Grounding evaluation and retrieval threats

Evaluate components and outcomes

Measure ingestion completeness and lineage, retrieval relevance and recall, permission correctness, reranking quality, answer support, citation correctness and coverage, no-answer behavior, latency, and evidence completeness. A correct-looking answer can conceal failed retrieval; a relevant passage can still yield an unsupported answer.

Threat cases

Include documents containing prompt injection, misleading instructions, hidden text, poisoned facts, conflicting versions, sensitive identifiers, malformed content, oversized sections, and adversarial metadata. Test query manipulation, cross-tenant access, inference about denied documents, cache leakage, stale permissions, and deleted content.

Treat retrieved instructions as untrusted unless a separately authorized workflow explicitly interprets them.

Evaluation set

Build representative questions with expected sources, allowed audiences, required claims, forbidden disclosures, acceptable no-answer cases, and severity. Keep a protected regression set and version every input and evaluator.

Automated model-based graders can assist but require calibration, disagreement review, and version control. Preserve human review for high-impact or ambiguous outcomes.

Release gates should report severe failures separately and require retesting after corpus, permission, embedding, reranker, model, prompt, or policy change.