mlsanityData to 7 Oct 2026

GraphRAG under Fire

arXiv 2501.14050 ↗First posted 23 Jan 2025cs.LG cs.AI cs.CRcited by 23

On the map: Retrieval-augmented generation → Privacy and security of RAG

Abstract (arXiv)

GraphRAG advances retrieval-augmented generation (RAG) by structuring external knowledge as multi-scale knowledge graphs, enabling language models to integrate both broad context and granular details in their generation. While GraphRAG has demonstrated success across domains, its security implications remain largely unexplored. To bridge this gap, this work examines GraphRAG's vulnerability to poisoning attacks, uncovering an intriguing security paradox: existing RAG poisoning attacks are less effective under GraphRAG than conventional RAG, due to GraphRAG's graph-based indexing and retrieval; yet, the same features also create new attack surfaces. We present GragPoison, a novel attack that exploits shared relations in the underlying knowledge graph to craft poisoning text capable of compromising multiple queries simultaneously. GragPoison employs three key strategies: (i) relation injection to introduce false knowledge, (ii) relation enhancement to amplify poisoning influence, and (iii) narrative generation to embed malicious content within coherent text. Empirical evaluation across diverse datasets and models shows that GragPoison substantially outperforms existing attacks in terms of effectiveness (up to 98% success rate) and scalability (using less than 68% poisoning text) on multiple variations of GraphRAG. We also explore potential defensive measures and their limitations, identifying promising directions for future research.

Key facts. Cited by 23 papers in the map (data through 7 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 61 of its 151 references that are in the map. First posted on arXiv 23 Jan 2025.

Builds on

61 of 151 references.

Closest ancestors · 10

Same direction, newest first

  1. 2024On the Vulnerability of Applying Retrieval-Augmented Generation within Knowledge-Intensive Application Domains12 Sep
  2. 2024ConfusedPilot: Confused Deputy Risks in RAG-based LLMs9 Aug
  3. 2024Black-Box Opinion Manipulation Attacks to Retrieval-Augmented Generation of Large Language Models18 Jul
  4. 2024"Glue pizza and eat rocks" -- Exploiting Vulnerabilities in Retrieval-Augmented Generative Models26 Jun
  5. 2024Machine Against the RAG: Jamming Retrieval-Augmented Generation with Blocker Documents9 Jun
  6. 2024BadRAG: Identifying Vulnerabilities in Retrieval Augmented Generation of Large Language Models3 Jun
  7. 2024Certifiably Robust RAG against Retrieval Corruption24 May
  8. 2024TrojanRAG: Retrieval-Augmented Generation Can Be Backdoor Driver in Large Language Models22 May
  9. 2024Pandora: Jailbreak GPTs by Retrieval Augmented Generation Poisoning13 Feb
  10. 2024PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models12 Feb

Other references · 51

  1. 2020Language Models are Few-Shot Learnerscited by 32,199
  2. 2023LLaMA: Open and Efficient Foundation Language Modelscited by 13,958
  3. 2022Chain-of-Thought Prompting Elicits Reasoning in Large Language Modelscited by 12,302
  4. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,160
  5. 2024GPT-4o System Cardcited by 4,467
  6. 2018HotpotQA: A Dataset for Diverse, Explainable Multi-hop Question Answeringcited by 3,686
  7. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  8. 2023Retrieval-Augmented Generation for Large Language Models: A Surveycited by 2,185
  9. 2016MS MARCO: A Human Generated MAchine Reading COmprehension Datasetcited by 1,591
  10. 2024From Local to Global: A Graph RAG Approach to Query-Focused Summarizationcited by 1,411
  11. 2020Constructing A Multi-hop QA Dataset for Comprehensive Evaluation of Reasoning Stepscited by 1,259
  12. 2021BEIR: A Heterogenous Benchmark for Zero-shot Evaluation of Information Retrieval Modelscited by 1,225
38 more
  1. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  2. 2021MuSiQue: Multihop Questions via Single-hop Question Compositioncited by 893
  3. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 608
  4. 2022Precise Zero-Shot Dense Retrieval without Relevance Labelscited by 508
  5. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 500
  6. 2023Catastrophic Jailbreak of Open-source LLMs via Exploiting Generationcited by 439
  7. 2023Detecting Language Model Attacks with Perplexitycited by 411
  8. 2024AgentPoison: Red-teaming LLM Agents via Poisoning Memory or Knowledge Basescited by 402
  9. 2023Enhancing Retrieval-Augmented Large Language Models with Iterative Retrieval-Generation Synergycited by 343
  10. 2024LightRAG: Simple and Fast Retrieval-Augmented Generationcited by 310
  11. 2022Generate rather than Retrieve: Large Language Models are Strong Context Generatorscited by 296
  12. 2023Poisoning Web-Scale Training Datasets is Practicalcited by 276
  13. 2023Query Rewriting for Retrieval-Augmented Large Language Modelscited by 211
  14. 2024Retrieval-Augmented Generation with Graphs (GraphRAG)cited by 170
  15. 2023Take a Step Back: Evoking Reasoning via Abstraction in Large Language Modelscited by 157
  16. 2023Poisoning Retrieval Corpora by Injecting Adversarial Passagescited by 153
  17. 2023Lift Yourself Up: Retrieval-augmented Text Generation with Self Memorycited by 103
  18. 2024Medical Graph RAG: Towards Safe Medical Large Language Model via Graph Retrieval-Augmented Generationcited by 89
  19. 2024Trustworthiness in Retrieval-Augmented Generation Systems: A Surveycited by 83
  20. 2024Enhancing Code LLMs with Reinforcement Learning in Code Generation: A Surveycited by 82
  21. 2023Large Language Model based Long-tail Query Rewriting in Taobao Searchcited by 61
  22. 2024Astute RAG: Overcoming Imperfect Retrieval Augmentation and Knowledge Conflicts for Large Language Modelscited by 57
  23. 2023KnowledGPT: Enhancing Large Language Models with Retrieval and Storage Access on Knowledge Basescited by 52
  24. 2020CSKG: The CommonSense Knowledge Graphcited by 45
  25. 2024Can Perplexity Reflect Large Language Model's Ability in Long Text Understanding?cited by 45
  26. 2024DELL: Generating Reactions and Explanations for LLM-Based Misinformation Detectioncited by 41
  27. 2019Data Poisoning Attack against Knowledge Graph Embeddingcited by 34
  28. 2024ClinicalAgent: Clinical Trial Multi-Agent System with Large Language Model-based Reasoningcited by 31
  29. 2024CMAT: A Multi-Agent Collaboration Tuning Framework for Enhancing Small Language Modelscited by 26
  30. 2024Harnessing Large Language Models for Knowledge Graph Question Answering via Adaptive Multi-Aspect Retrieval-Augmentationcited by 24
  31. 2024RAG-RLRC-LaySum at BioLaySumm: Integrating Retrieval-Augmented Generation and Readability Control for Layman Summarization of Biomedical Textscited by 23
  32. 2024Mitigating the Risk of Health Inequity Exacerbated by Large Language Modelscited by 21
  33. 2024RobustKV: Defending Large Language Models against Jailbreak Attacks via KV Evictioncited by 21
  34. 2021WikiGraphs: A Wikipedia Text - Knowledge Graph Paired Datasetcited by 20
  35. 2020Reasoning on Knowledge Graphs with Debate Dynamicscited by 16
  36. 2023QASiNa: Religious Domain Question Answering using Sirah Nabawiyahcited by 14
  37. 2021Poisoning Knowledge Graph Embeddings via Relation Inference Patternscited by 12
  38. 2025Journey into Automation: Image-Derived Pavement Texture Extraction and Evaluationcited by 7

50 most cited of 51 All 51 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 6; 2026: 17.

23 papers.

Sort:

By area:

  1. 2026A Survey on Long-Term Memory Security in LLM Agents: Attacks, Defenses, and Governance Across the Memory Lifecyclecited by 21
  2. 2025Self-Destructive Language Modelcited by 10
  3. 2025Reasoning or Retrieval? A Study of Answer Attribution on Large Reasoning Modelscited by 9
  4. 2026Safeguarding LLM Agents against Long-Horizon Threats via Shadow Memorycited by 6
  5. 2025Towards Practical Defect-Focused Automated Code Reviewcited by 3
  6. 2025UniC-RAG: Universal Knowledge Corruption Attacks to Retrieval-Augmented Generationcited by 3
  7. 2026SD-RAG: A Prompt-Injection-Resilient Framework for Selective Disclosure in Retrieval-Augmented Generationcited by 3
  8. 2026Connect the Dots: Knowledge Graph-Guided Crawler Attack on Retrieval-Augmented Generation Systemscited by 3
  9. 2026Beyond RAG for Cyber Threat Intelligence: A Systematic Evaluation of Graph-Based and Agentic Retrievalcited by 3
  10. 2025DeepRAG: Integrating Hierarchical Reasoning and Process Supervision for Biomedical Multi-Hop QAcited by 2
  11. 2025DisarmRAG: Stealthy Retriever-Centric Poisoning to Disable Self-Correction in Retrieval-Augmented Generation (Extended Version)cited by 2
  12. 2026Making Theft Useless: Adulteration-Based Protection of Proprietary Knowledge Graphs in GraphRAG Systemscited by 2
11 more
  1. 2026Retrieval Pivot Attacks in Hybrid RAG: Measuring and Mitigating Amplified Leakage from Vector Seeds to Graph Expansioncited by 1
  2. 2026KEPo: Knowledge Evolution Poison on Graph-based Retrieval-Augmented Generationcited by 1
  3. 2026Oracle Poisoning: Corrupting Knowledge Graphs to Weaponise AI Agent Reasoningcited by 1
  4. 2026LaCache: Robust Semantic Caching for LLM Servingcited by 1
  5. 2026Graphs Don't Stay Secret: Practical Subgraph Reconstruction Attacks on Defended Graph RAGcited by 0
  6. 2026FlashRT: Towards Computationally and Memory Efficient Red-Teaming for Prompt Injection and Knowledge Corruptioncited by 0
  7. 2026ShadowMerge: A Novel Poisoning Attack on Graph-Based Agent Memory via Relation-Channel Conflictscited by 0
  8. 2026MemVenom: Triggered Poisoning of Multimodal Memories in Web Agentscited by 0
  9. 2026TopoGuard: Graph Theory Based Defenses Against Split-Knowledge Attacks on RAGcited by 0
  10. 2026NeuroGraph: An AI Graph-Driven Neuro-Symbolic Framework for Explainable Threat Reasoning in Advanced Manufacturingcited by 0
  11. 2026Building Trustworthy Graph-Agentic RAG for Social Good: Architectures, Failure Propagation, and Assurance by Constructioncited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025A Few Words Can Distort Graphs: Knowledge Poisoning Attacks on Graph-based Retrieval-Augmented Generation of Large Language Models
  2. 2025RAG Safety: Exploring Knowledge Poisoning Attacks to Retrieval-Augmented Generation
  3. 2026LogicPoison: Logical Attacks on Graph Retrieval-Augmented Generation
  4. 2025One Shot Dominance: Knowledge Poisoning Attack on Retrieval-Augmented Generation Systems
  5. 2026Benchmarking Knowledge-Extraction Attack and Defense on Retrieval-Augmented Generation
  6. 2025Practical Poisoning Attacks against Retrieval-Augmented Generation
  7. 2026GraphSteal: Structural Knowledge Stealing from Graph RAG via Traversal Reconstruction
  8. 2025Uncovering Competing Poisoning Attacks in Retrieval-Augmented Generation