Abstract
Graph-based Retrieval-Augmented Generation (GraphRAG) enhances the reasoning capabilities of Large Language Models (LLMs) by grounding their responses in structured knowledge graphs. Leveraging community detection and relation filtering techniques, GraphRAG systems demonstrate inherent resistance to traditional RAG attacks, such as text poisoning and prompt injection. However, in this paper, we find that the security of GraphRAG systems fundamentally relies on the topological integrity of the underlying graph, which can be undermined by implicitly corrupting the logical connections, without altering surface-level text semantics. To exploit this vulnerability, we propose \textsc{LogicPoison}, a novel attack framework that targets logical reasoning rather than injecting false contents. Specifically, \textsc{LogicPoison} employs a type-preserving entity swapping mechanism to perturb both global logic hubs for disrupting overall graph connectivity and query-specific reasoning bridges for severing essential multi-hop inference paths. This approach effectively reroutes valid reasoning into dead ends while maintaining surface-level textual plausibility. Comprehensive experiments across multiple benchmarks demonstrate that \textsc{LogicPoison} successfully bypasses GraphRAG's defenses, significantly degrading performance and outperforming state-of-the-art baselines in both effectiveness and stealth. Our code is available at \textcolor{blue}this https URL.
Abstract (translated)
基于图的检索增强生成（GraphRAG）通过将回答锚定在结构化知识图谱上，增强了大型语言模型（LLMs）的推理能力。利用社区检测和关系过滤技术，GraphRAG系统对传统的RAG攻击（如文本投毒和提示注入）表现出固有抵抗力。然而，本文发现GraphRAG系统的安全性根本上依赖于底层图的拓扑完整性，而该完整性可能在不改变表面文本语义的情况下，通过隐式破坏逻辑连接而被削弱。为利用此漏洞，我们提出了\textsc{LogicPoison}，一种针对逻辑推理而非注入虚假内容的新型攻击框架。具体而言，\textsc{LogicPoison}采用类型保持的实体交换机制，同时扰动全局逻辑枢纽以破坏整体图连通性，并切断查询特定推理桥梁以阻断关键的多跳推理路径。该方法在保持表面文本合理性的同时，有效将有效推理引入死胡同。在多个基准测试上的综合实验表明，\textsc{LogicPoison}成功绕过了GraphRAG的防御，显著降低了其性能，并在有效性和隐蔽性上均优于最先进基线方法。代码已公开于\this https URL。
URL
https://arxiv.org/abs/2604.02954
