Embed in a route
<FigureFromSource sourcePath="content/publications/figures/products/rag-harness.dsl.md" figureId="RAG-02" />
RAG-02
RAG Failure-Mode Coverage
A useful harness separates prompt injection, corpus poisoning, cross-tenant retrieval, provenance loss, and unsafe action propagation.
coverage matrix
Failure modes
Ingest
Retrieve
Assemble
Generate
Act
Retest
Indirect prompt injection
Hostile instructions enter through retrieved content.
Covered
Covered
Covered
Covered
Partial
Covered
Corpus poisoning
Malicious or misleading content affects retrieval and generation.
Covered
Covered
Partial
Covered
Partial
Covered
Cross-tenant retrieval
Content crosses an intended tenant or access boundary.
Partial
Covered
Covered
Covered
Partial
Planned
Provenance loss
The system cannot preserve or communicate source origin and trust.
Covered
Covered
Covered
Partial
Unknown
Covered
Unsafe action propagation
Retrieved content influences a tool or consequential action.
Not applicable
Partial
Covered
Covered
Covered
Partial
Indirect prompt injection
Hostile instructions enter through retrieved content.
- Ingest
- Covered
- Retrieve
- Covered
- Assemble
- Covered
- Generate
- Covered
- Act
- Partial
- Retest
- Covered
Corpus poisoning
Malicious or misleading content affects retrieval and generation.
- Ingest
- Covered
- Retrieve
- Covered
- Assemble
- Partial
- Generate
- Covered
- Act
- Partial
- Retest
- Covered
Cross-tenant retrieval
Content crosses an intended tenant or access boundary.
- Ingest
- Partial
- Retrieve
- Covered
- Assemble
- Covered
- Generate
- Covered
- Act
- Partial
- Retest
- Planned
Provenance loss
The system cannot preserve or communicate source origin and trust.
- Ingest
- Covered
- Retrieve
- Covered
- Assemble
- Covered
- Generate
- Partial
- Act
- Unknown
- Retest
- Covered
Unsafe action propagation
Retrieved content influences a tool or consequential action.
- Ingest
- Not applicable
- Retrieve
- Partial
- Assemble
- Covered
- Generate
- Covered
- Act
- Covered
- Retest
- Partial
Coverage states
CoveredPartialPlannedUnknownNot applicable
The matrix must be reviewed against the live harness. A named failure mode is not evidence that every pipeline stage is covered.
About this figure
This coverage matrix frames a RAG harness around five failure modes that commonly break end-to-end reliability: indirect prompt injection, corpus poisoning, cross-tenant retrieval, provenance loss, and unsafe action propagation. It maps those risks across the full pipeline, from ingest and retrieve through assemble, generate, act, and retest, so each stage can be evaluated for both attack exposure and control effectiveness.
The abstract emphasizes that useful coverage is not just about finding failures, but about making them observable and repeatable. By assigning states such as covered, partial, planned, unknown, and not applicable, the harness reveals where defenses are already exercised, where evidence is weak, and where the system still permits risky behavior to propagate into downstream actions.
Citation
RAG Failure-Mode Coverage (RAG-02). AI Security LLC Figure Library. https://aisecurity.llc/publication-dsl/figures/RAG-02