Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper investigates a vulnerability in retrieval-augmented generation (RAG) systems, termed Document-Authored Control-Signal Impersonation (DACSI), where attacker-authored documents can masquerade as legitimate control signals, undermining system safety. By evaluating DACSI across various model settings and prompt pressures, the authors find that certain models are particularly susceptible to this indirect prompt attack, revealing a critical flaw in how RAG systems handle untrusted text. The study highlights the necessity for distinct evaluations of document-authored signals, as they can be misattributed as authoritative, posing significant risks to RAG safety boundaries.
Untrusted documents can masquerade as legitimate control signals in RAG systems, exposing a critical vulnerability that could compromise safety protocols.
Retrieval-augmented generation (RAG) systems often serialize user queries, retrieved documents, metadata, system labels, and task instructions into one natural-language prompt. We study a source-authority boundary failure in this design: attacker-authored retrieved text can impersonate metadata, provenance, authority, or disclosure-policy signals that appear control-relevant to the model. We call this pattern Document-Authored Control-Signal Impersonation (DACSI). DACSI is a non-imperative, metadata-like payload subclass within indirect prompt injection. Its central lesson is simple: document-authored labels are data, not policy. Command-style injection asks the model to ignore, override, or violate policy; DACSI asks whether untrusted document text can be misattributed as an authorized control signal when RAG prompt rendering collapses trusted and untrusted text into the same natural-language channel. We evaluate DACSI across six model settings, prompt-pressure levels, injection baselines, signal taxonomies, RAG-mediated pipelines, system-control probes, a source-authority attribution probe, and synthetic canary formats. We interpret the evidence by model regime rather than as six equal replications: DeepSeek V4 Pro and Qwen3.5-397B provide the cleanest positive lift, DeepSeek V4 Flash is a high-susceptibility setting, GPT-5.5 and Gemini 3.1 Pro Low are strong-boundary probes with selected residual risks, and GLM-4.7 is a saturated leakage boundary case. Across these regimes, DACSI warrants separate evaluation because it uses a command-free metadata/provenance/policy surface, follows a RAG-specific source-authority path, and responds to source/channel separation. The source-authority probe is behavioral attribution evidence, not proof of an internal mechanism.