Mind the Data Voids: Hijacking Copilot Trust
Demonstrates how adversaries exploit data voids in LLM training corpora and search indexes to manipulate Microsoft Copilot answers and inject untrusted content.
Summary
Data Voids in Large Language Model Retrieval
Generative AI assistants (such as Microsoft Copilot) rely on Retrieval-Augmented Generation (RAG) to supplement model knowledge with real-time web search results and corporate indexes.
Weaponizing Data Voids and Knowledge Gaps
Tobias Diehl explains how attackers identify 'data voids'—obscure search queries or emerging topics with minimal established web presence—and populate them with malicious, SEO-optimized content.
Hijacking Copilot Responses and User Trust
When users query Copilot about these niche topics, the RAG pipeline retrieves the attacker's malicious content, leading the AI assistant to deliver fraudulent instructions, hallucinated advice, or weaponized command-line snippets.
Defending AI Retrieval Pipelines
Securing AI assistants requires search result source reputation scoring, domain verification, and strict contextual guardrails on retrieved RAG sources.
Related talks
Community Stage·34 min
Andra Lezza · Jeremiah Edwards
Presents threat modeling and defensive guardrails for autonomous multi-agent AI workflows, covering persistent memory, tool execution, and prompt injection.
Creator Stage·52 min
Dane Sherrets · Shlomie Liberow
Deep dives into adversarial prompt injection, context poisoning, and RAG manipulation flaws to help researchers find and demonstrate high-impact AI vulnerabilities.
Main Stage·46 min
Ben Nassi · Or Yair · Stav Cohen
Demonstrates an indirect prompt injection attack where a Google Calendar invite autonomously triggers Gemini AI agents to exfiltrate private user emails and files.