Pre-Model Interception Points Where Vendors Stop Indirect Prompt Injection in Enterprise RAG

Indirect prompt injection detection in enterprise RAG pipelines requires checks at ingestion, retrieval, prompt assembly, policy enforcement, and tool execution, with shared state across those stages. No single classifier covers poisoned documents, reformatted instructions, and multi-turn attacks.

Why indirect prompt injection is structurally different from direct injection in RAG pipelines

Direct injection comes through the user input channel, so input scanning can check the attack itself. Indirect injection comes through content that the system retrieves. An attacker might plant instructions in a SharePoint document that an ordinary user later asks the system to consult. The attacker need not be present then. The user’s request can be entirely legitimate while the retrieved document attempts to redirect the model.

Scanning the user’s message cannot detect instructions found only in the retrieved document, so the relevant boundary lies between the data source and the model. OWASP classifies both forms under LLM01 in its Top 10 for LLM Applications because both induce unintended instructions. Their entry points, however, demand different controls.

How the attack surface expanded once RAG became the dominant enterprise retrieval pattern

RAG retrieves top-k chunks from a vector index and concatenates them into the context window with the user’s query. If an attacker can write to an indexed source, a poisoned document can be crafted to rank for a targeted query. One document can then reach many users. PoisonedRAG, presented at USENIX Security 2025, demonstrated that a very small number of crafted documents among millions can achieve high attack success rates. Bulk poisoning is not required.

Multi-agent systems extend that reach because one agent’s output becomes another’s input. A successful injection can propagate beyond the first retrieval boundary into later planning and execution. Filed vulnerabilities show the production consequences. CVE-2025-54132 involved diagram-based data exfiltration in Cursor IDE. These are not merely cases of a model giving an unwanted answer.

Why a sequence of discrete interception points is needed, not a single classifier

Would a classifier that is accurate enough solve the problem? Only if each inspection exposed everything needed to recognize the attack. A payload spread across chunks or conversation turns can look harmless when each part is checked on its own, and reformatting can hide instructions from a content detector. Each stage can show different evidence about the same content. Their ordering therefore determines what a defense can know before allowing the next step.

Earlier interception is cheaper but has less context. Later checks can inspect retrieved combinations or proposed actions, though the payload is then closer to influencing the model or its tools. The promptware kill chain paper by Brodt, Feldman, Schneier, and Nassi frames injection as a multistage security problem. The architectural response is both distributed and stateful, with checks at distinct boundaries and evidence retained between them.

Interception Point 1 — corpus ingest and write-time screening before content enters the vector store

Ingest screening has a property no later check shares. It can prevent malicious content from becoming retrievable at all. Lexical and statistical checks look for known injection templates, structural anomalies, and policy violations in incoming documents before they enter the vector store. TriShieldRAG’s 2026 framework formalizes this as its “Ring 1” screening layer, positioned before retrieval. Every later interception point checks content that has already passed this boundary or come in through another route.

Its coverage is necessarily bounded by that position. An enterprise can screen documents it controls at ingest, but not live API outputs, real-time web content, or tool responses that arrive later. A document may also look benign until paired with a particular query, while base64 or Unicode obfuscation can evade lexical checks. Query rewriting can also help by disrupting the similarity mapping between triggers chosen by an attacker and poisoned text. Because it changes the user query, however, it changes retrieval rather than deciding which documents enter the corpus.

Interception Point 2 — retriever-internal filtering that operates on similarity scores before chunks are promoted

RAGPart and RAGMask inspect retrieval behavior rather than asking a classifier whether text looks malicious. Both were presented at the AAAI 2026 Workshop on New Frontiers in Information Retrieval. RAGPart uses document-partitioning dynamics to identify chunk-level behavior inconsistent with benign retrieval patterns. RAGMask measures the change in a document’s similarity score when selected tokens are masked. A sharp shift suggests that its rank depends on particular adversarial tokens.

Neither method requires changes to the generation model. That makes this boundary a lightweight place to screen candidates before they are promoted into context. But suspicious ranking behavior is not the same as malicious intent, and normal-looking retrieval does not prove safety. The authors make clear that both methods protect retrieval and have no generation-stage check. Poison that gets through this filter still needs a post-retrieval check.

Interception Point 3 — post-retrieval document scanning and content transformation before the prompt is assembled

Azure AI Content Safety Prompt Shields is a commercial classifier used at this boundary. Microsoft recommends it as a primary control, with a unified API covering User Prompt attacks and Document attacks before content generation. The latter includes indirect instructions in RAG sources, attachments, and tool outputs. This is the relevant coverage for third-party data. Microsoft’s Azure AI Foundry mapping places Prompt Shields at general availability for models and agents, while explicitly pairing probabilistic classifiers with deterministic controls.

Microsoft’s Spotlighting takes a different approach by transforming retrieved content so the model treats it as less trustworthy than user and system prompts. Its techniques include base-64 encoding and datamarking. Published tests found that datamarking reduced attack success from over half to below two percent, with little task-quality loss. Spotlighting is a Preview, model-only capability. It changes how content is presented without establishing what a tool is authorized to do.

The evasion evidence exposes the limits of this boundary. Production guardrail tests using emoji smuggling, Unicode tags, homoglyphs, and zero-width characters found substantial evasion, with emoji smuggling achieving full evasion across the tested guardrails. EchoLeak, CVE-2025-32711, demonstrated a production failure against Microsoft 365 Copilot. A crafted email bypassed Prompt Shields through linguistic obfuscation, then used reference-style Markdown rather than inline links to slip an exfiltration link past the output filter. The zero-click exploit makes downstream authorization controls essential alongside better scanning.

Interception Point 4 — policy-aware selective sanitization at retrieval that treats the problem as access control

A disclosure policy asks a different question from a classifier. Instead of deciding whether a passage resembles an attack, it decides whether the content may reach the model under defined access rules. SD-RAG, by Al Masoud, Arazzi, and Nocera in 2026, applies sanitization and disclosure controls during retrieval, before input augmentation. Its semantic mechanism accepts human-readable, dynamic security and privacy constraints. A graph-based data model supports fine-grained retrieval that can suppress or sanitize content violating those policies.

This approach addresses persuasive content without recognizable injection syntax. A passage need not say “ignore your previous instructions” to seek a disclosure that policy forbids. SD-RAG’s evaluation reported up to a 58% improvement in privacy score, with strong resilience to prompt injection targeting the generative model. Its protection still depends on disclosure policies that are defined in a machine-readable form. Gaps in the policy graph leave the same gaps in what it protects.

Google’s User Alignment Critic provides a parallel separation of responsibilities. A separate model evaluates proposed agent actions using metadata, with the untrusted web content itself excluded from the evaluation. This check looks at the proposed action, while retrieval sanitization looks at content, but both can act on more than recognizable attack wording.

Interception Point 5 — information-flow control at the tool and agent layer before a privileged action fires

Tool-layer enforcement comes after the checks that run before content reaches the model. It is the last structural gate before a surviving injection can trigger a privileged action. FIDES, the Flow Integrity Deterministic Enforcement System, assigns content integrity labels of trusted or untrusted and confidentiality labels of public, private, or user_identity. It propagates these through tool calls using a most-restrictive-wins rule, with per-tool policies such as accepts_untrusted=False. A quarantined LLM processes untrusted text without tool access, making the enforced boundary deterministic rather than dependent on successful attack recognition.

FIDES is still experimental and works with only one programming language in Microsoft’s agent-framework-core, as of v1.3.0, under agent_framework.security. Neural Cryptographic Services, or NCS, is a different research approach that was tested on an agent benchmark. Its untrusted neural planner drafts plans, while a deterministic symbolic controller authorizes execution through an offline-signed, hash-chained instruction stream. Altered or out-of-order calls fail closed. NCS does not promise to prevent planner compromise, but to prevent a compromised planner from dispatching actions outside its cryptographic authorization.

That separation can guard against attacks that get through every upstream filter. It also addresses cross-agent escalation, where injected output from one agent seeks high-privilege tools through another. The February 2026 Cline/OpenClaw attack shows the stakes at execution. Injection in issue triage run by Claude-powered GitHub Actions led to a compromised npm package that silently installed OpenClaw, a legitimate open-source AI agent, on approximately 4,000 developer machines. Cline’s investigation found no evidence of data exfiltration or credential exposure, so this case demonstrates unauthorized software installation.

Why stateless checkpoints at each layer individually fail and stateful belief tracking across layers is required

In their 2026 evaluation of Fujitsu Research’s MMA-RAGT, Singh et al. found that attack success rose by twenty-six point four percentage points when belief-state tracking was removed. Under homogeneous stateless filtering, adding checkpoints yielded zero marginal benefit because detection events became perfectly correlated. Repetition alone added no new protection in that setting. A sleeper payload illustrates why history is needed, as instructions planted across turns can activate on a trigger in a later session. Microsoft reported more than 50 hidden prompts from 31 companies designed to plant lasting recommendations in AI memory.

MMA-RAGT models adversarial intent as a latent variable inferred from noisy observations across stages. Its Modular Trust Agent keeps a cumulative belief state across five checkpoints and updates that state instead of making a separate binary decision at each checkpoint. Evaluation across tens of thousands of instances found a substantial average reduction in attack success with negligible utility cost. Both spatial coverage and retained history were necessary. Neither replaced the other.

Logging, belief propagation, or policy enforcement across the pipeline can keep evidence that a filter working on its own would discard. Otherwise, a suspicious retrieval, a later planning step, and a tool request that follows stay separate events. The compound attack becomes visible only when the defense can relate them.

What the evasion record reveals about the limits of pre-model interception and what it does not excuse

The strongest objection is that adaptive attackers can evade classifiers. Encoding, semantic persuasion, character manipulation, and languages outside a detector’s training coverage leave no fixed set of patterns that closes the problem. But perfect detection is not the only useful outcome. Pre-model interception can raise attack cost and shrink the exploitable surface, while policy and tool controls constrain what surviving instructions can accomplish.

Microsoft expanded Prompt Shields’ training coverage in October 2026 for Chinese, French, German, Italian, and Portuguese. That update illustrates an operational model of continuous improvement. For TPRM, InfoSec, and Legal teams, the practical requirement is continuous assessment of vendor AI assets, including which interception points exist, what they inspect, and whether their signals connect. A deployed classifier is one control to monitor as part of ongoing management of inherited risk.