Graph retrieval-augmented generation (GraphRAG) uses document-derived knowledge graphs to assemble evidence for large language model (LLM) answers.
Its security depends on both the seed chunks retrieved for a query and the graph evidence assembled from them, yet attacks on this evidence path remain underexplored.
GraphRAG-LTM
We introduce GraphRAG-LTM, a Layered Threat Modeling framework that tests three nested levels of attacker access.
Query Techniques
BB Query uses ranking feedback to make query edits under a semantic-similarity constraint and demote relevant seed chunks.
WB Query uses retriever gradients for the same objective.
Graph-aware WB
Graph-aware WB keeps the white-box adversarial query and deletes bridge triplets from the query-specific evidence graph, disrupting multi-hop evidence propagation through localized graph edits.
Experiments
Across datasets, retrievers, and LLM backbones, rank feedback alone reduces answer quality, gradient access strengthens query attacks, and bridge-triplet deletion further impairs supporting-fact retrieval.
Further Analyses
Further analyses show how seed retrieval and graph evidence jointly contribute to these failures.