Hop-Decayed Influence: New Vulnerabilities of Structural Auxiliary Indexing in GraphRAG Pipelines with LLM

Hop-Decayed Influence: New Vulnerabilities of Structural Auxiliary Indexing in GraphRAG Pipelines with LLM

arXiv:2610.02373v1 [cs.CR] 1 Oct 2026

Jisung Park1 B[0009-0005-8603-4125] , John Le1 [0000-0003-0019-0345] , and Heath Cooper1 [0009-0001-1054-5165] Institute of Cybersecurity and Cryptology, University of Wollongong jp407@uowmail.edu.au, {johnle, hcooper}@uow.edu.au

Abstract. GraphRAG pipelines construct auxiliary structures during offline indexing—semantic summaries, hierarchical edges, and pre-computed scores—that determine how retrieval is prioritised at query time. Prior attacks target only instance-level components (nodes, edges, triples), overlooking these schema-level structures. We formalise Auxiliary SchemaLevel Entity as a novel attack surface and propose the 3S Framework (Semantics, Structure, Scoring) for its systematic exploitation. Our HopDecayed Influence (HDI) attack identifies high-impact targets through query-aware influence propagation and corrupts their auxiliary structures post-indexing. Across two benchmarks (HotpotQA, 2WikiMultiHopQA) and two architectures (Microsoft GraphRAG, HippoRAG2), HDI achieves 88–94% attack success rate while modifying as few as 0.016% of auxiliary structures. Each modification affects up to 6.00 queries (Schema Leverage Ratio), demonstrating 1:N amplification unavailable to instance-level attacks. Manipulated structures evade perplexity and paraphrase defenses with over 99% evasion rate, as they remain linguistically coherent system-generated artifacts. These results reveal that auxiliary schema-level entities receive implicit trust without runtime validation, constituting a structural blind spot in current GraphRAG defenses. https://github.com/Jisung-Pacific/HDI-GraphRAG-Attack.

Keywords: GraphRAG · Knowledge Graph Security · Adversarial Attacks · Schema-Level Entities

1

Introduction

Large language models have achieved success [1] in NLP tasks in various domains, e.g., healthcare and scientific research [15, 30]. Yet, they exhibit limitations such as hallucination, knowledge recency gaps and lack of domain specific or private knowledge [10,13,16]. To address these limitations, Retrieval Augmented Generation (RAG) has emerged by retrieving relevant information from external knowledge bases [4, 17]. Existing RAG approaches have focused on semi-structured

2

J. Park et al.

knowledge (e.g., web page, email), unstructured knowledge (e.g., textual documents), and multimodal knowledge (e.g., image, audio) [2]. However, these RAG approaches still suffer from limitations such as weak structured, relational and logical knowledge representation, multi-hop traversal challenges [14]. KG RAG Offline Indexing

Chunking Embedding

Corpus "Alan Turing worked at the University of Manchester from 1948 until his death."

E1 E2

“The Turing Test was proposed by Alan Turing in 1950."

En

…

…

Knowledge Graph Construction

… … Embedding model

…

Named Entity Recognition S

Online Retrieval

…

Tokens

P

O

Constructor Auxiliary construction

Query

Top-k, filtering

“What university did the person who proposed the Turing Test belong to?” "What themes connect AI pioneers?"

…

Embedding process … E1 … … En

K1

Retriever Similarity search PPR algorithm Global retrieval

Knowledge Graph

K2

…

Generation Generator

Retriever

Embedding model

Kn

Output

Fig. 1. A process of GraphRAG pipeline

is a RAG technique that operates on knowledge graphs, leveraging structured relational knowledge where query processors, retrievers, and graph granularity interact to enhance retrieval precision [7, 8, 18, 24]. GraphRAG pipeline in this research extends beyond the conventional scope of online retrieval, which merely involves interactions among queries, retrievers, and static knowledge graphs. Instead, it encompasses the complete end to end process including offline indexing, which performs knowledge extraction from raw text corpora to knowledge graph construction [21, 26, 33]. These pipelines construct diverse and unique auxiliary structures. These auxiliary structures either enable additional functionalities such as sense-making and multi-hop reasoning, or enhance retrieval performance efficiency and effectiveness through mechanisms like context richness and pre-computed scoring [3, 5]. This approach is increasingly adopted in both academic and industrial fields across diverse domains [28, 30]. Recent security research has revealed vulnerabilities in RAG and GraphRAG systems through systematic poisoning attacks targeting knowledge retrieval and representation. Direct graph attacks manipulate the structural components of knowledge graphs corrupting nodes, edges, or triples to propagate misinformation through relational pathways [19,20,29]. Corpus to graph attacks exploit the end to end nature of GraphRAG pipelines, injecting adversarial passages into source corpora that propagate through the knowledge extraction workflow to corrupt the constructed graph [34, 35]. However, these attacks remain confined to the instance-level paradigm of conventional knowledge graphs, assuming that the graph itself constitutes the complete retrieval substrate. This perspective misses that end to end GraphRAG pipelines construct auxiliary structures during offline indexing that exist as separate layers beyond the core knowledge

HDI: Auxiliary Structure Poisoning in GraphRAG

3

graph. These structures are architectural necessities for advanced functionalities including sense-making and multi-hop reasoning. They reside not in the data plane of individual facts but in the control plane that determines retrieval paths and prioritisation directly determining not merely what is retrieved, but how it is ranked and interpreted. We propose Auxiliary Schema-Level Entity as an attack surface comprising components that exist beyond traditional graph granularities, systematised through the 3S Framework: Semantics (summaries), Structure (hierarchical edges), and Scoring (pre-computed metrics). This qualifies as an attack surface for the following reasons. These structures are required components for advanced functionalities including sense-making and multi-hop reasoning, residing in the control plane that determines retrieval paths and prioritisation. As system generated artifacts, they are granted implicit trust and excluded from runtime validation. A single schema at hierarchical aggregation points, when manipulated, simultaneously affects numerous subordinate entities and queries providing asymmetric 1:N leverage. Even when instance-level facts remain accurate, higher level semantic abstractions dominate the interpretive context delivered to the LLM, distorting final generation. Existing defenses target anomaly detection at the node, edge, and triple level, leaving schema-level manipulation as a structural blind spot; As derived artifacts synthesised from multiple sources, they lack singular ground truth, rendering tampering verification intractable. To demonstrate this attack surface, we suggest the Hop-Decayed Influence , which targets the auxiliary extension structures Semantics, Structure, Scoring beyond instance level entities that GraphRAG pipelines uniquely employ for additional functions and efficient retrieval strategies. The attack is deployed after knowledge construction through offline indexing in the GraphRAG pipeline, but before online retrieval commences. The attack first identifies targets using type predicted queries, then applies the selected 3S attack method. To investigate these vulnerabilities, we address the following research questions: RQ1: Are Auxiliary Schema-Level Entities exploitable, and does HopDecayed Influence effectively compromise GraphRAG systems?, RQ2: How efficient and scalable is Hop-Decayed Influence compared to conventional poisoning approaches?, RQ3: Is Hop-Decayed Influence stealthy enough to evade existing GraphRAG defense mechanisms? Based on query types, we select attack targets through either scoring exploration, then manipulate the attack surfaces including semantics, structure, and scoring mechanisms. Our method achieved over 85% attack success rate across all configurations with minimal structural perturbation. Defense evasion rates exceeded 99% against existing detection mechanisms [12]. Our key contributions to the understanding and advancement of GraphRAG pipeline are: – We formalise Auxiliary Schema-Level Entity (semantic summaries, hierarchical edges, pre-computed scores) as a novel attack surface in GraphRAG pipelines.

4

J. Park et al.

– We propose Hop-Decayed Influence (HDI), a gray-box attack achieving high ASR with minimal structural perturbation and 1:N leverage. – We analyse defense limitations, revealing conventional instance-level defenses are insufficient for schema-level threats. The paper proceeds as follows: Section 2 covers background, Section 3 presents methodology, Section 4 details experimental setup, Section 5 reports results, and Section 6 discusses defenses before concluding.

2

Background

2.1

GraphRAG Pipeline

GraphRAG pipeline consists of two primary phases: offline indexing and online retrieval [26, 33]. Offline Indexing. Given a raw text document corpus D, the system performs text chunking to divide documents into overlapping segments that maintain semantic continuity. Each chunk is transformed into dense vector representations via embedding functions, enabling similarity based retrieval. Concurrently, a knowledge extraction process identifies entities E and relations R using LLMs or NLP tools, representing each fact as a triple (ei , rk , ej ). The extracted information is structured into a knowledge graph G = (V, E ′ ), where vertices include both entities and text chunks, and edges represent relationships between them. An auxiliary structure generation function faux : G → A creates pipeline specific schema-level information that distinguishes end to end GraphRAG from simple KG based retrieval. Online Retrieval. Given a query q, the system embeds it into the same vector space and performs similarity based search to extract relevant context. The retrieval granularity g ∈ {node, edge, path, subgraph} determines the structural form of retrieved knowledge. Retrieved elements undergo ranking through scoring functions to select the top-k most relevant components within context window constraints. Finally, the LLM generates answers by processing the selected context alongside the original query.

2.2

GraphRAG Attack Methods

Prior GraphRAG attacks operate at the instance level. GRAGPOISON targets relations by identifying shared relations across queries and injecting competing relations with temporal ordering [19]. Corpus-level attacks exploit GraphRAG’s dependency on source text: TKPA rewrites vulnerable text chunks to control specific query outputs, while UKPA perturbs coreference signals to fragment graph structure globally [29]. PoisonedRAG injects malicious texts optimised to maximise retrieval similarity while inducing adversarial answers [35].

HDI: Auxiliary Structure Poisoning in GraphRAG 1) Query entity extraction

2) Mapping in Knowledge Graph

Query What university did the person who proposed the Turing Test belong to?

…

3) Hop Decayed Influence: Target selection

5

4) Attack on 3S

Extractor

Entity Extracted

Auxiliary construction Allocating Influence by BFS search

Attack on 3S: Summary, Structure, Score

Fig. 2. The process of Hop-Decayed Influence .

3

Methodology

3.1

Threat model

Adversary’s Objectives. The adversary aims to degrade GraphRAG retrieval performance by corrupting auxiliary structures used for retrieval optimization. Given a set of target queries, the adversary seeks to inject minimal perturbations such that the system generates incorrect responses while bypassing existing defense mechanisms. Attack Surface: Auxiliary Schema-Level Entity. We introduce Auxiliary Schema-Level Entity as an attack surface in GraphRAG systems, defined as structural components constructed during offline indexing that exist beyond instance-level elements (nodes, edges, triples). These structures augment LLM context, optimise retrieval through precomputation, and guide graph navigation; we categorise them into Semantics, Structure, and Scoring (3S). Unlike prior attacks that alter graph content, our attack manipulates how the graph is traversed. Adversary’s Capabilities. The adversary can modify auxiliary structures in the constructed knowledge graph, operating post-indexing. Such capabilities arise in practical settings such as insider threats with database write access or compromised graph database interfaces. In practice, representative GraphRAG systems store auxiliary structures (e.g., summaries as plaintext Parquet files, scores in unprotected caches) without integrity verification separate from core graph data. However, write access alone is insufficient; identifying which minimal subset to corrupt for maximum cross-query impact is the core challenge. The adversary cannot access the original text corpus, cannot retrigger the indexing pipeline, and cannot control any parameters of the retriever or generator. Adversary’s Knowledge. We assume a gray-box setting where the adversary has access to a representative target query set, reflecting scenarios with partially predictable query patterns (e.g., enterprise knowledge bases with recurring analytical queries), and can query the knowledge graph through standard graph database interfaces.

6

3.2

J. Park et al.

Problem Formulation

A GraphRAG system constructs a knowledge graph from a text corpus, along with auxiliary structures for retrieval optimisation. These auxiliary structures include semantic summaries, hierarchical edges, and pre-computed scores. Given a query set Q, the attacker’s objective is to find minimal perturbations to auxiliary structures such that retrieval fails for the maximum number of queries, subject to budget constraint ϵ: X max ⊮ [R(q, A + ∆A) ∩ R(q, A) = ∅] (1) ∆A

q∈Q

where R(q, A) denotes the retrieved context for query q. 3.3

Target Selection: Hop-Decayed Influence

Effective target selection is essential for maximising attack impact under limited budget. We propose Hop-Decayed Influence (HDI), a query aware method that identifies high influence nodes. For each query q, we extract seed entities and map them to graph nodes. From each seed s, influence propagates with exponential decay based on shortest path distance d(s, v): X X Influence(v) = λd(s,v) (2) q∈Q s∈Seeds(q)

where λ ∈ (0, 1) is the decay factor. Nodes beyond hmax hops receive zero influence. Given budget k, we select the top-k nodes with highest cumulative influence as attack targets. 3.4

Attack Methods: 3S Framework

We propose the 3S attack framework targeting three categories of auxiliary structures. Semantic Attack. Corrupts textual summaries associated with target nodes by injecting adversarial text δ that introduces false entity associations while maintaining low perplexity to evade detection. Structure Attack. Injects misleading edges between target nodes and semantically distant nodes. For each target v ∗ , we add edges to nodes with similarity below threshold τ , i.e., E ′ = E ∪{(v ∗ , u) : sim(v ∗ , u) < τ }, creating false traversal paths. Score Attack. Manipulates pre-computed scores to disrupt ranking: for target set V ∗ = arg maxv∈V,|V ∗ |=k σ(v), scores are demoted via σ ′ (v ∗ ) = µ, while medianranked nodes Vmed are promoted via σ ′ (v) = σmax , causing retrievers to prioritise irrelevant nodes.

HDI: Auxiliary Structure Poisoning in GraphRAG

7

Algorithm 1: Hop Decayed Influence Target Selection Input: Query set Q, Knowledge graph G, Decay factor λ, Max hops hmax , Budget k Output: Target node set T Initialise: Influence[v] ← 0 for all v ∈ V; foreach query q ∈ Q do Seeds(q) ← ExtractEntities(q); foreach seed s ∈ Seeds(q) do sv ← MapToNode(s, G); if sv ̸= null then foreach node v ∈ V do d ← ShortestPath(sv , v, G); if d ≤ hmax then Influence[v] ← Influence[v] + λd ; T ← TopK(Influence, k); return T

3.5

Algorithm Overview

The attack proceeds in two phases. First, HDI computes influence scores by extracting seeds from each query and propagating influence with decay λ. The top-k nodes are selected as targets. Second, the selected attack method (Semantic, Structure, or Score) is applied to each target node. The choice depends on the target pipeline’s retrieval mechanism: semantic attacks are effective against embedding based systems, while structure attacks target graph traversal systems.

4

Experiment setup

Benchmark datasets & GraphRAG Baseline. To evaluate the effectiveness of Hop-Decayed Influence attacks and observe attack patterns in multi-hop graph RAG task, we employ two established benchmark datasets: HotpotQA [31] and 2WikiMultiHopQA [9] sourced from Wikipedia. Those datasets are sampled with 1,000 cases from each dataset due to computational budget constraints. We compare ’HDI’ against RAG systems: Microsoft GraphRAG [3] uses hierarchical community detection where high-level summaries aggregate subordinate entities. HippoRAG2 [5, 6] relies on Personalised PageRank (PPR) with pre-computed scores for retrieval prioritisation. Configuration setup. OpenAI’s ’text-embedding-3-small’ [23] and ’GPT-4o-mini’ [22] are employed. For KG construction we use networkx, tiktoken and datasets of huggingface. During graph construction, we apply standard quality control

8

J. Park et al.

including entity deduplication and relation normalisation to ensure consistent baseline conditions. For HDI target selection, we set decay factor λ = 0.5, maximum hop distance hmax = 4, random seed = 42 and manipulation intensity = 0.001%, 0.01%, 0.1%. Experiments were conducted on over 32GB of RAM. Metric. To evaluate attack performance, we propose new metrics: Schema Leverage Ratio (SLR) The expected number of queries affected per single auxiliary structure modification. SLR =

|Qaffected | |∆A|

(3)

where Qaffected is the set of queries with altered responses after attack, and ∆A is the set of modified auxiliary structures. Instance-level attacks achieve SLR ≈ 1 as each modification targets one query. Schema-level attacks exploit shared auxiliary structures across retrieval paths, enabling SLR ≫ 1. Higher SLR indicates greater architectural vulnerability to schema-level manipulation. We also employ standard metrics to evaluate attack effectiveness. Attack Success Rate (ASR) quantifies the proportion of queries where the adversarial attack successfully manipulates thePsystem’s response to match the adversarial N objective, computed as ASR = N1 i=1 1[attacki = success], where N denotes the total number of target queries [11, 27]. Specifically, an attack is considered successful when a query that was correctly answered before the attack produces an incorrect answer after the attack. F1 Score measures token-level overlap between predicted answer yi and ground truth yi∗ using the harmonic mean of |tokens(yi )∩tokens(yi∗ )| |tokens(yi )∩tokens(yi∗ )| precision Pi = and recall Ri = , aver|tokens(yi )| |tokens(yi∗ )| P N i ·Ri aged across all queries as F1 = N1 i=1 2·P Pi +Ri . Exact Match (EM) provides strict evaluation by measuring whether normalised predicted answers exactly P|Q| gold 1 match ground truth: EM = |Q| )], where norm(·) i=1 1[norm(ŷi ) = norm(yi applies lowercase conversion, whitespace removal, and punctuation handling [32]. Based on the stealthiness standard [25], PF and PD are measured.

5

Experimental Results

5.1

RQ1: Are Auxiliary Schema-Level Entities exploitable, and does Hop-Decayed Influence effectively compromise GraphRAG systems?

Table 1 shows attack effectiveness across configurations. Microsoft GraphRAG on HotpotQA achieves 91.69% ASR, while 2WikiMultiHopQA reaches 88.17%. HippoRAG2 shows similar vulnerability: 88.24% ASR on HotpotQA and 94.44% on 2WikiMultiHopQA, the highest across all configurations. The two systems differ in vulnerability patterns. Microsoft GraphRAG’s hierarchical community structure amplifies attack impact: corrupting one high-level summary affects all

HDI: Auxiliary Structure Poisoning in GraphRAG

9

Table 1. Performance Comparison Before and After Attack Across Different Models and Datasets MSGraphRAG

HippoRAG2

HotpotQA 2WikiMultiHopQA HotpotQA 2WikiMultiHopQA Best Config Our ASR (%) PoisonedRAG (%) Gragpoison (%)

HDI-T 91.69 80.69 85.64

HDI-T 88.17 80.42 88.68

HDI-T 88.24 81.49 86.28

HDI-C 94.44 85.89 87.24

Table 2. Attack Efficiency Comparison Across Different GraphRAG Models and Datasets. HDI-T: HDI with Structure attack; HDI-C: HDI with Score attack; HDI-S: HDI with Semantic attack. SLR = Schema Leverage Ratio (affected queries / modifications). Mod. Ratio(%) = # Modified / Total Structures × 100. MSGraphRAG

HippoRAG2

HotpotQA 2WikiMultiHopQA HotpotQA 2WikiMultiHopQA Best Config

HDI-T

HDI-T

HDI-T

HDI-C

Total Structures # Modified Mod. Ratio (%)

6,328 300 4.74

9,328 450 4.82

440,020 330 0.075

311,419 49 0.016

Our SLR PoisonedRag’s SLR

4.57 1.36

3.41 1.25

5.80 0.42

6.00 0.32

queries routed through that community. HippoRAG2’s Personalised PageRank distributes retrieval across multiple paths, offering some resilience. Still, ASR exceeds 86% in every configuration. Schema-level entities are exploitable regardless of architectural choices. 5.2

RQ2: How efficient and scalable is Hop-Decayed Influence compared to conventional poisoning approaches?

Table 2 quantifies attack footprint. HDI achieves high success rates with minimal modifications. HippoRAG2 on 2WikiMultiHopQA requires only 49 modified structures out of 311,419 (0.016%) of the total that yet reaches 94.44% ASR. On HotpotQA, 330 modifications (0.075%) produce 88.24% ASR. Microsoft GraphRAG has fewer total structures (6,328 on HotpotQA, 9,328 on 2WikiMultiHopQA), so modification ratios are higher (4.74% and 4.82%), but absolute counts remain low: 300–450 modifications. Schema Leverage Ratio (SLR) measures queries affected per modification. Our approach achieves SLR of 3.41–6.00, compared to PoisonedRAG’s 0.32–1.36. The gap is largest on HippoRAG2-2WikiMultiHopQA: our SLR (6.00) versus

10

J. Park et al.

Table 3. Defense Evasion Performance (RQ3): Perplexity Filter and Paraphrase Defense MSGraphRAG

HippoRAG2

HotpotQA 2WikiMultiHopQA HotpotQA 2WikiMultiHopQA Best Type

HDI-T

HDI-T

HDI-T

HDI-C

Perplexity Evasion (%) Paraphrase Evasion (%) Detection Rate (%)

99.85 99.13 0.07

99.50 99.14 0.09

99.87 99.72 0.05

99.79 99.27 0.08

PoisonedRAG’s (0.32). This 1:N leverage that one schema modification affecting many queries is unavailable to instance-level attacks. Attack type matters. We evaluate defense evasion using each configuration’s best performing attack type (Table 3). HippoRAG2 prefers Structure attacks on HotpotQA but Score attacks (C) on 2WikiMultiHopQA, reflecting PPR’s sensitivity to pre-computed rankings. 5.3

RQ3: Is Hop-Decayed Influence stealthy enough to evade existing GraphRAG defense mechanisms?

Table 3 evaluates HDI against perplexity filtering and paraphrase defense. Structure attacks (T) serve as the test configuration. Detection rates are negligible. Perplexity filtering misses 99.50% – 99.87% of modifications. Paraphrase defense fails similarly, with evasion rates of 99.13% – 99.72%. Across all configurations, detection stays below 0.1%. These defenses target instance-level anomalies: odd entity names, implausible triples, statistically unusual text. Schema-level manipulations evade them because corrupted summaries are still LLM generated and linguistically fluent. Injected edges connect semantically plausible entity pairs. Numerical scores bypass text based detection entirely. Auxiliary structures receive implicit trust. Auxiliary structures, being system generated artifacts, receive no runtime validation. Current defenses assume attacks manifest as anomalous content. Schema-level attacks produce normal looking content through abnormal selection and aggregation. This mismatch leaves GraphRAG systems exposed. 5.4

Ablation Study

Modification intensity Scaling Analysis. Figure 3 shows ASR scaling with the proportion of modified structures. Structure attacks (T) consistently outperform Semantic attacks (S) on MS GraphRAG, achieving 91.69% versus 48.52% ASR when modifying 0.1% of total structures on HotpotQA. The two systems exhibit distinct patterns: MS GraphRAG shows near-linear growth, while HippoRAG2

HDI: Auxiliary Structure Poisoning in GraphRAG MS GraphRAG

HippoRAG2

100

100

91.7 88.8

80

48.5 41.7

40

33.3 24.3 19.8 15.5 13.7

20

HotpotQA × T HotpotQA × S 2WikiMHQA × T 2WikiMHQA × S

0 0%

0.01%

Manipulation Ratio (%)

73.5 71.2

0.05%

0.1%

88.9 88.2 72.8

64.4

64.2

55.4

ASR (%)

ASR (%)

84.3 82.6

80 67.8

60

11

60

51.7

40

35.7 28.9

20

HotpotQA × T HotpotQA × S 2WikiMHQA × T 2WikiMHQA × S

0 0%

0.01%

Manipulation Ratio (%)

0.05%

0.1%

Fig. 3. ASR scaling with modification intensity across GraphRAG systems. Left: MS GraphRAG. Right: HippoRAG2. X-axis: proportion of modification intensity (%). Yaxis: Attack Success Rate (%). T: Structure attack. S: Semantic attack.

on 2WikiMultiHopQA demonstrates early saturation, reaching 71–73% ASR by modifying merely 0.01% of structures. This indicates that densely connected auxiliary structures enable high attack impact with minimal perturbation. Notably, on HippoRAG2-2WikiMultiHopQA, both attack methods converge to 88.89% ASR, though Semantic attacks achieve superior efficiency.

6

Discussion & Defense

Prior stealthiness research in adversarial RAG has focused on detecting statistical anomalies at the instance level perplexity filtering and paraphrase detection assuming adversarial content manifests as linguistic outliers [12, 25]. Schemalevel manipulations evade these defenses for two reasons: auxiliary structures are LLM generated and thus linguistically fluent by construction, and aggregated summaries lack singular ground truth against which tampering can be verified. We identify three potential defense directions. First, provenance tracking maintains lineage between schema entities and their source instances, enabling consistency audits. Second, runtime verification detects semantic drift between retrieved summaries and underlying nodes at query time. Third, robust aggregation applies outlier resistant functions to summarisation and scoring mechanisms. However, these defenses impose computational overhead that partially negates the efficiency gains schema-level structures were designed to provide, presenting an inherent trade-off between retrieval performance and adversarial robustness.

7

Ethical consideration

All experiments were conducted on public benchmark datasets and open source implementations in isolated environments. No attacks targeted production systems. We follow responsible disclosure practices, sharing findings with affected

12

J. Park et al.

project maintainers prior to publication. This research aims to improve GraphRAG security by enabling developers to understand and mitigate schema-level vulnerabilities.

8

Conclusion & Future work

This work identifies Auxiliary Schema-Level Entity as a distinct attack surface in GraphRAG pipelines and demonstrates through the 3S Framework and Hop-Decayed Influence attack that minimal perturbation yields high attack success rates with 1:N amplification unavailable to instance-level approaches. These findings expose that auxiliary structures receive implicit trust without runtime validation, rendering current defenses inadequate for schema-level threats. Future research will develop provenance-aware defense mechanisms that maintain lineage between schema-level entities and source instances, enabling consistency verification through cross referencing aggregated summaries against underlying nodes. We plan to investigate robust aggregation functions resistant to outlier manipulation and extend HDI to recently proposed GraphRAG pipeline with temporal and multi-modal retrieval capabilities. Additionally, developing standardised benchmark suites for evaluating schema-level attack resilience will enable systematic comparison of defense strategies across diverse GraphRAG implementations. Further evaluation should extend to other GraphRAG applications (e.g., summarisation, decision support) and out-of-distribution queries. Key limitations include: the post-indexing write access assumption may not hold in all deployments, defense evaluation is limited to text-level detection methods mismatched against score and structure tampering, and generalisation across backbone LLMs remains unverified.

References 1. Brown, T.B., Mann, B., Ryder, N., Subbiah, M., Kaplan, J., Dhariwal, P., Neelakantan, A., Pranav Shyam, e.a.: Language models are few-shot learners. In: Advances in Neural Information Processing Systems. vol. 33, pp. 1877–1901. Curran Associates, Inc. (2020) 2. Cheng, M., Luo, Y., Ouyang, J., Liu, Q., Liu, H., Li, L., Yu, S., Zhang, B., Cao, J., Ma, J., Wang, D., Chen, E.: A survey on knowledge-oriented retrieval-augmented generation (2025) 3. Edge, D., Trinh, H., Cheng, N., Bradley, J., Chao, A., Mody, A., Truitt, S., Metropolitansky, D., Ness, R.O., Larson, J.: From local to global: A graph rag approach to query-focused summarization (2025) 4. Gao, Y., Xiong, Y., Gao, X., Jia, K., Pan, J., Bi, Y., Dai, Y., Sun, J., Wang, M., Wang, H.: Retrieval-augmented generation for large language models: A survey (2024) 5. Gutiérrez, B.J., Shu, Y., Gu, Y., Yasunaga, M., Su, Y.: Hipporag: Neurobiologically inspired long-term memory for large language models (2025)

HDI: Auxiliary Structure Poisoning in GraphRAG

13

6. Gutiérrez, B.J., Shu, Y., Qi, W., Zhou, S., Su, Y.: From rag to memory: Nonparametric continual learning for large language models (2025) 7. Han, H., Wang, Y., Shomer, H., Guo, K., Ding, J., Lei, Y., Halappanavar, M., Rossi, R.A., Mukherjee, S., Tang, X., He, Q., Hua, Z., Long, B., Zhao, T., Shah, N., Javari, A., Xia, Y., Tang, J.: Retrieval-augmented generation with graphs (graphrag) (2025) 8. He, X., Tian, Y., Sun, Y., Chawla, N.V., Laurent, T., LeCun, Y., Bresson, X., Hooi, B.: G-Retriever: Retrieval-augmented generation for textual graph understanding and question answering. In: Advances in Neural Information Processing Systems (NeurIPS). vol. 37 (2024), https://openreview.net/forum?id=MPJ3oXtTZl 9. Ho, X., Duong Nguyen, A.K., Sugawara, S., Aizawa, A.: Constructing a multi-hop QA dataset for comprehensive evaluation of reasoning steps. In: Proceedings of the 28th International Conference on Computational Linguistics. pp. 6609–6625. International Committee on Computational Linguistics, Barcelona, Spain (Online) (2020). https://doi.org/10.18653/v1/2020.coling-main.580 10. Huang, L., Yu, W., Ma, W., Zhong, W., Feng, Z., Wang, H., Chen, Q., Peng, W., Feng, X., Qin, B., et al.: A survey on hallucination in large language models: Principles, taxonomy, challenges, and open questions. ACM Transactions on Information Systems 43(2), 1–55 (2025) 11. Huang, Y., Gupta, S., Xia, M., Li, K., Chen, D.: Catastrophic jailbreak of opensource llms via exploiting generation. In: International Conference on Learning Representations (2024) 12. Jain, N., Schwarzschild, A., Wen, Y., Somepalli, G., Kirchenbauer, J., yeh Chiang, P., Goldblum, M., Saha, A., Geiping, J., Goldstein, T.: Baseline defenses for adversarial attacks against aligned language models (2023) 13. Kalai, A.T., Nachum, O., Vempala, S.S., Zhang, E.: Why Language Models Hallucinate (sep 2025) 14. Kalutharage, C.S., Liu, X., Chrysoulas, C., Bamgboye, O.: Neurosymbolic learning in the XAI framework for enhanced cyberattack detection with expert knowledge integration. In: ICT Systems Security and Privacy Protection (IFIP SEC 2024). IFIP Advances in Information and Communication Technology, vol. 710, pp. 236– 249. Springer (2024). https://doi.org/10.1007/978-3-031-65175-5_17 15. Khodadad, M.: Domain-Specific Adaptation and Multi-Hop Reasoning in Chemistry and Biomedicine. MASc thesis, McMaster University, Hamilton, Ontario, Canada (2025), advisor: Hamidreza Mahyar 16. Klesel, M., Wittmann, H.F.: Retrieval-augmented generation (rag) m. klesel, hf wittmann. Business & Information Systems Engineering pp. 1–11 (2025) 17. Lewis, P., Perez, E., Piktus, A., Petroni, F., Karpukhin, V., at al.: Retrievalaugmented generation for knowledge-intensive nlp tasks. In: Advances in Neural Information Processing Systems. vol. 33, pp. 9459–9474. Curran Associates, Inc. (2020) 18. Li, M., Miao, S., Li, P.: Simple is effective: The roles of graphs and large language models in knowledge-graph-based retrieval-augmented generation (2025) 19. Liang, J., Wang, Y., Li, C., Zhu, R., Jiang, T., Gong, N., Wang, T.: GraphRAG under fire. In: 2026 IEEE Symposium on Security and Privacy (SP). pp. 1316–1333 (2026). https://doi.org/10.1109/SP63933.2026.00070 20. Liu, J., Zhang, J., Wang, S.: Exposing privacy risks in graph retrieval-augmented generation (2025) 21. Luo, H., Chen, G., Lin, Q., Guo, Y., Xu, F., Kuang, Z., Song, M., Wu, X., Zhu, Y., Tuan, L.A., et al.: Graph-r1: Towards agentic graphrag framework via end-to-end reinforcement learning (2025)

14

J. Park et al.

22. OpenAI, :, Hurst, A., Lerer, A., Goucher, A.P., Perelman, A., Ramesh, A., Clark, A., Ostrow, A., Welihinda, A., Hayes, A., Radford, A., Mądry, A., Alex BakerWhitcomb, e.a.: Gpt-4o system card (2024) 23. OpenAI: New embedding models and api updates. https://openai.com/index/ new-embedding-models-and-api-updates/ (2024) 24. Pan, S., Luo, L., Wang, Y., Chen, C., Wang, J., Wu, X.: Unifying large language models and knowledge graphs: A roadmap. IEEE Transactions on Knowledge and Data Engineering 36(7), 3580–3599 (Jul 2024). https://doi.org/10.1109/tkde. 2024.3352100, http://dx.doi.org/10.1109/TKDE.2024.3352100 25. Panebianco, F., D’Onghia, M., Zanero, S., Carminati, M.: How stealthy is stealthy? Studying the efficacy of black-box adversarial attacks in the real world. In: Nemec Zlatolas, L., Rannenberg, K., Welzer, T., Garcia-Alfaro, J. (eds.) ICT Systems Security and Privacy Protection. IFIP Advances in Information and Communication Technology, vol. 746, pp. 140–154. Springer, Cham (2025). https: //doi.org/10.1007/978-3-031-92886-4_10, 40th IFIP International Conference, SEC 2025 26. Peng, B., Zhu, Y., Liu, Y., Bo, X., Shi, H., Hong, C., Zhang, Y., Tang, S.: Graph retrieval-augmented generation: A survey (2024) 27. Rizqullah, M.R., Purwarianti, A., Aji, A.F.: Qasina: Religious domain question answering using sirah nabawiyah. In: 2023 10th International Conference on Advanced Informatics: Concept, Theory and Application (ICAICTA). pp. 1–6 (2023). https://doi.org/10.1109/ICAICTA59291.2023.10390123 28. Song, Y., Lyu, C., Zhang, P., Brunswicker, S., Dutt, N., Rahmani, A.: Dementiaplan: An agent-based framework for multi-knowledge graph retrieval-augmented generation in dementia care (2025) 29. Wen, J., Chen, T., Zheng, Z., Huang, C.: A few words can distort graphs: Knowledge poisoning attacks on graph-based retrieval-augmented generation of large language models (2025) 30. Wu, J., Zhu, J., Qi, Y., Chen, J., Xu, M., Menolascina, F., Jin, Y., Grau, V.: Medical graph RAG: Evidence-based medical large language model via graph retrievalaugmented generation. In: Che, W., Nabende, J., Shutova, E., Pilehvar, M.T. (eds.) Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). pp. 28443–28467. Association for Computational Linguistics, Vienna, Austria (Jul 2025). https://doi.org/10.18653/v1/ 2025.acl-long.1381, https://aclanthology.org/2025.acl-long.1381/ 31. Yang, Z., Qi, P., Zhang, S., Bengio, Y., Cohen, W.W., Salakhutdinov, R., Manning, C.D.: HotpotQA: A dataset for diverse, explainable multi-hop question answering. In: Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing. pp. 2369–2380. Association for Computational Linguistics, Brussels, Belgium (2018) 32. Yani, M., Krisnadhi, A.A.: Challenges, techniques, and trends of simple knowledge graph question answering: a survey. Information 12(7), 271 (2021) 33. Zhang, Q., Chen, S., Bei, Y., Yuan, Z., Zhou, H., Hong, Z., Chen, H., Xiao, Y., Zhou, C., Dong, J., Chang, Y., Huang, X.: A survey of graph retrieval-augmented generation for customized large language models (2025) 34. Zhao, T., Chen, J., Ru, Y., Zhu, H., Hu, N., Liu, J., Lin, Q.: Rag safety: Exploring knowledge poisoning attacks to retrieval-augmented generation (2025) 35. Zou, W., Geng, R., Wang, B., Jia, J.: PoisonedRAG: Knowledge corruption attacks to retrieval-augmented generation of large language models. In: 34th USENIX Security Symposium (USENIX Security 25). pp. 3827–3844 (2025)

Related documents

• Hop-Decayed Influence: New Vulnerabilities of Structural Auxiliary Indexing in GraphRAG Pipelines with LLM#1186687
• Reviewer Capability Governs Rejection Targeting, Not Repair Skill: Evidence from LLM Execute-Review-Revise Pipelines#660890
• Host-Aware Web Crawling for LLM Pretraining Data#1297673
• DMG: A Scalable and Efficient Memory-Disaggregated Graph Processing System#394373
• CVE-2026-104427 — HIGH 8.2#1175931