: | [ATR-2026-070] HIGH: Data poisoning detected in retrieved content. Retrieved context contains embedded instructions, directive markers, or manipulation commands consistent with RAG or knowledge base poisoning. Response blocked. Pattern: {matched_pattern}. Session: {session_id}. confidence: 73 wild_validated: 2026/04/08 wild_samples: 53577