RAG Poisoning Attacks COASP Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary goal when crafting an adversarial document for a RAG poisoning attack?

   • ATo ensure the document is never retrieved by the retriever
   • BTo increase the token count of the document to slow down the LLM
   • CTo make the document appear as a legitimate source so it is indexed and retrieved
   • DTo cause the embedding model to crash when processing the document
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company's RAG system is being redesigned to be more resilient to poisoning. The team has a limited budget and must choose between two controls: (1) a content filter that scans documents for known malicious patterns, and (2) a monitoring system that logs retrieved documents and flags anomalies. Which control should be prioritized?

   • AImplement neither control and rely on the LLM's ability to ignore malicious instructions.
   • BImplement the monitoring system first, because it can detect attacks that the filter misses.
   • CImplement both controls simultaneously, even if it exceeds the budget.
   • DImplement the content filter first, because it prevents malicious content from entering the knowledge base.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company's RAG system uses a vector database that is populated from multiple sources. A security audit identifies that a poisoned document from a public source is being retrieved and causing harmful outputs. The team wants to implement a mitigation that reduces the risk without completely removing the public source. Which approach is most effective?

   • ARemove all public sources from the ingestion pipeline.
   • BAdd a system prompt that instructs the LLM to ignore any instructions from public sources.
   • CImplement a source-trust scoring system that down-weights documents from public sources during retrieval.
   • DIncrease the similarity threshold for all queries.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   An attacker wants to poison a RAG system's knowledge base. Which action would directly achieve this?

   • AUploading a document containing false information to the document store that the RAG system indexes
   • BSending a crafted prompt to the LLM that includes a hidden instruction
   • CModifying the LLM's system prompt to include biased instructions
   • DIntercepting and altering the network traffic between the user and the LLM
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A RAG system for a medical research library uses a vector database and an LLM. An attacker poisons a research paper that is then retrieved for a query about drug interactions. Which component of the RAG architecture is most directly responsible for the incorrect answer?

   • AThe LLM's training data, which lacks information about the drug interaction.
   • BThe retrieval component, which selected the poisoned paper as relevant context.
   • CThe vector database's indexing algorithm, which failed to detect the poisoning.
   • DThe user's query, which was not specific enough.
   Reveal Solution Discussion Select an answer first