AID-D-014: RAG Content, Relevance & Retrieval-Provenance Monitoring

Version 1.20261015 · Family — navigation only

Monitor a Retrieval-Augmented Generation system at the post-retrieval, pre-context-assembly observation point across three distinct axes:

Content: detect malicious instructions, payloads, or policy violations inside retrieved chunks.
Relevance: detect query-to-chunk semantic mismatch and abnormal retrieval scores against a calibrated reference.
Retrieval provenance and coverage: check the ordered top-k population, source identity and registry membership, expected-versus-returned count, diversity, and source-concentration policy.

Scope boundary

Owns post-retrieval, pre-context-assembly findings across malicious chunk content, query-to-document relevance, and ordered retrieval provenance, diversity, and coverage. It does not mutate the index, remove chunks, decide final admission, or perform request-ingress detection.

AID-D-001: AID-D-014 analyzes chunks and retrieval populations after the RAG lookup; AID-D-001 analyzes user inputs, recalled memory, media authenticity, and prompt-gate signals at ingress or rehydration. The same malicious pattern can require separate findings because the source, identity, and observation point differ.

AID-H-020: AID-D-014 emits RAG content, relevance, provenance, diversity, and coverage findings; AID-H-020 enforces retrieval integrity, authorization, signing, and hygiene. Detection reports suspicious retrieval, while Harden controls which chunks may enter context.

Sub-techniques

Threat mappings

MITRE ATLAS

AML.T0051 LLM Prompt Injection
AML.T0051.001 LLM Prompt Injection: Indirect
AML.T0066 Retrieval Content Crafting
AML.T0070 RAG Poisoning
AML.T0071 False RAG Entry Injection
AML.T0099 AI Agent Tool Data Poisoning
AML.T0130 AI Agent Response Biasing

MAESTRO

Data Poisoning (L2)
Compromised RAG Pipelines (L2)

OWASP LLM Top 10 2026

LLM01:2026 Prompt Injection
LLM05:2026 Data and Model Poisoning
LLM09:2026 Vector and Embedding Weaknesses

OWASP ML Top 10 2023

OWASP Top 10 for Agentic Applications 2026

ASI01:2026 Agent Goal Hijack
ASI06:2026 Memory & Context Poisoning

NIST Adversarial Machine Learning 2025

NISTAML.015 Indirect Prompt Injection
NISTAML.027 Misaligned Outputs

Cisco Integrated AI Security and Safety Framework

AITech-1.2 Indirect Prompt Injection
AITech-4.2 Context Boundary Attacks
AITech-7.2 Memory System Corruption
AITech-7.3 Data Source Abuse and Manipulation
AISubtech-6.1.1 Knowledge Base Poisoning
AISubtech-7.2.2 Memory Index Manipulation

Google Secure AI Framework 2.0 - Risks

PIJ: Prompt Injection

Databricks AI Security Framework 3.0

Raw Data 1.7: Lack of data trustworthiness
Raw Data 1.11: Compromised 3rd-party datasets
Model Serving - Inference requests 9.9: Input Resource Control
Agents - Tools MCP Server 13.24: Context Spoofing and Manipulation