Abstract
Graph-based Retrieval-Augmented Generation (GraphRAG) constructs the Knowledge Graph (KG) from external databases to enhance the timeliness and accuracy of Large Language Model (LLM) this http URL,this reliance on external data introduces new attack this http URL can inject poisoned texts into databases to manipulate LLMs into producing harmful target responses for attacker-chosen this http URL research primarily focuses on attacking conventional RAG this http URL,such methods are ineffective against this http URL robustness derives from the KG abstraction of GraphRAG,which reorganizes injected text into a graph before retrieval,thereby enabling the LLM to reason based on the restructured context instead of raw poisoned this http URL expose latent security vulnerabilities in GraphRAG,we propose Knowledge Evolution Poison (KEPo),a novel poisoning attack method specifically designed for this http URL each target query,KEPo first generates a toxic event containing poisoned knowledge based on the target this http URL fabricating event backgrounds and forging knowledge evolution paths from original facts to the toxic event,it then poisons the KG and misleads the LLM into treating the poisoned knowledge as the final this http URL multi-target attack scenarios,KEPo further connects multiple attack corpora,enabling their poisoned knowledge to mutually reinforce while expanding the scale of poisoned communities,thereby amplifying attack this http URL results across multiple datasets demonstrate that KEPo achieves state-of-the-art attack success rates for both single-target and multi-target attacks,significantly outperforming previous methods.
Abstract (translated)
GraphRAG（基于图的检索增强生成）通过从外部数据库构建知识图谱来提升大型语言模型（LLM）在时效性和准确性方面的性能。然而，这种对外部数据的依赖也引入了新的攻击面——攻击者可以向数据库中注入中毒文本，使LLM生成特定目标的有害回应。尽管现有研究主要关注于针对传统检索增强生成（RAG）系统的攻击方法，但这些方法对GraphRAG无效，因为它的鲁棒性源于KG抽象化过程：在检索之前将注入的文本重组为图结构，从而使LLM基于重新组织后的上下文进行推理，而非直接处理原始中毒数据。 为了揭示GraphRAG潜在的安全漏洞，我们提出了一种专门针对该模型设计的新攻击方法——知识演进毒害（KEPo）。对于每个目标查询，KEPo首先根据特定目标生成含有中毒信息的事件，并构建虚假背景及从原有事实到有毒事件的知识演化路径。随后将这些知识引入KG中，误导LLM将其视为最终知识源。在多目标攻击场景下，KEPo进一步连接多个攻击数据库集合，使各自注入的知识相互强化并扩大受感染社区规模，从而放大整体攻击效果。 实验结果表明，在多种数据集上进行测试时，KEPo实现了针对单目标和多目标攻击的最佳成功率，并显著优于先前方法。
URL
https://arxiv.org/abs/2603.11501
