Learning Paths
RAG
Understand how retrieval pipelines put content into context, why rank and citation are not trust, and which controls govern what retrieved data may influence or reach.
- Audience
- Engineers building retrieval systems, architects, security reviewers
- Approximate time
- About 1.5 to 2.5 hours
- Prerequisites
- Foundations path; Basic familiarity with embeddings or search indexes helps
Learning objectives
- Describe the retrieval pipeline and where security trimming belongs
- Separate relevance, rank and citation from trust
- Distinguish knowledge poisoning from prompt injection
- Apply provenance and information flow control to retrieved data
Path sequence
01 Mechanics and attack surface
02 Practice
- 03 - Lab - Controlled simulationRAG Prompt Injection (Lab)
Walk the RAG trust path in a controlled simulation.
- 04 - Lab - Controlled simulationPoisoned Knowledge Base (Lab)
Separate false content from instruction-like content in a controlled simulation.
- 05 - Lab - Controlled simulationRetrieval Relevance vs Trust (Lab)
Practice why the top-ranked chunk is not the most trusted one.
03 Controls and evidence
- 06 - DefenseData Provenance
Tracks where content came from so later decisions can use origin as evidence.
- 07 - DefenseInformation Flow Control
Governs whether specific data may move to a specific sink.
- 08 - DefenseInput / Content Inspection
Inspection produces probabilistic evidence, not authorization.
- 09 - ResearchBIPIA
A benchmark measuring model reactions to instructions embedded in external content; results are benchmark-specific.
Go deeper (optional)
- Incident - Read with its evidence classificationSlack AI - Data Exfiltration via Indirect Prompt Injection
A research demonstration involving retrieval across channels; not a confirmed in-the-wild incident.
- ResearchNot What You've Signed Up For (Greshake et al.)
Early framing of retrieved content as an injection vector.
- DefenseSpotlighting / Data Marking
Marking retrieved data as data; helpful but probabilistic.
Knowledge check
Think through each question, then open it to compare with the expected reasoning. There is no score.
The answer cites the top-ranked chunk. Is the answer therefore trustworthy?
No. Rank reflects similarity to the query and a citation shows where text came from. Neither establishes source authority or correctness.
Where should document-level access control apply in a RAG pipeline?
Before content reaches the model, through security trimming at retrieval. Asking the model to ignore restricted content is not access control.
How does a poisoned fact differ from an injected instruction?
A poisoned fact misleads the answer; an injected instruction tries to redirect the task or actions. Both need provenance, but they call for different reviews.
After this path, you should be able to...
- Explain why relevance, rank and citation are not trust
- Place security trimming before context assembly
- Distinguish poisoning from prompt injection
- Choose provenance and information flow controls for retrieved data