Evaluating Defenses Against Prompt Injection and Retrieval Poisoning in Bengali Educational RAG Systems

mindmap
  root((Bengali RAG Security))
    Problem
      No evaluated defenses
      Bengali is underserved
      Educational harm
    Gap
      RIPE-II covers English only
      OWASP LLM01 general
      NCTBench has no security eval
    Attacks
      Prompt Injection
        Indirect via retrieved docs
        Hidden instructions
      Retrieval Poisoning
        Fake documents in index
        Rank high for queries
    Defense
      Provenance-based
        Source signing
        Integrity checks
        Instruction-data separation
      Evaluation
        ASR reduction
        Accuracy preserved
        Latency overhead
    Dataset
      NCTBench
        12403 QA pairs
        CC-BY-4.0
        Classes 6-9
    Metrics
      Attack Success Rate
      Retrieval Precision
      Answer Accuracy EM-F1
      Latency p50-p95-p99
    Deliverables
      Baseline RAG
      Attack suite
      Defense evaluation
      Thesis and paper
      

flowchart LR
    A[Student Query] --> B[Retriever]
    B --> C{Vector Store}
    C --> D[Retrieved Documents]
    D --> E[LLM Prompt Builder]
    E --> F[LLM Generator]
    F --> G[Answer to Student]
    X1[ATTACK 1 - Prompt Injection] -.-> D
    X2[ATTACK 2 - Retrieval Poisoning] -.-> C
    style X1 fill:#ffcccc,stroke:#cc0000,stroke-width:2px
    style X2 fill:#ffcccc,stroke:#cc0000,stroke-width:2px
    style A fill:#cce5ff
    style G fill:#ccffcc
      

flowchart TB
    subgraph A1["ATTACK 1 - Prompt Injection"]
        A1a[Legitimate textbook page] --> A1b[Hidden instruction added]
        A1b --> A1c[Retrieved by RAG]
        A1c --> A1d[LLM follows malicious instruction]
        A1d --> A1e[Student gets WRONG answer]
    end
    subgraph A2["ATTACK 2 - Retrieval Poisoning"]
        A2a[Fake document created] --> A2b[Inserted into index]
        A2b --> A2c[Ranks high for common query]
        A2c --> A2d[Retrieved instead of real content]
        A2d --> A2e[Student gets WRONG answer]
    end
    style A1e fill:#ffcccc,stroke:#cc0000
    style A2e fill:#ffcccc,stroke:#cc0000
      

flowchart TD
    A[Retrieved Document] --> B{Source signed?}
    B -->|No| R[REJECT - Do not use in prompt]
    B -->|Yes| C{Valid signature?}
    C -->|No| R
    C -->|Yes| D{Integrity check - hash match?}
    D -->|No| R
    D -->|Yes| E{Instruction-Data separation?}
    E -->|Malicious patterns| R
    E -->|Clean| F[ACCEPT - Use in prompt]
    F --> G[LLM generates grounded answer]
    R --> H[Log rejection for audit]
    H --> G
    style R fill:#ffcccc,stroke:#cc0000
    style F fill:#ccffcc,stroke:#00cc00
    style G fill:#cce5ff
      

flowchart LR
    W1[Week 1-2 - Inception + Lit Review] --> W2[Week 3-4 - Baseline RAG]
    W2 --> W3[Week 5-6 - Run Attacks]
    W3 --> W4[Week 7-8 - Evaluate Defense]
    W4 --> W5[Week 9-10 - Analysis + Thesis]
    W5 --> W6[Week 11 - Mid-term]
    W6 --> W7[Week 12 - Final Submission]
    style W1 fill:#cce5ff
    style W7 fill:#ccffcc
      

flowchart TB
    subgraph U["Untrusted Zone"]
        STU[Student Query]
        ATT[Attacker]
    end
    subgraph T["Trusted Corpus"]
        NCT[NCTBench - Official Textbooks]
    end
    subgraph R["RAG System"]
        RET[Retriever]
        LLM[LLM Generator]
    end
    subgraph D["Defense Zone - NEW"]
        PRO[Provenance Checker]
    end
    subgraph O["Output"]
        ANS[Answer]
    end
    STU --> RET
    ATT -.-> NCT
    ATT -.-> RET
    NCT --> RET
    RET --> PRO
    PRO --> LLM
    LLM --> ANS
    style ATT fill:#ffcccc,stroke:#cc0000
    style PRO fill:#ccffcc,stroke:#00cc00
      

flowchart TB
    subgraph UI["Frontend"]
        WEB[Web UI]
    end
    subgraph API["API Layer"]
        GW[API Gateway]
        AUTH[Auth]
    end
    subgraph CORE["RAG Core"]
        RET[Retriever]
        VEC[(Vector Store)]
        PROV[Provenance Checker]
        LLM[LLM Generator]
    end
    subgraph DATA["Data"]
        NCT[(NCTBench 12403 QA)]
        TRACE[(Traces + Logs)]
    end
    subgraph MON["Observability"]
        MET[Metrics]
        LOG[Logs]
    end
    WEB --> GW
    GW --> AUTH
    AUTH --> RET
    RET --> VEC
    RET --> PROV
    VEC --> NCT
    PROV --> LLM
    LLM --> MET
    LLM --> LOG
    LLM --> TRACE
    MET --> GW
    style PROV fill:#ccffcc,stroke:#00cc00
    style NCT fill:#cce5ff
      

gantt
    title PMICS Project Timeline - 12 Weeks
    dateFormat YYYY-MM-DD
    axisFormat W%V
    section Phase 1 - Setup
    Inception Report        :a1, 2026-09-25, 14d
    Literature Review       :a2, 2026-09-25, 14d
    section Phase 2 - Baseline
    Baseline RAG Deploy     :b1, after a2, 14d
    NCTBench Setup          :b2, after a2, 7d
    section Phase 3 - Attacks
    Prompt Injection        :c1, after b1, 7d
    Retrieval Poisoning     :c2, after b1, 7d
    section Phase 4 - Defense
    Defense Evaluation      :d1, after c2, 14d
    section Phase 5 - Write-up
    Analysis and Writing    :e1, after d1, 14d
    Mid-term Presentation   :milestone, m1, after e1, 0d
    Final Submission        :milestone, m2, 2026-12-25, 0d
      

flowchart LR
    subgraph BEFORE["WITHOUT DEFENSE"]
        B1[Query] --> B2[Retrieve]
        B2 --> B3[Retrieve poisoned doc]
        B3 --> B4[LLM trusts content]
        B4 --> B5[Wrong answer]
    end
    subgraph AFTER["WITH PROVENANCE DEFENSE"]
        A1[Query] --> A2[Retrieve]
        A2 --> A3[Retrieve poisoned doc]
        A3 --> A4[Provenance check]
        A4 --> A5[REJECT poisoned]
        A5 --> A6[Retrieve clean doc]
        A6 --> A7[Correct answer]
    end
    style B5 fill:#ffcccc,stroke:#cc0000
    style A7 fill:#ccffcc,stroke:#00cc00
      

mindmap
  root((Evaluation Metrics))
    Security
      Attack Success Rate
        Lower is better
      Detection Rate
        Higher is better
      False Positive Rate
        Lower is better
    Quality
      Answer Accuracy
        Exact Match
        F1 Score
      Citation Fidelity
        Human rating 1-5
    Performance
      Latency
        p50
        p95
        p99
      Throughput
        Queries per second
    Cost
      Compute
        GPU-seconds
      Tokens
        Input and output