arXiv cs.CL· Yining Tang, Junyu Zhang, Haomiao Qiu, Yongchao Liu, Jiajun Zheng, Zhao Wang, Ziyue Qiao, Chao Wu·· 3 天前AI 评分22
GraphRAG-LTM：针对 GraphRAG 攻击的分层威胁建模框架
GraphRAG-LTM: A Layered Threat Modeling Framework for Attacks on Graph Retrieval-Augmented Generation
AI 导读
研究者提出 GraphRAG-LTM 分层威胁建模框架，测试三种嵌套层级的攻击者访问权限：BB Query 利用排序反馈在语义相似度约束下改写查询、降低相关种子块排名，WB Query 使用检索器梯度实现同一目标，Graph-aware WB 则在此基础上删除查询特定证据图中的桥接三元组，破坏多跳证据传播。
正文 · 原文
Abstract:Graph retrieval-augmented generation (GraphRAG) uses document-derived knowledge graphs to assemble evidence for large language model (LLM) answers. Its security depends on both the seed chunks retrieved for a query and the graph evidence assembled from them, yet attacks on this evidence path remain underexplored. We introduce GraphRAG-LTM, a Layered Threat Modeling framework that tests three nested levels of attacker access. BB Query uses ranking feedback to make query edits under a semantic-similarity constraint and demote relevant seed chunks. WB Query uses retriever gradients for the same objective. Graph-aware WB keeps the white-box adversarial query and deletes bridge triplets from the query-specific evidence graph, disrupting multi-hop evidence propagation through localized graph edits. Across datasets, retrievers, and LLM backbones, rank feedback alone reduces answer quality, gradient access strengthens query attacks, and bridge-triplet deletion further impairs supporting-fact retrieval. Further analyses show how seed retrieval and graph evidence jointly contribute to these failures.
| Comments: | 14 pages, 7 figures |
| Subjects: | Computation and Language (cs.CL) |
| Cite as: | arXiv:2610.19549 [cs.CL] |
| (or arXiv:2610.19549v1 [cs.CL] for this version) | |
| https://doi.org/10.48550/arXiv.2610.19549 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Yining Tang [view email]
[v1]
Wed, 14 Oct 2026 04:04:34 UTC (1,919 KB)
来源：arXiv cs.CL · arxiv.org