Course Objective & Scope
RAG systems take their answers from a knowledge base, so a handful of malicious documents added to a wiki, shared folder or crawled web source is enough to produce wrong or harmful answers to specific questions. The course demonstrates PoisonedRAG-style targeted attacks, text optimised to manipulate retrieval, embedding and vector database weaknesses, and documents carrying embedded instructions.
On the defensive side it builds source verification, content scanning, provenance metadata, trust-weighted reranking and anomaly monitoring of retrieval results into the ingestion pipeline.
Who Should Attend?
- AI engineers who design and operate RAG pipelines
- Knowledge management and enterprise search platform teams
- Data engineers and platform engineers
- Prerequisite: familiarity with chunking, embeddings and vector databases
Key Takeaways
- Build a targeted poisoning scenario against a RAG system
- Define trust levels for sources entering the knowledge base
- Apply content scanning and provenance checks at ingestion
- Reduce the impact of poisoned content with reranking and source attribution
- Set up metrics that monitor anomalies in retrieval behaviour
Curriculum
The RAG Attack Surface
- Sources, ingestion, embedding, indexing and retrieval steps
- OWASP's vector and embedding weaknesses risk
Poisoning Techniques
- Targeted Q&A poisoning and retrieval-manipulating text
- Instruction-bearing documents and metadata manipulation
Attack Lab
- Poisoning attempt against a sample enterprise knowledge base
- Impact measurement: which questions were affected, and how often
A Secure Ingestion Pipeline
- Source verification, content scanning and provenance metadata
- Change approval and versioned indexes
Defence and Monitoring at the Retrieval Layer
- Trust-weighted reranking and source attribution
- Monitoring retrieval anomalies and answer consistency
Other Courses in This Category
-
Covers pickle-based code execution, backdoors, licensing and provenance risks in models sourced from hubs such as Hugging Face, and how to manage them with safetensors, ModelScan, model signing and an AI-BOM (CycloneDX).
- Live Course
- 5 modules
-
Teaches how to prevent confused deputy and privilege escalation risks in autonomous agents through workload identity, OAuth 2.0 On-Behalf-Of delegation, dynamic scope attenuation and OPA/Cedar policy enforcement.
- Live Course
- 5 modules
-
Combines STRIDE with MITRE ATLAS and the OWASP Top 10 for LLM and Agentic AI to produce end-to-end AI threat models, trust boundary diagrams and control matrices for LLM, RAG and agent architectures.
- Live Course
- 5 modules
-
Teaches how to plan and execute scenario-driven red team campaigns against LLM, RAG and agent systems using PyRIT, garak and promptfoo, build multi-turn exploit chains and deliver reproducible findings.
- Live Course
- 5 modules
-
Teaches how to design and operate low-latency guardrails across input, retrieval, tool calling and output stages using NeMo Guardrails, Guardrails AI, Llama Guard and deterministic policy engines.
- Live Course
- 5 modules
-
Teaches how to build automated security evaluation suites for LLM and agent applications using promptfoo, garak and Inspect AI, enforce regression gates in CI/CD pipelines and continuously test model and prompt changes.
- Live Course
- 5 modules
Get in touch
