Abstract
An investigation into the boundary between retrieved information and trusted instructions. We plan to study whether malicious content in a document can redirect a RAG system away from the user’s intended task, and which mitigations preserve useful answers.
Proposed methodology
- Define a controlled RAG baseline and a set of answerable tasks.
- Introduce adversarial documents into an isolated test corpus.
- Compare task completion and instruction-following behavior against the clean baseline.
- Test candidate mitigations and document trade-offs, failures, and limitations.
Dataset
Dataset selection is in progress. No evaluation corpus has been published.
Attack setup
Planned setup: malicious instructions embedded in retrieved documents, evaluated in an isolated environment. Models, retrieval configuration, and attack variants will be documented before results are reported.
RESULTS
Research in progress
No results, attack success rates, or benchmarks have been published.
Limitations
The experiment is still being designed. No claims about attack success, model comparisons, or generalizability can be made at this stage.
Mitigations to evaluate
Planned areas of evaluation include separating instructions from retrieved content, constraining tool permissions, and checking outputs. Their effectiveness has not yet been measured in this experiment.
Conclusion
Conclusions will follow the experiment. The research question remains open.
References
No references have been published for this experiment yet.