GenAI in production · pillar 3 of 6
Retrieval
RAG is a search problem wearing a generation costume.
- 7 RAG is a search system with a generator on the end Retrieval-augmented generation combines a retriever that finds relevant passages with a generator that answers using…
- 8 Chunk boundaries decide what can be found Documents are split into chunks before being embedded and indexed. The chunk is the unit of retrieval, so the split…
- 9 The vector store inherits every access problem OWASP lists Vector and Embedding Weaknesses as its own entry. A vector store is a copy of your corpus in another shape…
Start this pillar See the whole map
Read against OWASP Top 10 for Large Language Model Applications, 2025, NIST AI 600-1 — Generative AI Profile (AI RMF), Lewis et al., Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks (arXiv:2005.11401), Hu et al., LoRA: Low-Rank Adaptation of Large Language Models (arXiv:2106.09685) on . Regulations and frameworks change; the date is there so you can tell whether this has kept up.
The OWASP Top 10 for LLM Applications is © the OWASP Foundation and published under a Creative Commons licence; NIST AI 600-1 is a US Government work in the public domain. These cards are independent commentary written in our own words. ytyk.org is not affiliated with or endorsed by the OWASP Foundation or NIST.