You ask your company’s HR bot a simple question about parental leave. It answers quickly, sounds confident, and includes citations. One citation is a random-looking page title that does not match any HR policy you have ever seen. If you are building or operating the bot, that is the moment you need a clear mental model of how the answer was assembled and where the cited text came from.
RAG security starts with understanding the architecture because the architecture explains both the value and the risks. In this course, we will use that architecture to reason about what can go wrong, what data is at stake, and what safeguards actually change outcomes. First, let’s ground ourselves in the basic flow a RAG app follows from question to answer.
Retrieval-augmented generation (RAG) is a way to make a chatbot answer using information pulled from a document collection at the time of the question. The app retrieves relevant text and places it into the model’s input so the model can write an answer that reflects that text. The key idea is simple. Whatever text gets retrieved has a strong influence on what the model says.
A RAG system usually has a few parts you will hear throughout this course. A retriever is the component that searches for relevant text. A vector database (vector DB) is a storage system that helps the retriever find similar text quickly. Chunks are small pieces of documents stored for retrieval. Top-k means the retriever returns the best k chunks it found for the question. Citations are references the app shows to indicate which chunks were used for the answer. Step through how those pieces connect.
Two common failure modes can look the same to a beginner because both produce a fluent answer. Hallucination is when the model states something that is not supported by the retrieved text it was given. For security, another concern is when retrieved text steers the model toward a wrong or unsafe result because the retrieved text itself is misleading for the user’s intent. The practical skill is learning to ask one question about any claim. Where in the retrieved text is the evidence for this sentence.
When you can trace an answer back to specific retrieved chunks, you can separate claims that are supported from claims that are free-floating. That tracing habit is also how you notice when a suspicious chunk is doing the steering. Compare two answers and see what is and is not grounded in retrieved text.