A RAG pipeline isn't one system, it's six interconnected components, each with its own attack surface and its own defense requirements. This is the stage-by-stage architectural map — what each layer does, and exactly which defense belongs there.
Scope note: for the attack categories themselves (corpus poisoning, document injection, cross-session contamination), see RAG Security: Complete Guide →. For RAG powering autonomous agents specifically, see RAG Security for Agentic AI →. This guide is the architecture those attacks and defenses map onto.
Traditional applications process deterministic inputs through structured workflows. RAG systems process probabilistic semantic relationships and dynamically retrieved, often untrusted, external data — this creates a genuinely semantic attack surface where an attacker doesn't need direct database access at all. They can manipulate retrieved context, embeddings, prompts, or inference behavior instead, and each of those is a different layer with a different defense.
Collects documents, preprocesses content, chunks text, and indexes information — this is where the trust boundary is actually set, since whatever gets indexed here becomes a trusted retrieval source later.
Transforms text into vector embeddings and semantic representations. Embeddings determine what gets retrieved and what context reaches the model, so manipulating them is functionally similar to SEO poisoning for AI retrieval.
Stores embeddings, metadata, and retrieval indexes — the core infrastructure layer where cross-tenant leakage, unauthorized retrieval, and metadata exposure risks concentrate.
Searches for semantically relevant content and determines what information actually reaches the LLM — strategically the most important target, since a frontend can hide a document while the retrieval engine still has access to it underneath.
Coordinates retrieval, prompt construction, and model execution by dynamically building prompts from retrieved content, system instructions, and user input — creating a complex prompt attack surface where the LLM may interpret malicious retrieved text as a higher-priority instruction than it should.
Generates the final response — and this is where most real RAG attacks actually occur, live, not during any earlier static testing phase.
No single layer is "the" critical one. A weakness anywhere in the six layers can compromise the whole pipeline regardless of how well-defended the others are — a perfectly sanitized ingestion pipeline doesn't help if the vector database has no tenant isolation, and perfect tenant isolation doesn't help if the orchestration layer has no instruction hierarchy enforcement. The six layers need six matched defenses, applied together, not one strong layer compensating for five weak ones.
The HexTyx AI Security Assessment runs structured tests across all six architectural layers, not just the most obvious one.