Private RAG system · demo on request
PDF QA System
Retrieval-augmented question answering over PDF corpora, including cybersecurity documents.
Problem
PDFs are the native format of papers, reports, and security writeups, and they are a poor interface for asking a precise question. Unconstrained chat over a document invents citations. A retrieval-augmented path is the minimum for answers that can be checked.
Context and constraints
This system was previously listed on the public GitHub profile as a private cybersecurity RAG / PDF QA project, available as a demo on request. The repository is not public, so this case study describes the retrieval pattern rather than an invented product stack.
My specific role
Author of a private PDF question-answering system using retrieval-augmented generation. Individual library choices are not published.
System architecture
PDF ingest
Document upload and text extraction from PDF pages
Chunking
Split long documents into retrievable passages
Embeddings + index
Vector search over passages instead of stuffing the full PDF into a prompt
Retrieve
Select the passages most relevant to the question
Grounded generation
LLM answers from retrieved context, including cybersecurity PDFs
Architecture is the standard RAG loop. Specific vendors and index software are not claimed because the repo is private.
Technologies
Engineering decisions
Retrieve before generating
The point of PDF QA is citation to a passage. Retrieval is the product, not a chat skin.
Keep the system private
Cybersecurity and research PDFs are a poor fit for a public demo with a client-side API key.
Ground answers in retrieved text
If a passage is not retrieved, the system should not invent a page number.
Challenges and trade-offs
Layout-heavy PDFs
Tables, two-column papers, and scanned pages break naive extraction. Chunk quality dominates model choice.
Closed source
Without a public repo, recruiters should ask for a walkthrough rather than infer a production deployment.
Results and evidence
Private demo path
Listed publicly as a cybersecurity RAG / PDF QA system available on request.
What I learned
- RAG is an evaluation problem: retrieval hit-rate matters more than prompt tone.
- PDF QA fails first at extraction, then at chunk boundaries, then at the model.
Potential improvements
- Publish an architecture README and a non-sensitive evaluation set.
- Measure groundedness: answer supported by retrieved spans.
Private system. Demo on request. Not a public repository and not a production security product.