Poison In, Poison Out: CDC-Aware Containment for RAG and Agent Memory

Abstract

An attacker poisons one document in a RAG corpus. The system chunks it, embeds it, retrieves it, and may later save a summary in an agent's memory. An administrator fixes or deletes the source. The hard question is whether the poison is actually gone.

This work-in-progress poster looks at that cleanup problem. Old chunks can remain in a vector index. Stale embeddings can stay retrievable. A replayed event can restore content that was already removed. Agent memory can keep a summary derived from the poisoned source. Many RAG poisoning defenses focus on spotting bad content at retrieval or generation time, but incident response also needs a way to find derived copies and prove cleanup.

The poster applies change data capture ideas to RAG and agent-memory containment. Each source change becomes an ordered event with a document version, commit time, actor or producer, content hash, prior content hash, and authorization context. Derived chunks, embeddings, and memory records keep links back to that source event. Corrections and deletions create tombstones for affected records. Version checks reject stale replays, and reconciliation compares source state with what is still available for retrieval.

The evaluation plan compares periodic source-only re-indexing, append-only updates, deletion support, and a CDC-aware containment design under corrections, deletions, stale replay, partial failures, and poison copied into memory. The goal is practical: after a poisoned source is fixed, the agent should stop using its derived records, and the operator should be able to show why.