Rewriting Queries Adds Attack Surface
Why LLM reformulation of queries before retrieval creates new injection vectors
The Conventional Framing
Query rewriting uses an LLM to reformulate user queries before retrieval. The model expands abbreviations, corrects typos, adds synonyms, or restructures the query for better retrieval results.
The pattern improves recall—finding relevant documents that a literal query would miss.
Why This Adds Risk
The rewriting step is itself vulnerable to injection. An attacker can craft a query that, when rewritten, becomes something entirely different—retrieving content the user didn't intend.
Rewriting also obscures provenance. What the user asked and what was searched are now different. Audit logs of the original query don't reflect what actually retrieved the results.
Architecture
Components:
- Original query— what the user actually typed
- Rewriter LLM— reformulates query for better retrieval
- Rewritten query— what actually gets searched
- Retrieval engine— searches with rewritten query
Trust Boundaries
- Query → Rewriter — injection in query affects rewriting
- Rewriter → Search — rewritten query may be malicious
Threat Surface
| Threat | Vector | Impact |
|---|---|---|
| Query manipulation | Injection causes rewriter to produce different query | Retrieve unintended content |
| Provenance obscuring | Original query differs from searched query | Audit logs don't reflect actual retrieval |
| Targeted retrieval | Manipulate rewrite to surface specific documents | Attacker controls what gets retrieved |
The ZIVIS Position
- •Log both original and rewritten queries.Audit trails must capture what the user asked AND what was searched. Discrepancies may indicate attacks.
- •Constrain rewriting scope.The rewriter should expand and refine, not fundamentally change the query. Semantic similarity checks between original and rewritten.
- •Separate rewriting from system context.The rewriter shouldn't have access to sensitive system information that could leak into rewritten queries.
What We Tell Clients
Query rewriting improves retrieval quality but adds an injection surface. The rewriter is an LLM operating on user input—it can be manipulated like any other LLM.
If you use rewriting, constrain it tightly and log both versions. Be suspicious of rewritten queries that are semantically distant from originals.
Related Patterns
- Naive RAG— baseline without rewriting
- Multi-Query Retrieval— multiple rewrites increase surface further
- HyDE— extreme rewriting via hypothetical generation