KEPo: Knowledge Evolution Poison on Graph-based Retrieval-Augmented Generation

arXiv cs.LG / 3/13/2026

📰 NewsIdeas & Deep AnalysisModels & Research

共有:

Key Points

GraphRAG constructs a knowledge graph from external databases to improve the timeliness and accuracy of LLM generations, but this reliance creates new attack surfaces through poisoned data.
GraphRAG's KG abstraction reorganizes injected text into a graph before retrieval, allowing the LLM to reason on the restructured context and mitigating some basic attacks while enabling new vulnerabilities.
The paper proposes Knowledge Evolution Poison (KEPo), a poisoning attack designed for GraphRAG that, for each target query, generates a toxic event with poisoned knowledge and forges knowledge evolution paths from original facts to the toxic event to poison the KG.
In multi-target settings, KEPo connects multiple attack corpora so poisoned knowledge can reinforce across communities, expanding the attack surface and boosting effectiveness.
Experimental results demonstrate that KEPo achieves state-of-the-art attack success rates for both single-target and multi-target attacks, significantly outperforming previous methods.

Abstract

Graph-based Retrieval-Augmented Generation (GraphRAG) constructs the Knowledge Graph (KG) from external databases to enhance the timeliness and accuracy of Large Language Model (LLM) generations.However,this reliance on external data introduces new attack surfaces.Attackers can inject poisoned texts into databases to manipulate LLMs into producing harmful target responses for attacker-chosen queries.Existing research primarily focuses on attacking conventional RAG systems.However,such methods are ineffective against GraphRAG.This robustness derives from the KG abstraction of GraphRAG,which reorganizes injected text into a graph before retrieval,thereby enabling the LLM to reason based on the restructured context instead of raw poisoned passages.To expose latent security vulnerabilities in GraphRAG,we propose Knowledge Evolution Poison (KEPo),a novel poisoning attack method specifically designed for GraphRAG.For each target query,KEPo first generates a toxic event containing poisoned knowledge based on the target answer.By fabricating event backgrounds and forging knowledge evolution paths from original facts to the toxic event,it then poisons the KG and misleads the LLM into treating the poisoned knowledge as the final result.In multi-target attack scenarios,KEPo further connects multiple attack corpora,enabling their poisoned knowledge to mutually reinforce while expanding the scale of poisoned communities,thereby amplifying attack effectiveness.Experimental results across multiple datasets demonstrate that KEPo achieves state-of-the-art attack success rates for both single-target and multi-target attacks,significantly outperforming previous methods.