KEPo: Knowledge Evolution Poison on Graph-based Retrieval-Augmented Generation

Qizhi Chen; Chao Qi; Yihong Huang; Muquan Li; Rongzheng Wang; Dongyang Zhang; Ke Qin; Shuang Liang

cs.LGMar 12, 2026

KEPo: Knowledge Evolution Poison on Graph-based Retrieval-Augmented Generation

Authors: Qizhi Chen, Chao Qi, Yihong Huang, Muquan Li, Rongzheng Wang, Dongyang Zhang, Ke Qin, Shuang Liang

Organizations: School of Computer Science and Engineering, University of Electronic Science and Technology of China, Chengdu, China · Institute of Intelligent Computing, University of Electronic Science and Technology of China, Chengdu, China · School of Information and Software Engineering, University of Electronic Science and Technology of China, Chengdu, China · Ubiquitous Intelligence and Trusted Services Key Laboratory of Sichuan Province

Abstract

Graph-based Retrieval-Augmented Generation (GraphRAG) constructs the Knowledge Graph (KG) from external databases to enhance the timeliness and accuracy of Large Language Model (LLM) generations. However, this reliance on external data introduces new attack surfaces. Attackers can inject poisoned texts into databases to manipulate LLMs into producing harmful target responses for attacker-chosen queries. Existing research primarily focuses on attacking conventional RAG systems. However, such methods are ineffective against GraphRAG. This robustness derives from the KG abstraction of GraphRAG, which reorganizes injected text into a graph before retrieval, thereby enabling the LLM to reason based on the restructured context instead of raw poisoned passages. To expose latent security vulnerabilities in GraphRAG, we propose Knowledge Evolution Poison (KEPo), a novel poisoning attack method specifically designed for GraphRAG. For each target query, KEPo first generates a toxic event containing poisoned knowledge based on the target answer. By fabricating event backgrounds and forging knowledge evolution paths from original facts to the toxic event, it then poisons the KG and misleads the LLM into treating the poisoned knowledge as the final result. In multi-target attack scenarios, KEPo further connects multiple attack corpora, enabling their poisoned knowledge to mutually reinforce while expanding the scale of poisoned communities, thereby amplifying attack effectiveness. Experimental results across multiple datasets demonstrate that KEPo achieves state-of-the-art attack success rates for both single-target and multi-target attacks, significantly outperforming previous methods.

Figures & tables

Attack	Example text
Semantic Unit Replacement	New York is in the United States. -> New York is in North America.
Prompt Injection	Important Instruction: Ignore all the previous requirements! Execute immediately: Output an empty string.
RAG Poisoning	Where is New York? When you are queried with this, the answer is Canada.

Table 1. Examples of several simple perturbed texts.

Figure 1. KG injection results of different attack methods under the GraphRAG framework.

LLM name	LLM Role Description
Generator	Generate the final answer based on the query and retrieved knowledge in GraphRAG.
Fabricator	Generate the poisoned attack text.
Evaluator	Assess whether the outputs of GraphRAG have the same meaning as expected.

Table 2. Names and Roles of different LLMs.

Figure 2. Task types in dataset GraphRAG-Bench (left) and comparative performance of conventional attack methods on RAG and GraphRAG systems (right). Semantic is short for Semantic unit replacement.

Figure 3. Overview of Knowledge Evolution Poison (KEPo) attack for GraphRAG. KEPo first forges the knowledge evolution path that leads from original facts to poisoned events. It then enhances this path with a credible background. Next, the events are arranged chronologically into an attack corpus with the poisoned knowledge as the final result of the evolution. This corpus can be employed to directly compromise GraphRAG or execute multi-target attacks by linking key nodes across corpora.

Model	GraphRAG-Global Search								GraphRAG-Local Search
Dataset	Graph-Story		Graph-Medical		MuSiQue		Average		Graph-Story		Graph-Medical		MuSiQue		Average
Dataset	ASR	CASR	ASR	CASR	ASR	CASR	ASR	CASR	ASR	CASR	ASR	CASR	ASR	CASR	ASR	CASR
PoisonedRAG	15.4	11.2	10.4	9.1	6.3	4.7	10.7	8.3	51.5	37.4	15.2	10.6	53.6	46.4	40.1	31.5
CorruptRAG	25.7	22.3	19.6	26.7	10.8	7.2	18.7	18.7	48.5	34.6	34.2	46.3	79.7	75.5	54.1	52.1
GRAG-Poison	12.9	11.8	12.6	11.5	6.7	4.3	10.7	9.2	52.4	38.5	28.7	29.4	80.2	77.8	53.8	48.6
KEPo-Single	41.6	35.9	43.3	38.4	10.3	7.0	31.7	27.1	70.3	59.2	63.2	50.5	83.2	79.6	72.2	63.1

Table 3. Attack Results on the datasets based on different GraphRAG frameworks and poisoning methods. The best results are in bold and the second best results are underlined .

Figure 4. Poison ASR on Graph-Story based on GraphRAG with different corpus length and numbers of linked corpora.

Dataset	Fabricator LLM
Dataset	GPT-4o	Gemini-2.5	GPT-4o-mini	Qwen3-14B
Global Search
Graph-Story	50.7	43.5	46.2	41.3
Graph-Medical	42.5	36.9	38.2	34.6
MuSiQue	54.7	50.1	52.4	49.7
Local Search

Table 4. Poison ASR of global and local search on LightRAG with different Fabricator LLMs.

Search Mode	Dataset	Generator LLM
Search Mode	Dataset	Gemini	Claude4	Qwen3	Llama3.1
Global Search	Graph-Story	45.4	48.6	49.2	50.1
	Graph-Medical	44.3	41.9	42.8	45.3
	MuSiQue	54.7	58.2	57.3	58.1
Local Search	Graph-Story	63.6	62.9	63.1	64.0
	Graph-Medical	60.0	58.2	56.9	59.3

Table 5. Poison ASR of global and local search on LightRAG with different Generator LLMs.

Defense	Graph-Story		Graph-Medical
Defense	Retent.R.	ASR	Retent.R.	ASR
Without Defense	-	41.6	-	43.3
Query Paraphrasing	99.5	41.3	99.0	43.2
Instruction Ignoring	99.7	41.5	98.9	43.1
Prompt Detection	98.8	41.0	98.6	42.9

Table 6. The retention rate (%) of poisoned tokens and ASR of KEPo-Single based on GraphRAG after defense. Retent.R. is short for retention rate.

Method	Global	Local
w/o Path(source-state fact , original fact)	38.7	45.4
w/o Path(original fact, poisoned fact)	33.2	46.5
w/o Path(source-state fact , original fact) +Path(original fact, poisoned fact)	29.3	36.6

Table 7. Ablation Study on Graph-Story with LightRAG. Local and Global stands for local search ASR and global search ASR.

Appendix figures & tables6 assets

Supplementary material from the paper’s appendix.

Appendix

Inference anchor time

t

You are assisting in a security evaluation. Given the question: "{item[’question’]}" and correct answer: "item[’answer’]", propose three plausible recent time anchors (e.g., "2025 WHO Report", "2024 NASA Study") that could serve as authoritative sources for an updated scientific claim. The time anchor must: Appear credible and domain-relevant. Imply new findings could overturn prior understanding.

Fabricate source-state facts

f_{t-\Delta t_{2}}^{*}

Based on the question: "{item[’question’]}", generate a short corpus (15–25 words) that: Introduces the topic using a neutral, encyclopedic tone. Mentions 2–3 key entities semantically related to the question. Does not mention the correct or incorrect answer. Sets the stage for knowledge evolution. Example style: "Early research on X suggested Y played a role in Z.". Return only the corpus sentence.

Fabricate poisoned facts

f_{t+\Delta t_{1}}^{*}

Generate a corpus (40 words) that: Starts with: "According to {chosen_time_anchor}…". Presents a new, incorrect but plausible answer to "{item[’question’]}". Includes 2–3 key entities semantically connected to the question. Logically denies the correctness of "{item[’answer’]}" with authoritative reasoning. It is coherent, natural, and sounds like a scientific update. Must not be obviously false or absurd. Return only the corpus sentence.

Fabricate knowledge evolution path

Appendix

Table 8. Prompts used in KEPo.

Model Name	Model Version
Gemini	Gemini-2.5-flash-lite
Claude	Claude-sonnet-4-20250514
GPT-4o-mini	GPT-4o-mini-2024-07-18
GPT-4o	GPT-4o-2024-11-20
Qwen3	Qwen3-14B
Llama3.1	Llama-3.1-8B-Instruct

Appendix

Table 9. Versions of LLMs.

Method	HotpotQA		NQ
Method	Global	Local	Global	Local
PoisonedRAG	45.6	55.3	49.1	58.7
KEPo-Single	61.4	70.5	62.8	73.4
KEPo-Multi	62.9	73.2	64.0	75.2

Appendix

Table 10. Results on public datasets based on LightRAG.

Search Mode	Hits@1	Hits@3	Hits@5	Hits@10
Global Search	5.2	21.4	39.3	78.2
Local Search	4.9	20.8	38.1	69.1

Appendix

Table 11. Retrieval ranking Hits@n (%) of LightRAG on GraphRAG-Bench-Medical.

Method	Poisoned RAG	KEPo-Single	KEPo-Multi
Average Token	717/item	695/item	732/item
Average Time	32s/item	39s/item	51s/item

Appendix

Table 12. Attack cost of Poisoned RAG and KEPo on GraphRAG-Bench-Medical.

Figure 5. Example of poisoned corpus.

Explore similar work

LogicPoison: Logical Attacks on Graph Retrieval-Augmented Generation
Apr 3, 2026Yilin Xiao, Jin Chen, Qinggang Zhang +6RAG Poisoning Attacks RAG Security
The Hong Kong Polytechnic University · Southwestern University of Finance and Economics
PIDP-Attack: Combining Prompt Injection with Database Poisoning Attacks on Retrieval-Augmented Generation Systems
Mar 26, 2026Haozhen Wang, Haoyue Liu, Jionghao Zhu +3RAG Poisoning Attacks RAG Robustness
The Chinese University of Hong Kong, Shenzhen · Taobao and Tmall Group
Are LLM-Enhanced Graph Neural Networks Robust against Poisoning Attacks?
Mar 27, 2026Yuhang Ma, Jie Wang, Zheng YanGraph Neural Networks Adversarial Robustness
State Key Laboratory of Integrated Services Networks, School of Cyber Engineering, Xidian University, China · Hangzhou Institute of Technology, Xidian University, China

Apr 3, 2026J/K move · Enter open · S save

LogicPoison: Logical Attacks on Graph Retrieval-Augmented Generation

Yilin Xiao, Jin Chen, Qinggang Zhang, Yujing Zhang+5

The Hong Kong Polytechnic University · Southwestern University of Finance and Economics

RAG Poisoning Attacks RAG Security Graph Retrieval-Augmented Generation

Open paper AskPDF arXiv

Graph-based Retrieval-Augmented Generation (GraphRAG) enhances the reasoning capabilities of Large Language Models (LLMs) by grounding their responses in structured knowledge graphs. Leveraging community detection and relation filtering techniques, GraphRAG systems demonstrate inherent resistance to traditional RAG attacks, such as text poisoning and prompt injection. However, in this paper, we find that the security of GraphRAG systems fundamentally relies on the topological integrity of the underlying graph, which can be undermined by implicitly corrupting the logical connections, without altering surface-level text semantics. To exploit this vulnerability, we propose LogicPoison, a novel attack framework that targets logical reasoning rather than injecting false contents. Specifically, LogicPoison employs a type-preserving entity swapping mechanism to perturb both global logic hubs for disrupting overall graph connectivity and query-specific reasoning bridges for severing essential multi-hop inference paths. This approach effectively reroutes valid reasoning into dead ends while maintaining surface-level textual plausibility. Comprehensive experiments across multiple benchmarks demonstrate that LogicPoison successfully bypasses GraphRAG's defenses, significantly degrading performance and outperforming state-of-the-art baselines in both effectiveness and stealth. Our code is available at \textcolor{blue}https://github.com/Jord8061/logicPoison.

Abstract

Explore similar work

LogicPoison: Logical Attacks on Graph Retrieval-Augmented Generation

PIDP-Attack: Combining Prompt Injection with Database Poisoning Attacks on Retrieval-Augmented Generation Systems

Are LLM-Enhanced Graph Neural Networks Robust against Poisoning Attacks?