Stop RAG poisoning, embedding attacks and retrieval data leakage. Hands-on on DVRAG.
This course maps to OWASP AISVS C8, Memory, Embeddings and Vector Database, the family that covers how a RAG system stores, retrieves and isolates its data. You learn the attacks against that layer and then the controls that shut them down, taught by the former Co-Leader of the AISVS (v1.0) standard.
Two-day hands-on course built around DVRAG. Module order and grouping can be adjusted for private deliveries.
How retrieval-augmented generation works from document upload to final answer. You trace a query through the full pipeline: document ingestion, chunking, embedding, vector storage, retrieval, context assembly and generation. You leave with a clear picture of every component and how they connect.
How documents enter the system and become retrievable chunks. You examine parsing, splitting strategies, metadata extraction and the decisions that determine what the model can later retrieve. You identify where untrusted content first enters the pipeline.
How embedding models convert text to vectors and how vector stores index and search those vectors. You study distance metrics, index types and the assumptions that similarity search makes about the data it holds.
Where the trust boundary sits between what the retriever returns and what the model generates. You map the point where retrieved content becomes part of the prompt and examine why this boundary is the most attacked surface in any RAG system.
Planting malicious documents that sit quietly in the index and steer answers only when retrieved for a target query. You craft poisoned chunks, tune them to win similarity search and watch a clean prompt return an attacker-controlled answer on DVRAG.
Manipulating the embedding space to make hostile content appear relevant to queries it should never match. You perturb document embeddings, study how small changes affect retrieval ranking and see how an attacker can force a document into the top results.
Attacking the retrieval step directly by crafting queries or documents that exploit how similarity search ranks results. You test techniques that push legitimate documents down the ranking and pull attacker-controlled content up.
Extracting another tenant's data from a shared vector store. You probe the index boundaries, craft queries that pull chunks across tenant boundaries and measure exactly how much data leaks when isolation is missing or misconfigured.
Flooding the context window with attacker-controlled content so legitimate retrieved documents are pushed out or buried. You test how many poisoned chunks it takes to dominate the context and how this changes the model's answers.
Hiding instructions inside documents that get retrieved and injected into the model's context. You plant instructions in documents, trigger their retrieval and trace how the model follows the injected instructions instead of the user's actual question.
Applying access control to vector databases so a query only returns chunks the caller is allowed to see. You configure row-level and document-level permissions and test that a query from one user never returns another user's data.
Keeping one tenant's data completely separate from another tenant's data in a shared vector store. You implement per-tenant isolation, test the boundaries and verify that cross-tenant queries return nothing they should not.
Encrypting vector data at rest so a compromised storage layer does not expose the underlying documents. You configure encryption for the vector store, verify the data is unreadable without the key and test that search still works correctly over encrypted data.
Backing up vector stores and verifying their integrity so you can detect tampering and recover from corruption. You set up backup procedures, hash the index for integrity checking and test a restore to confirm the data comes back clean.
Scanning documents before they enter the ingestion pipeline. You set up scanning rules that detect embedded instructions, suspicious content patterns and known poisoning signatures, and reject documents that fail before they reach the vector store.
Attaching provenance metadata to every chunk so you can trace each retrieved piece of content back to its source document, its ingestion time and its trust level. You build a provenance chain that holds up under audit.
Filtering retrieved results before they enter the context window. You build filters that check trust level, source, freshness and content safety on every chunk the retriever returns, dropping anything that fails before the model sees it.
Verifying that the model's answer is grounded in the retrieved documents and not hallucinated or steered by injected content. You implement grounding checks that compare the output against the source chunks and flag answers that cannot be traced back to trusted content.
Wiring the caller's identity and permissions into the retrieval query itself so access control is enforced at search time, not bolted on after. You configure scoped retrieval and test that every query respects the caller's access rights from the first vector lookup.
A structured lab where you run every RAG attack against DVRAG. You poison documents, manipulate embeddings, exploit cross-tenant leakage, stuff the context window and inject prompts through retrieved content. Every attack is recorded and scored.
A hands-on lab where you harden the DVRAG pipeline against the attacks from the previous lab. You deploy input scanning, retrieval filtering, output grounding and tenant isolation, then re-run the attacks to verify the defences hold.
A lab focused on provenance tracking and access-scoped retrieval. You build the provenance chain, configure per-user and per-tenant access controls, and test that every query returns only the chunks the caller is entitled to see.
Hands-on with the CyberSecAI tooling, not slideware. You exploit and then defend a real pipeline with the same tools our team uses on live engagements.
The hands-on lab you exploit then defend.
Poisoning and leakage test harness that scores a pipeline.
Retrieval-security checks against a running app, mapped to AISVS C8.
Signed evidence of the retrieval-security tests you ran.
A RAG system reads untrusted documents and feeds them straight into the model's context. A single poisoned document can steer answers, an injected instruction can hijack the model, and a badly isolated vector store can hand one tenant another tenant's data. This course shows you each attack on DVRAG, then the controls that stop it.
Most RAG data leaks are not exotic, they are missing access control on retrieval. You apply row-level and document-level security to the index, enforce per-tenant isolation so one customer never sees another's documents, and put provenance on every retrieved chunk so you can trace where an answer came from.
Every attack you run on DVRAG has a control that stops it. You build each one and test it against AISVS C8, taught by the former Co-Leader of the standard (v1.0).
Screen and clean documents before they ever reach the index.
Row-level and document-level security so tenants stay apart.
Track where every retrieved chunk came from.
Catch injected instructions hidden in retrieved text.
Reduce what an attacker can recover from your vectors.
Prove the controls hold against AISVS C8.
No slideware. You attack a running RAG pipeline on DVRAG, Damn Vulnerable RAG: poison its index, inject through retrieved context, and pull data out of the vector store. Then you build the defenses and prove they hold.
Build and run retrieval systems that stand up to attack.
Add RAG and vector database risks to your security review.
Secure ingestion, indexing and retrieval end to end.
Design retrieval systems you can isolate and prove.
This course counts toward the CyberSecAI AISVS assurance track. Assessment is practical: you exploit and then defend a RAG pipeline on DVRAG and show the retrieval controls hold against OWASP AISVS C8.
Two days, hands-on on DVRAG, mapped to OWASP AISVS C8 and taught by the former Co-Leader of the AISVS (v1.0) standard. Places are limited.
Corporate & sovereign cohorts, and bespoke on-site delivery, on request.