hackagent.attacks.techniques.rag.attack

RAG Attack implementation (indirect prompt injection via RAG poisoning).

Implements an end-to-end RAG poisoning attack:

1. Parse source documents
2. Poison documents using attacker LLM
3. Chunk and embed poisoned docs into local FAISS index
4. Generate benign queries per goal
5. For each query: retrieve from FAISS → augment prompt → send to target
6. Judge evaluates if target followed poisoned instructions

parse_documents

def parse_documents(sources: List[str], include_globs: List[str],
                    recursive: bool, fail_on_parse_error: bool,
                    logger: logging.Logger) -> List[Dict[str, Any]]

Load documents from file paths and directories.

Returns list of {"id": str, "text": str, "path": str}.

chunk_text

def chunk_text(text: str,
               chunk_size: int = 1000,
               overlap: int = 200) -> List[str]

Split text into overlapping chunks.

chunk_text_with_offsets

def chunk_text_with_offsets(text: str,
                            chunk_size: int = 1000,
                            overlap: int = 200) -> List[Tuple[str, int, int]]

Split text into overlapping chunks and keep char offsets.

get_embeddings

def get_embeddings(texts: List[str], config: Dict[str, Any],
                   logger: logging.Logger) -> np.ndarray

Get embeddings using OpenAI-compatible API.

build_faiss_index

def build_faiss_index(embeddings: np.ndarray) -> faiss.IndexFlatIP

Build a FAISS inner-product index from embeddings.

search_index

def search_index(index: faiss.IndexFlatIP,
                 query_embedding: np.ndarray,
                 top_k: int = 4) -> List[int]

Search FAISS index and return top-k indices.

RagAttack Objects

class RagAttack(BaseAttack)

RAG Attack: indirect prompt injection via RAG document poisoning.

Pipeline:

1. Parse source documents
2. Poison selected documents using attacker LLM
3. Chunk and embed poisoned docs into FAISS
4. Generate benign queries per goal
5. Retrieve context from FAISS and query target agent
6. Judge evaluates responses for poisoning success

run

def run(goals: Optional[List[str]] = None, **kwargs) -> List[Dict[str, Any]]

Execute the RAG Attack (indirect prompt injection).

Arguments:

• goals - List of malicious goals to inject.

Returns:

List of result dicts per goal with evaluation metrics.