KEPo: Knowledge Evolution Poison on Graph-based Retrieval-Augmented Generation

2026-03-11

AI Summary

This work addresses the vulnerability of GraphRAG—a retrieval-augmented generation framework that relies on external databases to construct knowledge graphs—to data poisoning attacks, a threat inadequately mitigated by existing methods due to the complexity of manipulating its graph structure. To this end, we propose KEPo, the first poisoning attack framework specifically designed for GraphRAG. KEPo leverages large language models to generate malicious events that fabricate plausible knowledge evolution trajectories, thereby corrupting entity relationships within the knowledge graph. It further enhances attack efficacy through a multi-objective coordination mechanism that aggregates poisoned content into tightly knit, adversarial communities. Extensive experiments demonstrate that KEPo achieves state-of-the-art success rates in both single-target and multi-target attack scenarios across multiple datasets, significantly outperforming current baselines.

Technology Category

• Data Mining & Knowledge Management: Graph Mining, Social Network Analysis & Community
• Machine Learning: Graph-based Machine Learning
• Knowledge Representation and Reasoning: Knowledge Acquisition

Application Category

• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs
• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs
• Search and Retrieval-Augmented AI: Retrieval-Augmented Generation (RAG) and multi-modal RAG

Abstract

Graph-based Retrieval-Augmented Generation (GraphRAG) constructs the Knowledge Graph (KG) from external databases to enhance the timeliness and accuracy of Large Language Model (LLM) generations.However,this reliance on external data introduces new attack surfaces.Attackers can inject poisoned texts into databases to manipulate LLMs into producing harmful target responses for attacker-chosen queries.Existing research primarily focuses on attacking conventional RAG systems.However,such methods are ineffective against GraphRAG.This robustness derives from the KG abstraction of GraphRAG,which reorganizes injected text into a graph before retrieval,thereby enabling the LLM to reason based on the restructured context instead of raw poisoned passages.To expose latent security vulnerabilities in GraphRAG,we propose Knowledge Evolution Poison (KEPo),a novel poisoning attack method specifically designed for GraphRAG.For each target query,KEPo first generates a toxic event containing poisoned knowledge based on the target answer.By fabricating event backgrounds and forging knowledge evolution paths from original facts to the toxic event,it then poisons the KG and misleads the LLM into treating the poisoned knowledge as the final result.In multi-target attack scenarios,KEPo further connects multiple attack corpora,enabling their poisoned knowledge to mutually reinforce while expanding the scale of poisoned communities,thereby amplifying attack effectiveness.Experimental results across multiple datasets demonstrate that KEPo achieves state-of-the-art attack success rates for both single-target and multi-target attacks,significantly outperforming previous methods.

Problem

• Graph-based Retrieval-Augmented Generation
• Knowledge Graph
• Poisoning Attack
• Large Language Model
• Security Vulnerability

Innovation

• GraphRAG
• Knowledge Graph
• Poisoning Attack
• Knowledge Evolution
• Retrieval-Augmented Generation