Red Specter ECHO

AI Memory & RAG Poisoning Framework — 7 subsystems. 36 techniques. 211 tests.

v1.0.0

Contents

Overview Installation VECTOR — Vector DB Attacks EMBED — Embedding Manipulation RETRIEVE — Retrieval Poisoning CONTEXT — Context Window Hijacking PERSIST — Memory Corruption INJECT — KB Injection ANTIDOTE — Mandatory Restore UNLEASHED Mode CLI Reference MITRE ATLAS Mapping Disclaimer

Overview

ECHO targets the memory and retrieval layer that modern RAG-augmented AI systems depend on. Every enterprise deploying retrieval-augmented generation trusts that their vector database returns accurate, unmanipulated content. ECHO proves that trust is misplaced.

Your AI remembers everything. ECHO decides what.

Installation

$ pip install red-specter-echo
$ rs-echo init
$ rs-echo status

VECTOR — Vector DB Attacks

ID	Technique	Description
VE-001	Document Injection	Inject malicious documents into vector stores via ingestion pipeline
VE-002	Similarity Poisoning	Craft embeddings that appear similar to legitimate content
VE-003	Nearest-Neighbour Manipulation	Position malicious vectors adjacent to target queries
VE-004	Index Corruption	Corrupt vector index structures to alter retrieval results
VE-005	Metadata Tampering	Modify document metadata to influence filtering and ranking

EMBED — Embedding Manipulation

ID	Technique	Description
EM-001	Adversarial Embedding	Generate embeddings that bypass semantic filters
EM-002	Semantic Pollution	Flood embedding space with adversarial vectors
EM-003	Cosine Similarity Exploit	Maximise similarity score for malicious content
EM-004	Dimension Collapse	Force retrieval failures through dimensional attacks
EM-005	Embedding Inversion	Reconstruct source text from embeddings

RETRIEVE — Retrieval Poisoning

Query manipulation, relevance score gaming, chunk boundary exploitation, re-ranking attacks, and source authority spoofing. Every technique designed to make retrieval systems return attacker-controlled content for legitimate queries.

CONTEXT — Context Window Hijacking

Context overflow attacks, priority injection, instruction smuggling via retrieved content, attention steering, and system prompt dilution. When retrieved content enters the context window, ECHO ensures it carries attacker instructions.

PERSIST — Memory Corruption

Persistent memory poisoning, conversation history manipulation, long-term memory injection, memory consolidation attacks, and forgetting induction. Targets AI systems with persistent memory across sessions.

INJECT — KB Injection

Knowledge base poisoning via document injection, trusted source impersonation, batch ingestion exploitation, and update pipeline attacks. Targets the data ingestion pipeline that feeds vector stores.

ANTIDOTE — Mandatory Restore

Baseline capture before any engagement. Vector store snapshots. Embedding integrity verification. All poisoned content catalogued and tracked. Signed restoration certificate confirms clean state post-engagement.

ECHO UNLEASHED

Standard mode detects. UNLEASHED exploits. Ed25519 crypto. Dual-gate safety. One operator.

# Scan RAG attack surfaces (detection only)
$ rs-echo scan --target http://localhost:8000

# UNLEASHED (dry run)
$ rs-echo poison --vector-db chromadb --override

# UNLEASHED (live)
$ rs-echo campaign --target http://localhost:8000 --override --confirm-destroy

UNLEASHED mode is restricted to authorised operators with Ed25519 private key access. Targets must be in allowed_targets.txt. 30-minute auto-lock. Unauthorised use violates applicable law.

CLI Reference

Command	Description
rs-echo init	Initialise configuration and Ed25519 keys
rs-echo status	System status and subsystem count
rs-echo techniques	List all 36 RAG poisoning techniques
rs-echo scan	Scan target RAG attack surfaces
rs-echo poison	VECTOR — inject into vector database
rs-echo embed	EMBED — manipulate embeddings
rs-echo retrieve	RETRIEVE — test retrieval poisoning
rs-echo context	CONTEXT — hijack context window
rs-echo campaign	Full RAG poisoning campaign
rs-echo engagements	List all engagement sessions

MITRE ATLAS Mapping

ECHO techniques map to MITRE ATLAS tactics including AML.T0043 (Data Poisoning), AML.T0044 (Model Poisoning), and OWASP Top 10 for LLM Applications including LLM06 (Sensitive Information Disclosure) and LLM01 (Prompt Injection via RAG).

Disclaimer

Red Specter ECHO is for authorised security testing only. RAG poisoning can corrupt AI system outputs and cause operational disruption. You must have explicit written permission before testing any system. Unauthorised use may violate the Computer Misuse Act 1990 (UK), CFAA (US), or equivalent legislation.