Re:Show HN: RAG knowledge base poisoning lab, 100% local
by salawat on Thursday March 12, 2026 @07:46PM
(#47358884)
But you can't do that. That would implicitly out where the knowledge came from, and we all know that the AI industry has an existential incapability to actually cope with that little turd. Might work great for data you actually own, got access to. Imagine that applied back to the latent space of LLM's though. Plus, wouldn't all of that eat through context window like no tomorrow?
[ Parent
| on HN ]
Re:Show HN: RAG knowledge base poisoning lab, 100% local
by sidrag22 on Thursday March 12, 2026 @08:09PM
(#47359084)
you're conflating the rag layer with the actual model, the rag metadata will exist in a properly designed system and its simply a matter of structuring the agent so that it provides references to it, or even just appending it manually at the bottom or something.
Re:Show HN: RAG knowledge base poisoning lab, 100% local
by aminerj on Thursday March 12, 2026 @08:21PM
(#47359167)
sidrag22 is right on the technical separation. The more interesting question for this specific attack is whether provenance metadata changes model behavior at generation time, not just provides an audit trail after the fact.
In my testing, the poisoned documents were more authoritative-sounding than the legitimate one — "CFO-approved correction", "board-verified restatement" vs. a plain financial summary. The legitimate document had no authority signals at all. If chunk metadata included "source: finance-system, ingested: 2024-Q1, author: [email protected]" surfaced directly in the prompt context, the model has something to reason about rather than just comparing document rhetoric.