KezoSec/rag-poisoning-lab

A self-contained Docker lab that demonstrates four classes of attacks against Retrieval-Augmented Generation (RAG) systems and defenses, validated on a local model (Llama 3.2 3B) and a frontier model (Claude Haiku 4.5). Intended for security researchers, red teams, and engineers building/defending RAG pipelines. Key features: - Reproducible attack scripts that inject payloads into a Chroma vector DB (document poisoning, indirect prompt injection, data exfiltration, PDF invisible-text smuggling). - Local offline Llama via Ollama and optional Anthropic Claude integration; sentence-transformers embeddings; Docker Compose orchestration. - Working defense: regex-based output filter and JSON evidence for each outcome. - Headline finding: stronger reasoning/helpfulness in frontier models can increase susceptibility to content-poisoning; model safety is shape-based, so retrieval-layer controls are required.

AI-related keywords found in this repo's description, topics, or README summary — grouped by category. Each badge links to the corresponding ranking detail page.