Graph attack methods degrade retrieval augmented large language model answers
GraphRAG-LTM: A Layered Threat Modeling Framework for Attacks on Graph Retrieval-Augmented Generation
Computation and Language
Summary
Some AI tools use graphs made from documents to help answer questions. The paper shows ways attackers can trick these tools by changing the search queries or editing parts of the graph. This makes the AI give worse answers or miss important facts. The authors built a system to test different attack levels and found that attacks using more information and graph changes are more harmful. This helps understand where these AI tools are vulnerable.
What this means in practice
- •For security engineers: Improve the design of defenses against query and graph manipulation attacks in document-based AI answer systems.
- •For product teams building ai assistants: Develop more robust AI assistants that use knowledge graphs by testing against layered threat models of query and graph edits.
Authors
Yining Tang, Junyu Zhang, Haomiao Qiu, Yongchao Liu, Jiajun Zheng, Zhao Wang, Ziyue Qiao, Chao Wu
Abstract
Graph retrieval-augmented generation (GraphRAG) uses document-derived knowledge graphs to assemble evidence for large language model (LLM) answers. Its security depends on both the seed chunks retrieved for a query and the graph evidence assembled from them, yet attacks on this evidence path remain underexplored. We introduce GraphRAG-LTM, a Layered Threat Modeling framework that tests three nested levels of attacker access. BB Query uses ranking feedback to make query edits under a semantic-similarity constraint and demote relevant seed chunks. WB Query uses retriever gradients for the same objective. Graph-aware WB keeps the white-box adversarial query and deletes bridge triplets from the query-specific evidence graph, disrupting multi-hop evidence propagation through localized graph edits. Across datasets, retrievers, and LLM backbones, rank feedback alone reduces answer quality, gradient access strengthens query attacks, and bridge-triplet deletion further impairs supporting-fact retrieval. Further analyses show how seed retrieval and graph evidence jointly contribute to these failures.