Slide 8 of 27
Part 1 · What Is It?Slide 8
Slide 8 · The Misconception
“We validate user prompts, so we’re safe.”
This is the most dangerous assumption in RAG security.
The Wrong Mental Model

Most security controls on LLM applications are designed to inspect what the user sends. Rate limiting, content moderation, input validation — all guard the front door. LLM08 doesn’t come through the front door.

The Actual Threat Model

The attack arrives as a normal-looking document in your knowledge base — possibly days or weeks before any user submits a query. By the time the AI gives a poisoned answer, the attacker may be long gone. The “malicious input” was never visible to any content filter.

❌ What Teams Typically Guard
User prompt content
Query rate and length limits
LLM output moderation
✅ What LLM08 Requires
Knowledge base ingestion controls
Retrieval permission enforcement
Vector store monitoring
← BackNext → The 4 attack types