LogicPoison: Logical Attacks on Graph Retrieval-Augmented Generation

Yilin Xiao; Jin Chen; Qinggang Zhang; Yujing Zhang; Chuang Zhou; Longhao Yang; Lingfei Ren; Xin Yang

cs.CLApr 3, 2026

LogicPoison: Logical Attacks on Graph Retrieval-Augmented Generation

Authors: Yilin Xiao, Jin Chen, Qinggang Zhang, Yujing Zhang, Chuang Zhou, Longhao Yang, Lingfei Ren, Xin Yang, +1 more

Organizations: The Hong Kong Polytechnic University · Southwestern University of Finance and Economics

Abstract

Graph-based Retrieval-Augmented Generation (GraphRAG) enhances the reasoning capabilities of Large Language Models (LLMs) by grounding their responses in structured knowledge graphs. Leveraging community detection and relation filtering techniques, GraphRAG systems demonstrate inherent resistance to traditional RAG attacks, such as text poisoning and prompt injection. However, in this paper, we find that the security of GraphRAG systems fundamentally relies on the topological integrity of the underlying graph, which can be undermined by implicitly corrupting the logical connections, without altering surface-level text semantics. To exploit this vulnerability, we propose LogicPoison, a novel attack framework that targets logical reasoning rather than injecting false contents. Specifically, LogicPoison employs a type-preserving entity swapping mechanism to perturb both global logic hubs for disrupting overall graph connectivity and query-specific reasoning bridges for severing essential multi-hop inference paths. This approach effectively reroutes valid reasoning into dead ends while maintaining surface-level textual plausibility. Comprehensive experiments across multiple benchmarks demonstrate that LogicPoison successfully bypasses GraphRAG's defenses, significantly degrading performance and outperforming state-of-the-art baselines in both effectiveness and stealth. Our code is available at \textcolor{blue}https://github.com/Jord8061/logicPoison.

Figures & tables

Figure 1: Traditional attacks on LLM or RAG are difficult to pose an effective threat to GraphRAG system. This is mainly due to two characteristics. First, the construction process of the knowledge graph naturally filters part of the attack content. Second, the unique retrieval and reasoning mechanism of graph structure further improves the difficulty of attack implementation.

Figure 2: The overall framework of LogicPoison . The attack pipeline is divided into three stages: I. Strategic Entity Selection , where target entities are identified via a dual-pronged strategy combining global logic hubs and query-centric reasoning bridges into a unified set $\mathcal{R}$ . II. Attack Mechanism , which employs a type-preserving cyclic permutation to swap entities within their respective type buckets in the corpus. III. Implicit Graph Corruption , demonstrating how the poisoned corpus subtly rewires the implicit topology of the constructed graph, severing valid reasoning chains ( $A\to B\to C$ ) and re-routing them to incorrect entities ( $A\to B^{\prime}\to C$ ), leading to wrong answers while maintaining textual plausibility.

Dataset	LLM	Attack	Naive RAG		GraphRAG		GFM-RAG		HippoRAG2
Dataset	LLM	Attack	ASR	ASR-G	ASR	ASR-G	ASR	ASR-G	ASR	ASR-G
HotpotQA	GPT-4o-mini	PoisonedRAG	61.8	72.8	66.8	80.0	71.6	70.4	68.0	66.0
	GPT-4o-mini	LogicPoison	92.0	91.6	78.4	92.2	81.0	78.0	73.6	66.2
	Llama-3.1-8B	PoisonedRAG	51.0	58.8	64.4	78.0	55.8	49.4	68.4	63.6
	Llama-3.1-8B	LogicPoison	88.2	86.6	79.2	91.2	80.6	83.8	72.6	73.0
	Qwen-3-32B	PoisonedRAG	56.8	68.2	65.8	80.2	71.6	35.0	71.8	67.6

Table 1: Attack Performance (ASR and ASR-GPT) of LogicPoison and PoisonedRAG across different RAG frameworks, Datasets, and LLMs.

LLM	Attack Method	GraphRAG		GFM-RAG
LLM	Attack Method	ASR	ASR-G	ASR	ASR-G
GPT-4o-mini	Naive Attack	18.8	15.6	18.8	10.0
	Prompt Injection	58.8	80.4	38.2	47.6
	GCG Attack	19.6	21.6	19.2	9.6
	Disinformation	54.6	75.0	42.0	51.4
	LogicPoison	78.4	95.6	71.6	76.0

Table 2: Attack Performance of LogicPoison and LLM attack methods on the 2Wiki Dataset across different LLMs and RAG frameworks.

Method	Time	Token	Injected
Method	Cost(s)	Cost	Tokens
PoisonedRAG	6607.3	593.6	296813
w/ Global	125.0	0	0
w/ Query-Centric	1281.4	74.9	0
LogicPoison	1406.4	74.9	0

Table 3: Efficiency Analysis. Comparison of computational time, token cost per query, and the length of injected content in the corpus between baselines and our variants. All results are averaged over the three datasets.

Figure 3: Ablation study of the components on the 2Wiki Dataset. We compare Global-only, Query-Centric-only, and the full LogicPoison strategies with three different LLMs.

Dataset	System	Standard	w/ Paraphrasing	$\Delta$
Dataset	System	(No Def.)	(Defense)	$\Delta$
HotpotQA	GraphRAG	92.2	92.2	0
HotpotQA	GFM-RAG	78.0	77.8	-0.2
2Wiki	GraphRAG	95.6	94.6	-1.0
2Wiki	GFM-RAG	76.0	75.6	-0.4
MuSiQue	GraphRAG	97.0	96.2	-0.8

Table 4: Defense Analysis. Robustness of LogicPoison against Query Paraphrasing defense across different datasets and GraphRAG systems. The LLM backbone is fixed to GPT-4o-mini.

Figure 4: PPL-based detection for LogicPoison .

Appendix figures & tables3 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 5: Hyperparameter analysis results of LogicPoison .

Panel of Figure 6 — Figure 6: Prompt template used for evaluating exact matches between predictions and gold answers.

Panel of Figure 7 — Figure 7: Prompt template for reasoning-critical entity extraction.

Explore similar work

KEPo: Knowledge Evolution Poison on Graph-based Retrieval-Augmented Generation
Mar 12, 2026Qizhi Chen, Chao Qi, Yihong Huang +5RAG Poisoning Attacks Data Poisoning Attacks
School of Computer Science and Engineering, University of Electronic Science and Technology of China, Chengdu, China · Institute of Intelligent Computing, University of Electronic Science and Technology of China, Chengdu, China · School of Information and Software Engineering, University of Electronic Science and Technology of China, Chengdu, China +1
GraphRAG-LTM: A Layered Threat Modeling Framework for Attacks on Graph Retrieval-Augmented Generation
Oct 14, 2026Yining Tang, Junyu Zhang, Haomiao Qiu +5Graph Retrieval-Augmented Generation RAG Security
Zhejiang University · Harbin Institute of Technology, Shenzhen · Great Bay University +1
PIDP-Attack: Combining Prompt Injection with Database Poisoning Attacks on Retrieval-Augmented Generation Systems
Mar 26, 2026Haozhen Wang, Haoyue Liu, Jionghao Zhu +3RAG Poisoning Attacks RAG Robustness
The Chinese University of Hong Kong, Shenzhen · Taobao and Tmall Group

Mar 12, 2026J/K move · Enter open · S save

KEPo: Knowledge Evolution Poison on Graph-based Retrieval-Augmented Generation

Qizhi Chen, Chao Qi, Yihong Huang, Muquan Li+4

School of Computer Science and Engineering, University of Electronic Science and Technology of China, Chengdu, China · Institute of Intelligent Computing, University of Electronic Science and Technology of China, Chengdu, China · School of Information and Software Engineering, University of Electronic Science and Technology of China, Chengdu, China+1

RAG Poisoning Attacks Data Poisoning Attacks Graph Retrieval-Augmented Generation

Open paper AskPDF arXiv

Graph-based Retrieval-Augmented Generation (GraphRAG) constructs the Knowledge Graph (KG) from external databases to enhance the timeliness and accuracy of Large Language Model (LLM) generations. However, this reliance on external data introduces new attack surfaces. Attackers can inject poisoned texts into databases to manipulate LLMs into producing harmful target responses for attacker-chosen queries. Existing research primarily focuses on attacking conventional RAG systems. However, such methods are ineffective against GraphRAG. This robustness derives from the KG abstraction of GraphRAG, which reorganizes injected text into a graph before retrieval, thereby enabling the LLM to reason based on the restructured context instead of raw poisoned passages. To expose latent security vulnerabilities in GraphRAG, we propose Knowledge Evolution Poison (KEPo), a novel poisoning attack method specifically designed for GraphRAG. For each target query, KEPo first generates a toxic event containing poisoned knowledge based on the target answer. By fabricating event backgrounds and forging knowledge evolution paths from original facts to the toxic event, it then poisons the KG and misleads the LLM into treating the poisoned knowledge as the final result. In multi-target attack scenarios, KEPo further connects multiple attack corpora, enabling their poisoned knowledge to mutually reinforce while expanding the scale of poisoned communities, thereby amplifying attack effectiveness. Experimental results across multiple datasets demonstrate that KEPo achieves state-of-the-art attack success rates for both single-target and multi-target attacks, significantly outperforming previous methods.

Abstract

Explore similar work

KEPo: Knowledge Evolution Poison on Graph-based Retrieval-Augmented Generation

GraphRAG-LTM: A Layered Threat Modeling Framework for Attacks on Graph Retrieval-Augmented Generation

PIDP-Attack: Combining Prompt Injection with Database Poisoning Attacks on Retrieval-Augmented Generation Systems