Contain and recover from a poisoned RAG index

A compromised connector inserted plausible but false policy documents into the retrieval corpus. Answers citing those chunks reached users for several hours. Design containment, blast-radius analysis, clean recovery, and preventive controls. The index is large, so deleting suspicious rows in place would be faster but would destroy version consistency and make rollback difficult.

connector=shared-drive-v2, source_account=sync-bot-4, ingestion_run=run-983
poisoned document IDs share provenance but have already produced chunks in index build 2026-07-30.4
production alias policy-current -> build 2026-07-30.4
last attested clean build -> 2026-07-29.2.

• Freeze the affected ingestion path and credentials before accepting more content.
• Use provenance to find documents, derived chunks, embeddings, caches, answers, and affected users.
• Switch aliases to an immutable known-good build when its staleness risk is acceptable.
• Rebuild from attested source data rather than mutating the poisoned index in place.
• Evaluate retrieval, groundedness, and known attack cases before promotion.
• Record user-impact and correction obligations as part of incident recovery.

1. Disable the connector, revoke its credentials, freeze the poisoned build, and preserve provenance evidence.
2. Move production retrieval to a known-good immutable build or a degraded trusted-source mode.
3. Trace the compromised ingestion run through documents, chunks, caches, answer citations, and user-visible outputs.
4. Restore trusted source state, add validation or approval, and build a fresh index under a new version.
5. Run integrity checks, labeled retrieval evaluation, attack queries, and citation verification against the new build.
6. Canary and atomically promote the alias, monitor recurrence signals, notify affected parties as required, and retain the incident record.

async def recover_poisoned_index(incident: Incident):
    await connectors.disable(incident.connector_id)
    await credentials.revoke(incident.credential_id)
    await indexes.freeze(incident.poisoned_build)

    clean_build = await indexes.last_attested_clean_before(incident.started_at)
    await aliases.compare_and_swap(
        name="policy-current",
        expected=incident.poisoned_build,
        replacement=clean_build.id,
    )

    impact = await provenance.trace_ingestion_run(incident.ingestion_run_id)
    restored_sources = await sources.restore_and_attest(impact.source_ids)
    candidate = await indexes.build_new(restored_sources, immutable=True)
    report = await evaluations.run(
        candidate,
        suites=["retrieval", "grounding", "poisoning_attacks", "tenant_isolation"],
    )
    if not report.release_gates_pass:
        raise RecoveryGateFailed(report.id)
    await aliases.canary_then_promote("policy-current", candidate.id)
    return impact, report

Impact tracing is linear in affected provenance edges and derived artifacts. A full rebuild is expensive, but immutable versions make containment and rollback constant-time alias operations.

• The last clean index omits recent legitimate policy updates and creates a different correctness risk.
• Cached generated answers outlive the index rollback.
• The compromised connector modified existing documents rather than only adding new ones.
• One source document was copied through another connector and has different provenance.
• Users acted on a false answer before containment.

• Require cache and generated-answer impact analysis in addition to index cleanup.
• Make the known-good build stale and expect an explicit degraded-mode decision.
• Reuse poisoned text through a second source and require content plus provenance investigation.
• Fail one attack-query gate and prohibit alias promotion.
• Verify the production alias changes atomically and the poisoned build remains preserved for forensics.

• Deleting suspicious vectors in place leaves an unverifiable mixture of old and new state.
• Rebuilding from the same compromised source recreates the poison.
• Checking only a few normal queries misses adversarial recurrence.
• Rolling back the index without invalidating answer caches keeps serving poisoned output.
• Technical recovery without user-impact review ignores the consequences of already delivered misinformation.