Metadata Exploitation

Document metadata (author, creation date, content-type, access control lists, source URL, confidence scores) influences retrieval ranking, filtering, and the LLM's trust weighting of retrieved content. Metadata exploitation manipulates these fields to affect how documents are processed, ranked, and trusted without modifying the document content itself. The assumption violated is that metadata is a faithful descriptor of the document — in practice, metadata is often author-supplied, unverified, and mutable.

• Validate metadata against document content (content-type, encoding, language)
• Monitor metadata changes independently of content changes
• Verify ACL metadata against the authorization system
• Observable signal: documents with metadata inconsistent with their content or ingestion source

Metadata exploitation amplifies all other T12 techniques: timestamp manipulation feeds T12-AT-009, authorship spoofing feeds T12-AT-008, ACL manipulation feeds T12-AT-011 (Cross-Collection). Metadata-based ranking manipulation feeds T12-AT-002 (Retrieval Manipulation).