LLMs, GenAI, RAG, agents, evaluation · insight-1602

Control who can write to the corpus, because a few planted passages can steer answers

Situation
A RAG assistant indexes a wiki, a ticket system and a shared drive that many employees and contractors can edit.
Action
Tier sources by write trust and let answers rely only on the reviewed tier. Store author and edit time per chunk, alert when a new document enters the top results for many unrelated queries, and keep ingestion batches revertible.
Reason
Retrieval ranks by similarity, not by who is entitled to speak. The PoisonedRAG authors report a 90% attack success rate with five malicious texts per target question in a knowledge base of millions of texts, in their own settings.
Boundary
Corpora with many writers or automatic imports from systems you do not own.

Symptom or risk

One passage written to match a likely question outranks the real policy, and the model repeats it with a citation, so the wrong answer looks sourced.

Small closed corpora where every document is reviewed before indexing.

Review queues slow publishing and lower freshness.

Asking the model to judge which passage is credible, and auditing documents but not their later edits.

Hypothetical: a contractor adds one sentence about free upgrades to a baggage-policy wiki page, and the assistant quotes it.

PoisonedRAG reports that adding five malicious texts per target question to a knowledge database of millions of texts gives a 90% attack success rate, as measured by the authors.
PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models