Add AID-D-017: Embedding Provenance Attestation for RAG

[neerazz]

New Defense Technique

Adds Embedding Provenance Attestation for RAG under the Detect tactic (AID-D-017).

Threat addressed

Adversarial embeddings injected into RAG retrieval corpora silently manipulate downstream LLM behavior — an attack class that bypasses traditional input/output guardrails because the manipulation happens between embedding generation and response generation, not at the prompt boundary.

Defense

Cross-layer detection plus cryptographic provenance attestation tying each retrieved chunk back to its source corpus and embedding pipeline (Sigstore / in-toto), with an embedding-layer integrity check at retrieval time. Complements existing input/output guardrail techniques (AID-D-001 and friends).

Framework mappings

• MITRE ATLAS: AML.T0051.000 LLM Prompt Injection: Indirect; AML.T0057 LLM Data Leakage
• MAESTRO: Indirect Prompt Injection (L3); Compromised RAG Corpus (L3)
• OWASP LLM Top 10 2025: LLM01 Prompt Injection; LLM08 Vector and Embedding Weaknesses

Open-source reference implementation

EmbedGuard — IJCESEN 2026 paper (DOI 10.22399/ijcesen.4869), MIT-licensed.

Notes for maintainers

Only tactics/detect.js is modified. data/data.json is generated by scripts/generate-dataset.js (which runs under the fail-closed keyword lock), so I have intentionally not regenerated it here — please regenerate as part of the normal release flow.