📑 Canary RAG Document

Watermarked docs in vector DBs detecting RAG extraction.

→ Explore in ATT&CK matrix (2 mappings) Deployment detail

What it is

Embed synthetic canary documents with cryptographic watermarks into vector databases and RAG pipelines. When an attacker extracts knowledge base content via prompt injection or RAG extraction attacks, the watermarked canary documents reveal the theft.

Implementation requirements

Vector database access (Pinecone, Weaviate, ChromaDB, pgvector)
Canary document generation with embedded statistical watermarks
Detection pipeline: Query the RAG system with specific trigger queries; analyze responses for watermark presence
Integration with existing RAG infrastructure (LangChain, LlamaIndex)
Rollback: Remove the canary documents and their embeddings from the vector store.
Upkeep: Re-insert the canaries after every re-index or rebuild of the knowledge base. Monthly proof-of-life query.

Technologies

AI/LLMCI/CD

ATT&CK coverage 2

Technique	Tactic	Status	Confidence	Tier
T1213 Data from Information Repositories	Collection	confirmed	strong	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (5 sources) GitGuardian Honeytoken — core concepts — Production honeytokens placed in code repositories, CI/CD, Docker images, Jira, Confluence and Slack; any use of one raises an alert. MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE Engage maps T1213 to its Lures activity. Detecting RAG Extraction Attack via Dual-Path Runtime Integrity Game (CanaryRAG) — (D071) CanaryRAG embeds canary tokens in retrieved chunks to detect knowledge-base extraction through the model. Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection — (D051) LLM-integrated applications follow instructions hidden in content they retrieve. LLM Agent Honeypot: Monitoring AI Hacking Agents in the Wild — (D051) Prompt injections embedded in honeypot responses identified AI hacking agents in the wild (8 potential agents over three months).
T1700 AI-Enabled Exfiltration	Exfiltration	theoretical	moderate	T2
↳ Detection point: the attack step itself touches the decoy
↳ Evidence (4 sources) Beyond Pattern Matching: Seven Cross-Domain Techniques for Prompt Injection Detection — Honeypot tool definitions implemented as a prompt-injection detector in the open-source prompt-shield; no standalone precision reported. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1700 AI-Enabled Exfiltration as an adversary behaviour. Detecting RAG Extraction Attack via Dual-Path Runtime Integrity Game (CanaryRAG) — (D071) CanaryRAG embeds canary tokens in retrieved chunks to detect knowledge-base extraction through the model. Dataset Protection via Watermarked Canaries in Retrieval-Augmented LLMs — (D071) CanaryTrace embeds watermarked canary documents in a RAG corpus to detect unauthorised use.

Evidence

Detecting RAG Extraction Attack via Dual-Path Runtime Integrity Game (CanaryRAG) — Xie, Y. et al., arXiv:2604.10717 2026 peer-reviewed
Dataset Protection via Watermarked Canaries in Retrieval-Augmented LLMs — Liu, Y.; Zhao, X.; Song, D.; Bu, Y., arXiv:2502.10673 2025 peer-reviewed
OWASP Top 10 for LLM Applications 2025 — OWASP 2025 standard
ATLAS: Adversarial Threat Landscape for AI Systems — MITRE standard
MITRE Engage — adversary engagement matrix and ATT&CK mapping — MITRE 2022 standard
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard

Research basis: - Yuanbo Xie et al., "Detecting RAG Extraction Attack via Dual-Path Runtime Integrity Game" (CanaryRAG) — ACL / arXiv:2604.10717, 2026. > - Yepeng Liu et al., "Dataset Protection via Watermarked Canaries in Retrieval-Augmented LLMs" (CanaryTrace) — arXiv:2502.10673, 2025.