mlsanityData to 14 Oct 2026

Exposing Privacy Risks in Graph Retrieval-Augmented Generation

arXiv 2508.17222 ↗First posted 24 Aug 2025cs.CR cs.AI cs.IRcited by 5

On the map: Retrieval-augmented generation → Privacy and security of RAG

Abstract (arXiv)

Retrieval-Augmented Generation (RAG) is a powerful technique for enhancing Large Language Models (LLMs) with external, up-to-date knowledge. Graph RAG has emerged as an advanced paradigm that leverages graph-based knowledge structures to provide more coherent and contextually rich answers. However, the move from plain document retrieval to structured graph traversal introduces new, under-explored privacy risks. This paper investigates the data extraction vulnerabilities of the Graph RAG systems. We design and execute tailored data extraction attacks to probe their susceptibility to leaking both raw text and structured data, such as entities and their relationships. Our findings reveal a critical trade-off: while Graph RAG systems may reduce raw text leakage, they are significantly more vulnerable to the extraction of structured entity and relationship information. We also explore potential defense mechanisms to mitigate these novel attack surfaces. This work provides a foundational analysis of the unique privacy challenges in Graph RAG and offers insights for building more secure systems.

Key facts. Cited by 5 papers in the map (data through 14 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 50 of its 82 references that are in the map. First posted on arXiv 24 Aug 2025.

Builds on

50 of 82 references.

Closest ancestors · 5

Same direction, newest first

  1. 2025Riddle Me This! Stealthy Membership Inference for Retrieval-Augmented Generation1 Feb
  2. 2024RemoteRAG: A Privacy-Preserving LLM Cloud RAG Service17 Dec
  3. 2024Privacy-Preserving Retrieval-Augmented Generation with Differential Privacy6 Dec
  4. 2024Mitigating the Privacy Issues in Retrieval-Augmented Generation (RAG) via Pure Synthetic Data20 Jun
  5. 2024The Good and The Bad: Exploring Privacy Issues in Retrieval-Augmented Generation (RAG)23 Feb

Other references · 45

  1. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,297
  2. 2020Dense Passage Retrieval for Open-Domain Question Answeringcited by 3,824
  3. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
  4. 2023Retrieval-Augmented Generation for Large Language Models: A Surveycited by 2,212
  5. 2020Extracting Training Data from Large Language Modelscited by 2,189
  6. 2020REALM: Retrieval-Augmented Language Model Pre-Trainingcited by 2,141
  7. 2022Language Models (Mostly) Know What They Knowcited by 1,856
  8. 2024From Local to Global: A Graph RAG Approach to Query-Focused Summarizationcited by 1,453
  9. 2020Leveraging Passage Retrieval with Generative Models for Open Domain Question Answeringcited by 1,210
  10. 2024Qwen2.5-Coder Technical Reportcited by 1,203
  11. 2021Membership Inference Attacks From First Principlescited by 878
  12. 2023REPLUG: Retrieval-Augmented Black-Box Language Modelscited by 792
33 more
  1. 2023In-Context Retrieval-Augmented Language Modelscited by 702
  2. 2024RAPTOR: Recursive Abstractive Processing for Tree-Organized Retrievalcited by 532
  3. 2023Large Language Models for Information Retrieval: A Surveycited by 331
  4. 2024Graph Retrieval-Augmented Generation: A Surveycited by 324
  5. 2023Knowledge Graph Prompting for Multi-Document Question Answeringcited by 152
  6. 2022A Comprehensive Survey on Trustworthy Graph Neural Networks: Privacy, Robustness, Fairness, and Explainabilitycited by 118
  7. 2024Medical Graph RAG: Towards Safe Medical Large Language Model via Graph Retrieval-Augmented Generationcited by 90
  8. 2024Catastrophic Failure of LLM Unlearning via Quantizationcited by 81
  9. 2021Cross-Node Federated Graph Neural Network for Spatio-Temporal Data Modelingcited by 69
  10. 2025Knowledge Graph-Guided Retrieval Augmented Generationcited by 58
  11. 2025Knowledge Graph Retrieval-Augmented Generation for LLM-based Recommendationcited by 57
  12. 2025RAG vs. GraphRAG: A Systematic Evaluation and Key Insightscited by 53
  13. 2021Adapting Membership Inference Attacks to GNN for Graph Classification: Approaches and Implicationscited by 52
  14. 2021GraphMI: Extracting Private Graph Data from Graph Neural Networkscited by 50
  15. 2024Learn What You Want to Unlearn: Unlearning Inversion Attacks against Machine Unlearningcited by 48
  16. 2020Scene-Graph Augmented Data-Driven Risk Assessment of Autonomous Vehicle Decisionscited by 34
  17. 2022A Comprehensive Survey on Trustworthy Recommender Systemscited by 32
  18. 2024Linear-Time Graph Neural Networks for Scalable Recommendationscited by 31
  19. 2024Unleashing Worms and Extracting Data: Escalating the Outcome of Attacks against RAG-based Inference in Scale and Severity Using Jailbreakingcited by 30
  20. 2023STPrivacy: Spatio-Temporal Privacy-Preserving Action Recognitioncited by 29
  21. 2024Reconstruction Attacks on Machine Unlearning: Simple Models are Vulnerablecited by 25
  22. 2024Score-based Generative Diffusion Models for Social Recommendationscited by 23
  23. 2024Graph Unlearning with Efficient Partial Retrainingcited by 20
  24. 2023Vertical Federated Graph Neural Network for Recommender Systemcited by 17
  25. 2023A Unified Framework of Graph Information Bottleneck for Robustness and Membership Privacycited by 14
  26. 2019I Am Not What I Write: Privacy Preserving Text Representation Learningcited by 12
  27. 2025Diagnosing and Addressing Pitfalls in KG-RAG Datasets: Toward More Reliable Benchmarkingcited by 12
  28. 2024SmartCooper: Vehicular Collaborative Perception with Adaptive Fusion and Judger Mechanismcited by 11
  29. 2024Self-Explainable Graph Transformer for Link Sign Predictioncited by 8
  30. 2025OpenGU: A Comprehensive Benchmark for Graph Unlearningcited by 8
  31. 2025DualEquiNet: A Dual-Space Hierarchical Equivariant Network for Large Biomoleculescited by 5
  32. 2024Verbalized Graph Representation Learning: A Fully Interpretable Graph Model Based on Large Language Models Throughout the Entire Processcited by 3
  33. 2025Graph-based Molecular In-context Learning Grounded on Morgan Fingerprintscited by 2

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 5.

5 papers.

  1. 2026URAG: A Benchmark for Uncertainty Quantification in Retrieval-Augmented Large Language Modelscited by 3
  2. 2026Benchmarking Knowledge-Extraction Attack and Defense on Retrieval-Augmented Generationcited by 2
  3. 2026Graphs Don't Stay Secret: Practical Subgraph Reconstruction Attacks on Defended Graph RAGcited by 0
  4. 2026The Confidence Trap: Calibration Attacks for Graph Neural Networkscited by 0
  5. 2026Hop-Decayed Influence: New Vulnerabilities of Structural Auxiliary Indexing in GraphRAG Pipelines with LLMcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025RAG Security and Privacy: Formalizing the Threat Model and Attack Surface
  2. 2026Security and Privacy in Retrieval-Augmented Generation: Architectures, Threats, Defenses, and Future Directions for Building Trustworthy Systems
  3. 2026SoK: Privacy Risks and Mitigations in Retrieval-Augmented Generation Systems
  4. 2025Privacy-Aware RAG: Secure and Isolated Knowledge Retrieval
  5. 2026Towards Secure Retrieval-Augmented Generation: A Comprehensive Review of Threats, Defenses and Benchmarks
  6. 2024Pirates of the RAG: Adaptively Attacking LLMs to Leak Knowledge Bases
  7. 2024RAG with Differential Privacy
  8. 2025RAG Safety: Exploring Knowledge Poisoning Attacks to Retrieval-Augmented Generation