RAG pipeline labs
From your first vector search to a RAG firewall, in seven runnable labs.
Retrieval-augmented generation (RAG) is the pattern where a language model answers from documents you retrieve at query time instead of from what it memorized in training. It is the most common production LLM architecture and the one most exam blueprints (NCP-AAI, NCP-GENL, CCAR-P) lean on hardest. It is also where most systems fail quietly: the model answers fluently from the wrong chunk, or from a chunk an attacker planted.
These labs walk the whole arc in order. You build a minimal pipeline with local models on a real GPU, then the hosted NVIDIA NIM version with an agent on top, then a production-shape retriever with dense plus BM25 search fused by Reciprocal Rank Fusion and re-ordered by a cross-encoder. A multimodal lab turns an uploaded image into a retrieval query. The last three labs flip to security: poison retrieval to steer answers, break tenant isolation, then build the RAG firewall that stops both.
Every lab runs in the browser against a live environment (GPU pod or hosted API), is split into checkable steps, and takes 35 to 80 minutes.
The labs, in order
All labs- 1GPU Proncp-genl · rag-pipelineIntermediate
Retrieval-Augmented Generation (RAG) Pipeline with Local Models
Build an end-to-end RAG pipeline on a single GPU: BGE embeddings, L2-normalized vector retrieval by dot product, and a local generator that answers with and without retrieved context so you can see exactly what retrieval changes.
ncp-genlnca-genl45 min4 stepsLaunch - 2HOSTED Proncp-aai · rag-pipeline-nimIntermediate
Build a RAG Pipeline with NVIDIA NIM
Build a complete Retrieval Augmented Generation pipeline — from document chunking to vector search to an agent that answers questions from your knowledge base.
ncp-aainca-genl35 minHostedLaunch - 3GPU Proncp-genl · advanced-ragAdvanced
Advanced RAG: Hybrid Search + Cross-Encoder Reranking
Build a production-shape retrieval stack — dense bi-encoder plus from-scratch BM25, fused with Reciprocal Rank Fusion, then re-ordered by a BAAI cross-encoder. The exact architecture behind modern enterprise RAG.
ncp-genlnca-genl40 min4 stepsLaunch - 4HOSTED Pro# multimodal-rag · agentPOST /api/agent/invoke200 OK · gradedncp-aai · multimodal-ragIntermediate
Multimodal RAG with NeMo Retriever
Build an image-query RAG system: embed a catalog with NeMo Retriever, translate an uploaded image into a retrieval query via a VLM, and ground the VLM's final answer in the retrieved passages.
ncp-aainca-genm35 minHostedLaunch - 5HOSTED ProlabAdvanced
Retrieval Poisoning: Win Top-k Across a Whole Query Class and Steer the Answer
Attack a real Retrieval-Augmented Generation assistant where it is most exposed: retrieval. Plant one document in a Milvus + NVIDIA embeddings knowledge base, craft it to win cosine top-k for one account question, then for the whole account-query class, then steer the generated answer through a directive framed as routine policy. Measure broad-class coverage and steering attack-success-rate, then harden in two distinct moves: treat retrieved context as data behind a non-spoofable boundary, and cap how many top-k slots any single source may take. Re-run the same battery and watch attack-success-rate collapse.
80 minHostedLaunch - 6HOSTED ProlabAdvanced
Cross-Tenant Leakage: Break RAG Metadata Isolation and Exfiltrate Another Tenant's Contract
Attack the multi-tenant isolation of a real Retrieval-Augmented Generation assistant. Two stacked bugs in one retriever, a caller-controlled tenant scope and a string-concatenated metadata filter, let a Globex-scoped caller read Initech's confidential contract from a Milvus + NVIDIA embeddings store. Chain the cross-tenant read into the EchoLeak markdown-image sink to exfiltrate the data to a listener, then harden the pipeline so isolation and the sink both hold.
70 minHostedLaunch - 7HOSTED ProlabAdvanced
Build a RAG Firewall: Reject Poisoned Ingestion and Enforce Tenant Isolation
Defend the same multi-tenant RAG assistant the offensive labs attack, in small sequential steps. Stand up the pipeline and trace one benign request, then reproduce two handed-to-you exploits one at a time: a poisoned document that wins retrieval and steers the answer, and a caller-controlled tenant scope that reads another tenant's confidential contract. Watch a naive deny-list get bypassed by a fresh payload, then build the durable control one mechanism per step: a server-side tenant predicate the caller cannot widen, then an ingestion screen that rejects directive-shaped documents before indexing. Verify both exploits are blocked with benign traffic intact, then prove fresh, paraphrased, and renamed variants are all blocked on a real Milvus + NVIDIA embeddings stack.
80 minHostedLaunch
Before you start
- Python basics and comfort reading a short script
- What an embedding is (a vector that places similar text near similar text)
- For the security labs: having done at least one build lab first
Every lab in this collection, plus every practice test on the platform
$29.99 per month or $290 per year. Cancel any time. Free labs need only an account.
Certifications these labs prepare you for
Frequently asked questions
No. GPU labs run on a Preporato-provisioned NVIDIA GPU pod inside the browser; hosted labs call NVIDIA NIM through the platform. Nothing to install and no keys to manage.
RAG design, chunking, retrieval evaluation and grounding appear in the NVIDIA NCP-AAI and NCP-GENL blueprints and in the Integration domain of Anthropic's CCAR-P. The labs are built to make those exam questions concrete rather than to teach one vendor SDK.
About six hours end to end: four build labs of 35 to 45 minutes each and three security labs of 70 to 80 minutes. Each lab saves progress, so you can stop between steps.
The labs are included in Preporato Pro ($29.99 per month or $290 per year), which also covers every practice test and every other lab on the platform. Free previews of individual labs show the full brief and first step.