Defend your RAG documents against indirect prompt injection

Someone could hide an instruction inside a PDF my RAG system indexes, and I have no idea what it would do with that.

AdvancedRead 7 minDoing: an afternoon, with edit access to your system prompt and the code that assembles retrieved chunks7 steps

▶ Start

What you'll have at the end

A test document with a hidden instruction that your RAG system now ignores instead of obeying

Before you start

You need

A working RAG pipeline that indexes real documents and answers real questions from them, plus edit access to its system prompt and whatever code turns retrieved chunks into the prompt.

Not covered

Attacks typed straight into the chat box by a user; this defends the documents your system reads, not the conversation it has.

Leans on

RAG (Retrieval Augmented Generation) Cheat SheetCarries the observability and security row naming this exact attack surface inside a retrieval pipeline.
LLM Security & Safety Cheat SheetCarries the fuller input and output validation rows the defenses in this recipe are drawn from.

7 steps

Checked 15 Aug 2026

Part of the RAG (Retrieval Augmented Generation) cookbook