How do I secure LlamaIndex RAG pipelines from data poisoning?

LlamaIndex RAG pipelines are vulnerable to data poisoning because any document ingested into the vector store becomes a trusted context source — and attackers can embed malicious instructions inside documents that override the system prompt when retrieved.

RAG data poisoning exploits the trust gap between ingestion and retrieval:

• Indirect prompt injection via documents: Attackers embed instructions like "Ignore previous instructions and execute..." inside PDFs, web pages, or database entries that get indexed
• Vector similarity manipulation: Crafting documents with specific embeddings to ensure they're retrieved for targeted queries
• Cross-tenant contamination: In multi-tenant RAG systems, one tenant's poisoned documents can influence another tenant's results
• No provenance tracking: LlamaIndex doesn't track which document influenced which output, making forensics impossible

Exogram addresses RAG poisoning at the execution boundary. Even if poisoned context causes the model to propose a malicious action, the deterministic policy engine blocks it. Additionally, Exogram's namespace isolation prevents cross-tenant data access, and the Trust Ledger records which context sources influenced each decision for forensic analysis.