Where does a RAG system fail?
Retrieval-augmented generation, or RAG, adds retrieved material to the context a language model uses to answer a request. The application must select that material, pass it to the model, and decide how to handle the resulting response. A vector database can support retrieval, but the database, the retrieval policy, and the model are separate parts of the system.
The essays here focus on understanding and measuring security outcomes across those parts. A document reaching the model, an instruction influencing its response, and a monitor detecting that response are different events. Keeping them separate helps explain why two systems can report the same overall injection rate yet need different improvements. The worked examples provide a vocabulary and a way to interpret the measurements.
Choose a starting point
-
Learning RAG
Start with the glossary definition below, then use the channel, decoder, and substrate essay to distinguish the information, interpreter, and environment.
Channel, Decoder, Substrate: A Vocabulary for ML Attacks -
Building or operating systems
Read the worked comparison to identify whether a measurement concerns retrieval, model behavior, or monitoring before choosing a change.
Two RAG systems, same injection rate, different problems -
Researching security
Use the evaluation essay to examine denominators, stage-specific outcomes, detection coverage, and the limits of a headline injection rate.
Two RAG systems, same injection rate, different problems
Read in sequence
-
Channel, Decoder, Substrate: A Vocabulary for ML Attacks
Build a vocabulary for the parts of the system.
16 min read -
Two RAG systems, same injection rate, different problems
See what a single headline metric leaves out.
12 min read
Take the question further
A Field Guide to AI Infrastructure
Place retrieval and vector databases within the wider application infrastructure.