ExamWizardzExamWizardz
Start free
Security

What is retrieval-augmented generation?

Retrieval-augmented generation (RAG) is an AI design that retrieves relevant documents and adds them to the prompt so the model answers from them.

What is retrieval-augmented generation?

Retrieval-augmented generation (RAG) connects a large language model to documents it was never trained on. When a question arrives, the application first retrieves the passages most relevant to it from a knowledge source, such as a wiki, file shares, a ticket history or product manuals, and places them in the model's prompt alongside the question. The model then writes its answer from those passages and can cite them. Researchers at Facebook AI described the approach in 2020, and it is now a widely used way for businesses to point chatbots at their own data.

How RAG works

  1. Ingest: documents are split into chunks, and each chunk is converted into an embedding, a list of numbers that represents its meaning.
  2. Index: the embeddings are stored in a vector database or search index, often with metadata such as the source file and who may read it.
  3. Retrieve: the user's question is embedded the same way, and the closest chunks are returned.
  4. Generate: the application builds a prompt from its instructions, the question and the retrieved chunks, and the model answers.

Because the knowledge lives in the index rather than in the model's weights, updating it is simple: change or delete a document and re-index it.

Security risks in a RAG pipeline

  • Retrieval that ignores permissions. If the index returns any chunk that matches, a user can receive passages from documents they could never open directly. A related failure: retrieval honors permissions, but the permissions were already far too broad, and the assistant makes overshared files easy to find.
  • Poisoned sources. Anyone who can edit an indexed source can plant false statements that the assistant repeats, complete with a citation.
  • Indirect prompt injection. A retrieved document can carry instructions aimed at the model rather than facts.
  • A second copy of sensitive data. Chunks and embeddings taken from HR, legal or customer files often get weaker protection than the originals. Research has shown that embeddings can be partly turned back into text, so they deserve the source's classification.
  • Stale copies. A document deleted or restricted at the source can remain in the index until the next sync.

Example: permission-aware retrieval

An employee asks the company assistant What did we pay the vendors on the Hollis project? A naive pipeline searches every indexed chunk, finds a finance spreadsheet and quotes figures from it. A permission-aware pipeline passes the user's identity with the query and filters results to documents that identity can read, so the finance chunks never reach the prompt and the model replies that it has no information. The filter has to run before the model sees the text. Telling the model not to reveal restricted content after it has already been given that content is not access control.

Defending RAG systems

  • Enforce the source system's permissions at retrieval time, using the asking user's identity rather than a broad service account.
  • Clean up file permissions and apply sensitivity labels before connecting a source to the index.
  • Restrict who can publish to indexed sources, and keep edit history so planted content can be traced and removed.
  • Leave out data classifications the assistant has no reason to answer from.
  • Show the source behind every answer, and keep the index in step with deletions and permission changes.
  • Mark retrieved text as data in the prompt and limit the tools the model can call, since some injected text will get through.

RAG vs. fine-tuning

Fine-tuning changes a model's weights by training it on more examples, so the knowledge becomes part of the model and is hard to remove or restrict per user; taking a fact back out usually means retraining. RAG leaves the model unchanged and supplies knowledge at question time, so access can be checked on each request and a document can be withdrawn by deleting it from the index. For security, RAG's advantage is control, and its cost is a new set of indexes and connectors to protect.

Retrieval-augmented generation on the CompTIA Security+ exam

RAG is a design rather than a threat, so it reaches the exam through AI threats taught under SY0-801 objective 2.6: retrieval poisoning, where false content is planted in a source the assistant searches, and indirect prompt injection, where planted content gives the model instructions. Wording such as the chatbot cited an internal wiki page or the assistant answers from the company's document library describes RAG. Then decide what went wrong. False facts in a source point to poisoning, instructions in a source point to injection, and an assistant revealing files the user was never meant to see points to weak access control on retrieval. Hallucination is the distractor when the false answer came from no source at all.

Studying for CompTIA (Security)?

ExamWizardz turns the official objectives into a guided study plan — with practice tests, realistic PBQs, and a readiness score. Start free.

Start studying free

Related terms

AI hallucination

An AI hallucination is confident, fluent output from an AI model that is false, such as an invented fact, citation, command or package name.

data classification

Data classification labels data by the harm its exposure or loss would cause, such as public, confidential or restricted, and sets handling rules.

data poisoning

Data poisoning corrupts the data a model is trained on or retrieves answers from, so it gives the attacker's chosen output or reacts to a hidden trigger.

large language model

A large language model (LLM) is an AI model trained on vast amounts of text to predict the next token, used in chatbots, coding assistants and AI agents.

principle of least privilege

The principle of least privilege is a security rule that gives each user, account or process only the access it needs to do its job, and nothing more.

prompt injection

Prompt injection is crafted input that an LLM treats as instructions, overriding what its application intended, directly or hidden in content it reads.

← Back to the full CompTIA glossary