Used in: Definition slides (02–04), vulnerability framework (09–13), mitigation framework (18–23). The authoritative source for the AG06 definition, root causes, memory tier taxonomy, and mitigation recommendations.

Used in: Slides 10, 27 (RAG poisoning via crawled web content, indirect prompt injection framework). The foundational paper establishing indirect prompt injection as a distinct attack class. Included demonstrations against production systems (Bing Chat/Copilot) where web-retrieved content poisoned the model's context to exfiltrate user data. Directly established the theoretical basis for Type 1 and Type 4 AG06 vulnerability categories.

Used in: Slides 11, 27 (Type 3 — preference/profile poisoning real example). Researcher demonstrated that ChatGPT's persistent memory feature could be abused via indirect prompt injection — malicious content in processed documents caused the model to write false persistent facts that survived across all future sessions. OpenAI partially patched the issue. This is the first documented instance of cross-session memory persistence attack against a production AI assistant.

Used in: Slides 10, 12, 14 (RAG poisoning and indirect ingestion patterns). Multiple independent research groups demonstrated that enterprise RAG systems with automated document ingestion are vulnerable to poisoning via carefully crafted documents that score high semantic similarity for target queries. Demonstrated against enterprise knowledge base deployments, customer support RAG systems, and automated email processing pipelines.

Used in: Slides 13, 15 (Type 6 — memory extraction, Scenario 3). Documented finding pattern from security assessments of multi-tenant RAG deployments: application-layer tenant filtering in shared vector stores can be bypassed by prompt injection that instructs the agent to perform unscoped queries. Demonstrated data leakage across tenant namespaces without any privileged access. Primary mitigation is database-level namespace isolation rather than application-layer filtering.

Used in: Slides 12, 15 (Type 5 — multi-agent contamination, Scenario 4). Documented attack pattern in multi-agent systems where a poisoned write to a shared memory or knowledge store propagates across all agents that read from it. Particularly relevant for agent orchestration frameworks that use a common memory bus or shared vector store for inter-agent coordination.

Used in: Mitigation framework (slides 18–23). V8 requirements for sensitive data protection, data classification, and access control inform MIT03 (memory access controls) and MIT06 (tier separation). V1 (Architecture) requirements for security by design inform the memory tier architecture recommendations.

Used in: Mitigation framework structure. The Govern, Map, Measure, and Manage functions of the NIST AI RMF provide the organizational context for memory system risk management. The "Manage" function's emphasis on monitoring and response aligns with MIT08 (audit logging) and MIT09 (periodic integrity review).

Used in: Slide 27 (research context). Background on data poisoning at scale — establishes that even small poisoning rates in large datasets can have meaningful effects on model behavior. The same scalability principle applies to RAG systems: a small number of poisoned documents can dominate retrieval for specific queries if crafted to score high semantic similarity.