mlsanityData to 14 Oct 2026

Query-Efficient Agentic Graph Extraction Attacks on GraphRAG Systems

arXiv 2601.14662 ↗First posted 21 Jan 2026cs.AI cs.MAcited by 3

On the map: LLM reasoning → Knowledge- and tool-augmented reasoning

also in 2 more
Abstract (arXiv)

Graph-based retrieval-augmented generation (GraphRAG) systems construct knowledge graphs over document collections to support multi-hop reasoning. While prior work shows that GraphRAG responses may leak retrieved subgraphs, the feasibility of query-efficient reconstruction of the hidden graph structure remains unexplored under realistic query budgets. We study a budget-constrained black-box setting where an adversary adaptively queries the system to steal its latent entity-relation graph. We propose AGEA (Agentic Graph Extraction Attack), a framework that leverages a novelty-guided exploration-exploitation strategy, external graph memory modules, and a two-stage graph extraction pipeline combining lightweight discovery with LLM-based filtering. We evaluate AGEA on medical, agriculture, and literary datasets across Microsoft-GraphRAG and LightRAG systems. Under identical query budgets, AGEA significantly outperforms prior attack baselines, recovering up to 90% of entities and relationships while maintaining high precision. These results demonstrate that modern GraphRAG systems are highly vulnerable to structured, agentic extraction attacks, even under strict query limits. The code is available at https://github.com/shuashua0608/AGEA.

Key facts. Cited by 3 papers in the map (data through 14 Oct 2026). Placed in Knowledge- and tool-augmented reasoning, one of 17 directions in LLM reasoning. Builds on 24 of its 46 references that are in the map. First posted on arXiv 21 Jan 2026.

Builds on

24 of 46 references.

Closest ancestors · 1

Same direction, newest first

  1. 2025Diagnosing and Addressing Pitfalls in KG-RAG Datasets: Toward More Reliable Benchmarking29 May

Other references · 23

  1. 2024From Local to Global: A Graph RAG Approach to Query-Focused Summarizationcited by 1,453
  2. 2024RAPTOR: Recursive Abstractive Processing for Tree-Organized Retrievalcited by 532
  3. 2023Iterative Preference Learning from Human Feedback: Bridging Theory and Practice for RLHF under KL-Constraintcited by 350
  4. 2024The Good and The Bad: Exploring Privacy Issues in Retrieval-Augmented Generation (RAG)cited by 159
  5. 2023Knowledge Graph Prompting for Multi-Document Question Answeringcited by 152
  6. 2025Unveiling Privacy Risks in LLM Agent Memorycited by 101
  7. 2024Follow My Instruction and Spill the Beans: Scalable Data Extraction from Retrieval-Augmented Generation Systemscited by 76
  8. 2025Knowledge Graph-Guided Retrieval Augmented Generationcited by 58
  9. 2023Fighting Fire with Fire: The Dual Role of LLMs in Crafting and Detecting Elusive Disinformationcited by 51
  10. 2025In-depth Analysis of Graph-based RAG in a Unified Frameworkcited by 46
  11. 2024Feedback-Guided Extraction of Knowledge Base from Retrieval-Augmented LLM Applicationscited by 37
  12. 2024Unleashing Worms and Extracting Data: Escalating the Outcome of Attacks against RAG-based Inference in Scale and Severity Using Jailbreakingcited by 30
11 more
  1. 2025KET-RAG: A Cost-Efficient Multi-Granular Indexing Framework for Graph-RAGcited by 29
  2. 2024Graph Unlearning with Efficient Partial Retrainingcited by 20
  3. 2025Silent Leaks: Implicit Knowledge Extraction Attack on RAG Systems through Benign Queriescited by 19
  4. 2024Pirates of the RAG: Adaptively Attacking LLMs to Leak Knowledge Basescited by 18
  5. 2024Graphusion: A RAG Framework for Knowledge Graph Construction with a Global Perspectivecited by 12
  6. 2025Privacy-Aware RAG: Secure and Isolated Knowledge Retrievalcited by 10
  7. 2025Differentially Private Synthetic Text Generation for Retrieval-Augmented Generation (RAG)cited by 6
  8. 2025CORRECT: Context- and Reference-Augmented Reasoning and Prompting for Fact-Checkingcited by 5
  9. 2025BioMol-MQA: A Multi-Modal Question Answering Dataset For LLM Reasoning Over Bio-Molecular Interactionscited by 4
  10. 2025Generalizing Test-time Compute-optimal Scaling as an Optimizable Graphcited by 4
  11. 2026Making Theft Useless: Adulteration-Based Protection of Proprietary Knowledge Graphs in GraphRAG Systemscited by 2

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 3.

3 papers.

  1. 2026URAG: A Benchmark for Uncertainty Quantification in Retrieval-Augmented Large Language Modelscited by 3
  2. 2026Securing Retrieval-Augmented Generation: A Taxonomy of Attacks, Defenses, and Future Directionscited by 2
  3. 2026The Confidence Trap: Calibration Attacks for Graph Neural Networkscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Graphs Don't Stay Secret: Practical Subgraph Reconstruction Attacks on Defended Graph RAG
  2. 2026LogicPoison: Logical Attacks on Graph Retrieval-Augmented Generation
  3. 2025GraphRAG under Fire
  4. 2025GraphSearch: An Agentic Deep Searching Workflow for Graph Retrieval-Augmented Generation
  5. 2026GraphSteal: Structural Knowledge Stealing from Graph RAG via Traversal Reconstruction
  6. 2026GraphRAG-LTM: A Layered Threat Modeling Framework for Attacks on Graph Retrieval-Augmented Generation
  7. 2026A2RAG: Adaptive Agentic Graph Retrieval for Cost-Aware and Reliable Reasoning
  8. 2025Youtu-GraphRAG: Vertically Unified Agents for Graph Retrieval-Augmented Complex Reasoning