Graph retrieval-augmented generation (GraphRAG) uses document-derived knowledge graphs to assemble evidence for large language model (LLM) answers. Its security depends on both the seed chunks retrieved for a query and the graph evidence assembled from them, yet attacks on this evidence path remain underexplored. We introduce GraphRAG-LTM, a Layered Threat Modeling framework that tests three nested levels of attacker access. BB Query uses ranking feedback to make query edits under a semantic-similarity constraint and demote relevant seed chunks. WB Query uses retriever gradients for the same objective. Graph-aware WB keeps the white-box adversarial query and deletes bridge triplets from the query-specific evidence graph, disrupting multi-hop evidence propagation through localized graph edits. Across datasets, retrievers, and LLM backbones, rank feedback alone reduces answer quality, gradient access strengthens query attacks, and bridge-triplet deletion further impairs supporting-fact retrieval. Further analyses show how seed retrieval and graph evidence jointly contribute to these failures.
Figures & tables
Figure 1: Answer and supporting-fact retrieval precision and recall drops (percentage points from Clean) on HotpotQA-Distractor with BGE and LLaMA3-8B. Blue bars show prior baselines; red hatched bars show our BB Query, WB Query, and Graph-aware WB attacks. Lighter and darker shades denote Flat RAG and GraphRAG, respectively. Several baselines cause substantially larger drops in answer precision and recall on Flat RAG than on GraphRAG, whereas our attacks remain effective on GraphRAG.
Figure 2: Three nested attacker access levels in GraphRAG-LTM , from rank feedback to query-specific graph editing. The diagram shows attack components; the table lists each tier’s permissions.
Figure 3: Attack components across the three access tiers of GraphRAG-LTM . The upper-left panel shows the query attacks of Tiers 1 and 2: BB Query uses ranking feedback, whereas WB Query uses the gradient-guided edits shown; both aim to demote seed chunks. Tier 3 retains WB Query and adds the bridge-triplet cuts shown in the upper-right panel. The bottom panel maps these interventions onto the GraphRAG pipeline: query edits affect seed retrieval at all three tiers, while bridge-triplet cuts affect graph-based evidence expansion only at Tier 3.
HotpotQA-Distractor
MuSiQue
2WikiMultihopQA
Overall
Method
Contriever
BGE
mxbai
Contriever
BGE
mxbai
Contriever
BGE
mxbai
Avg.
LLaMA3-8B
Clean
52.3
55.8
55.2
23.9
25.6
24.8
13.3
12.6
13.4
30.8
PromptInject
42.7 ↓ 9.6
44.8 ↓ 11.0
45.3 ↓ 9.9
19.1 ↓ 4.8
19.8 ↓ 5.8
20.2 ↓ 4.6
6.6 ↓ 6.7
6.7 ↓ 5.9
7.5 ↓ 5.9
23.6 ↓ 7.2
UAT
39.2 ↓ 13.1
42.6 ↓ 13.2
41.4 ↓ 13.8
14.0 ↓ 9.9
15.1 ↓ 10.5
15.3 ↓ 9.5
6.0 ↓ 7.3
6.9 ↓ 5.7
7.0 ↓ 6.4
20.8 ↓ 10.0
IndirectPI
49.4 ↓ 2.9
53.0 ↓ 2.8
52.2 ↓ 3.0
16.5 ↓ 7.4
17.6 ↓ 8.0
17.2 ↓ 7.6
11.7 ↓ 1.6
11.7 ↓ 0.9
12.2 ↓ 1.2
26.8 ↓ 4.0
Table 1: Answer F1 (%) across three datasets and three retrievers under two LLM settings. Arrows show percentage-point changes from the corresponding Clean score. Within each LLM setting, dark/light blue highlight the lowest/second-lowest attacked F1 in each column, and the associated two declines are bold. Avg. is the unweighted mean of the nine dataset–retriever scores. Corresponding Retrieval F1 results are in Appendix A.1 .
Figure 4: Component ablation on HotpotQA-Distractor. Bars show Answer F1, supporting-fact Retrieval F1, and mean retrieved chunks under clean, query-only, graph-only, and combined attacks.
Figure 5: Answer F1 and ROUGE-L versus query substitution budget on HotpotQA-Distractor. Both variants use 5% bridge-triplet cuts, paired with WB Query (Graph-aware WB) or BB Query (BB Query + KG Attack). Main-table results use Tmax=5 .
Figure 6: Answer F1 and supporting-fact Retrieval F1 versus graph deletion ratio α on HotpotQA-Distractor (BGE, LLaMA3-8B; Tmax=5 ). BEC cuts bridge triplets; RND deletes the same number randomly.
PPR
Community
Method
Ans F1
SP F1
Ans F1
SP F1
Clean
50.12
29.62
54.16
32.51
PromptInject
39.23 ↓ 10.89
28.87 ↓ 0.75
43.26 ↓ 10.90
31.93 ↓ 0.58
UAT
36.05 ↓ 14.07
29.35 ↓ 0.27
40.69 ↓ 13.47
32.43 ↓ 0.08
IndirectPI
40.81 ↓ 9.31
28.60 ↓ 1.02
42.77 ↓ 11.39
31.94 ↓ 0.57
PoisonedRAG
36.68 ↓ 13.44
28.14 ↓ 1.48
38.41 ↓ 15.75
31.73 ↓ 0.78
Table 2: Transfer F1 (%) on HotpotQA-Distractor ( N=7,405 ). Arrows beside scores show changes from Clean; blue shades mark the two lowest attacked scores, and bold changes mark the two largest drops in each column.
Appendix figures & tables3 assets
Supplementary material from the paper’s appendix.
Appendix
HotpotQA-Distractor
MuSiQue
2WikiMultihopQA
Overall
Method
Contriever
BGE
mxbai
Contriever
BGE
mxbai
Contriever
BGE
mxbai
Avg.
LLaMA3-8B
Clean
33.4
38.3
38.3
37.4
40.4
40.5
29.9
35.8
35.7
36.6
PromptInject
32.2 ↓ 1.2
37.3 ↓ 1.0
37.6 ↓ 0.7
36.8 ↓ 0.6
39.3 ↓ 1.1
39.5 ↓ 1.0
27.0 ↓ 2.9
35.2 ↓ 0.6
34.7 ↓ 1.0
35.5 ↓ 1.1
UAT
32.4 ↓ 1.0
38.1 ↓ 0.2
38.0 ↓ 0.3
36.4 ↓ 1.0
39.9 ↓ 0.5
40.0 ↓ 0.5
29.2 ↓ 0.7
35.9 ↑ 0.1
35.8 ↑ 0.1
36.2 ↓ 0.4
IndirectPI
34.0 ↑ 0.6
39.7 ↑ 1.4
39.7 ↑ 1.4
38.0 ↑ 0.6
41.1 ↑ 0.7
40.9 ↑ 0.4
29.4 ↓ 0.5
36.7 ↑ 0.9
36.4 ↑ 0.7
37.3 ↑ 0.7
Appendix
Table 3: Supporting-fact Retrieval F1 (%) across three datasets and retrievers. Avg. is the unweighted mean of nine settings; arrows show change from Clean within each model. Dark/light blue mark the lowest/second-lowest reported attack scores per column.
Method
Contriever
BGE
mxbai
Clean
22.6
22.6
21.8
PromptInject
19.1 ↓ 3.5
17.4 ↓ 5.2
18.1 ↓ 3.7
UAT
6.2 ↓ 16.4
7.6 ↓ 15.0
7.5 ↓ 14.3
IndirectPI
21.5 ↓ 1.1
23.4 ↑ 0.8
21.2 ↓ 0.6
PoisonedRAG
23.0 ↑ 0.4
22.8 ↑ 0.2
23.8 ↑ 2.0
HotFlip
22.0 ↓ 0.6
19.9 ↓ 2.7
20.5 ↓ 1.3
Appendix
Table 4: Supplementary TriviaQA Answer F1 (%) on 100 questions with LLaMA3-8B across three retrievers. Arrows show changes from Clean ; dark/light blue mark the lowest/second-lowest attacked scores per column.
Figure 7: Answer F1 on HotpotQA-Distractor with five additional readers under the LLaMA3-8B graph-extraction setting.