PaperlayerView exact revision on arXiv

Source-linked AI summary

Hop-Decayed Influence: New Vulnerabilities of Structural Auxiliary Indexing in GraphRAG Pipelines with LLM

Jisung Park, John Le, Heath Cooper

arXiv:2610.02373v1cs.CRcs.AI

TL;DR

GraphRAG auxiliary schema-level structures are a distinct attack surface because they support retrieval and receive implicit trust. The paper proposes the 3S Framework and HDI to target them, reporting over 85% attack success across configurations and over 99% defense evasion.

  • Problem

    The paper asks whether auxiliary schema-level entities are exploitable and whether HDI compromises GraphRAG; these structures support sense-making and multi-hop reasoning while shaping retrieval paths.

    Source: §1 · p. 3

  • Method

    The 3S Framework covers semantics, structure, and scoring, while HDI selects top-k targets by cumulative hop-decayed influence.

    Source: §1 · p. 3, §3.3 · p. 6

  • Results

    Over 85% attack success rate across all configurations with minimal structural perturbation, and defense evasion rates exceeded 99% against existing detection mechanisms.

    Source: §1 · p. 3

  • Takeaways & Limitations

    Minimal perturbation yields 1:N amplification unavailable to instance-level approaches.

    Source: §8 · p. 12

    The post-indexing write-access assumption may not hold in all deployments.

    Source: §3.1 · p. 5, §8 · p. 12

Abstract

from arXiv · show

GraphRAG pipelines construct auxiliary structures during offline indexing--semantic summaries, hierarchical edges, and pre-computed scores--that determine how retrieval is prioritised at query time. Prior attacks target only instance-level components (nodes, edges, triples), overlooking these schema-level structures. We formalise Auxiliary Schema-Level Entity as a novel attack surface and propose the 3S Framework (Semantics, Structure, Scoring) for its systematic exploitation. Our Hop-Decayed Influence (HDI) attack identifies high-impact targets through query-aware influence propagation and corrupts their auxiliary structures post-indexing. Across two benchmarks (HotpotQA, 2WikiMultiHopQA) and two architectures (Microsoft GraphRAG, HippoRAG2), HDI achieves 88-94% attack success rate while modifying as few as 0.016% of auxiliary structures. Each modification affects up to 6.00 queries (Schema Leverage Ratio), demonstrating 1:N amplification unavailable to instance-level attacks. Manipulated structures evade perplexity and paraphrase defenses with over 99% evasion rate, as they remain linguistically coherent system-generated artifacts. These results reveal that auxiliary schema-level entities receive implicit trust without runtime validation, constituting a structural blind spot in current GraphRAG defenses. https://github.com/Jisung-Pacific/HDI-GraphRAG-Attack.

1 Introduction

Prior GraphRAG attacks target graph instances or source corpora, leaving offline auxiliary structures that shape retrieval outside that view. This paper formalizes those structures as an attack surface and presents HDI to target them after indexing.

1 Introduction

  • Prior attacks target nodes, edges, triples, or source corpora, while auxiliary structures in the retrieval control plane determine retrieval paths, prioritization, and interpretation.These offline-generated structures extend beyond the core graph and support functions such as sense-making and multi-hop reasoning.Source: §1 · pp. 2–3
  • Auxiliary Schema-Level Entities comprise Semantics (summaries), Structure (hierarchical edges), and Scoring (pre-computed metrics), and can provide 1:N leverage while receiving implicit trust without runtime validation.A manipulated aggregation point can affect numerous subordinate entities and queries; derived artifacts also lack a singular ground truth for verification.Source: §1 · p. 3
  • HDI selects targets based on query types and manipulates auxiliary structures after offline indexing but before online retrieval.The selected attack surfaces are Semantics, Structure, and Scoring.Source: §1 · p. 3
  • More than 85% attack success rate across all configurations, with defense evasion rates exceeding 99% against existing detection mechanisms.The attacks use minimal structural perturbation.Source: §1 · p. 3

2 Background

GraphRAG combines offline indexing, which builds a graph and auxiliary structures, with online retrieval and answer generation. Earlier GraphRAG attacks target graph instances or source text.

2.1 GraphRAG Pipeline

  • The GraphRAG pipeline builds a knowledge graph and auxiliary structures during offline indexing, then retrieves, ranks, and supplies context for answer generation online.Retrieval embeds the query, selects a granularity, and ranks elements to choose top-k context.Source: §2.1 · p. 4

2.2 GraphRAG Attack Methods

  • Prior attacks manipulate graph relations or source text, including relation injection, chunk rewriting, coreference perturbation, and similarity-optimized malicious text.The cited examples are GRAGPOISON, TKPA and UKPA, and PoisonedRAG.Source: §2.2 · p. 4

3 Methodology

The methodology models post-indexing manipulation of auxiliary schema-level structures and develops query-aware target selection followed by attacks on semantic, structural, or scoring components.

3.1 Threat model

  • The attacker has post-indexing write access to auxiliary structures and a representative query set, but cannot access the corpus, rerun indexing, or control retrieval or generation.The threat model includes database insiders or compromised graph interfaces and assumes a gray-box setting with partially predictable queries.Source: §3.1 · p. 5

3.2 Problem Formulation

  • The objective is to perturb auxiliary structures minimally so retrieval fails for as many target queries as possible, subject to a budget constraint.R(q, A) denotes the retrieved context for query q.Source: §3.2 · p. 6

3.3 Target Selection: Hop-Decayed Influence

  • HDI extracts query seed entities, propagates their influence across graph nodes with hop-based decay, and selects the top-k nodes under the attack budget.Nodes beyond hmax hops receive zero influence; λ is the decay factor.Source: §3.3 · p. 6

3.4 Attack Methods: 3S Framework

  • The 3S Framework targets summaries with false associations, adds misleading edges to semantically distant nodes, or alters precomputed scores to disrupt retrieval ranking.The score attack demotes selected high-scoring nodes and promotes median-ranked nodes.Source: §3.4 · p. 6

3.5 Algorithm Overview

  • The algorithm selects targets using query-aware influence and applies a semantic, structure, or score attack according to the target pipeline’s retrieval mechanism.Semantic attacks suit embedding-based systems, while structure attacks target graph traversal systems.Source: §3.5 · p. 7, §3.4 · p. 7

4 Experiment setup

The experiments use sampled multi-hop QA benchmarks and two GraphRAG architectures, with attack performance assessed using attack-specific and standard answer-quality metrics.

Benchmark datasets & GraphRAG Baseline

  • 1,000 cases from each of HotpotQA and 2WikiMultiHopQA were used to compare HDI on Microsoft GraphRAG and HippoRAG2.Microsoft GraphRAG uses hierarchical community detection and summaries; HippoRAG2 uses Personalised PageRank with precomputed retrieval scores.Source: §4 · p. 7

Configuration setup

  • λ = 0.5, hmax = 4, and manipulation intensities of 0.001%, 0.01%, and 0.1% were used for target selection and perturbation.The experiments used a random seed of 42.Source: §4 · p. 8

Metric

  • Schema Leverage Ratio measures the expected queries affected per auxiliary-structure modification; instance-level attacks have SLR ≈1, while schema-level attacks can have SLR ≫1.A higher SLR indicates greater architectural vulnerability to schema-level manipulation.Source: Schema Leverage Ratio (SLR) · p. 8
  • Attack Success Rate measures successful manipulation of previously correct answers, while F1 and Exact Match assess answer overlap and normalized exact agreement.F1 uses token-level precision and recall; Exact Match applies lowercase conversion, whitespace removal, and punctuation handling.Source: Schema Leverage Ratio (SLR) · p. 8

5 Experimental Results

Across Microsoft GraphRAG and HippoRAG2, HDI achieves high attack success across both benchmarks with few modifications. Its results also show strong defense evasion and differing attack-intensity patterns across systems.

5.1 RQ1: Are Auxiliary Schema-Level Entities exploitable, and does Hop-Decayed Influence effectively compromise GraphRAG systems?

  • 91.69% ASR on HotpotQA and 88.17% on 2WikiMultiHopQA for Microsoft GraphRAG; HippoRAG2 reaches 88.24% and 94.44%, respectively.HippoRAG2’s Personalised PageRank offers some resilience, but ASR exceeds 86% in every configuration; schema-level entities are exploitable across both architectures.Source: §5.1 · pp. 8–9, Table 1 · p. 9

5.2 RQ2: How efficient and scalable is Hop-Decayed Influence compared to conventional poisoning approaches?

  • 49 modifications (0.016%) yield 94.44% ASR on HippoRAG2-2WikiMultiHopQA, while HDI’s SLR is 3.41–6.00 versus PoisonedRAG’s 0.32–1.36.Microsoft GraphRAG requires higher modification ratios (4.74% and 4.82%), although absolute modification counts remain 300–450; one schema modification can affect multiple queries.Source: Table 2 · p. 9, §5.2 · pp. 9–10

5.3 RQ3: Is Hop-Decayed Influence stealthy enough to evade existing GraphRAG defense mechanisms?

  • Perplexity filtering misses 99.50%–99.87% of modifications, and paraphrase defense evasion is 99.13%–99.72%.Detection stays below 0.1%; corrupted summaries remain linguistically fluent, injected edges connect plausible entity pairs, and numerical scores bypass text-based detection.Source: Table 3 · p. 10, §5.3 · p. 10

5.4 Ablation Study

  • At 0.1% modification intensity on HotpotQA, structure attacks achieve 91.69% ASR versus 48.52% for semantic attacks on MS GraphRAG.MS GraphRAG shows near-linear growth, while HippoRAG2 on 2WikiMultiHopQA reaches 71–73% ASR at 0.01% modification; both attacks later reach 88.89% there, with semantic attacks more efficient.Source: §5.4 · pp. 10–11, Figure 3 · p. 11

6 Discussion & Defense

The discussion explains why schema-level manipulations evade text-focused defenses and outlines provenance, runtime verification, and robust aggregation as possible defenses, with computational overhead as a trade-off.

Prior defenses

  • Schema-level manipulations evade anomaly detection because generated structures are fluent and aggregated summaries lack singular ground truth for tampering checks.Prior stealthiness research targets statistical anomalies such as perplexity and paraphrase signals.Source: §6 · p. 11

Defense directions

  • Proposed defenses include provenance tracking, runtime checks for semantic drift, and outlier-resistant aggregation for summaries and scores.These approaches are presented as potential defense directions.Source: §6 · p. 11

Trade-off

  • The proposed defenses impose computational overhead that partially offsets the efficiency gains of schema-level structures.The discussion frames this as a trade-off between retrieval performance and adversarial robustness.Source: §6 · p. 11

7 Ethical consideration

The experiments used public benchmarks and open-source implementations in isolated environments; the authors report no production-system attacks and describe responsible disclosure.

Experimental setting

  • All experiments used public benchmark datasets and open-source implementations in isolated environments.The passage specifies an experimental setting rather than production deployment.Source: §7 · p. 11

Deployment scope

  • The authors state that no attacks targeted production systems.Source: §7 · p. 11

Disclosure and aim

  • The authors shared findings with affected project maintainers before publication and state that the research aims to help developers understand and mitigate schema-level vulnerabilities.Source: §7 · pp. 11–12

8 Conclusion & Future work

The conclusion identifies auxiliary schema-level entities as a distinct GraphRAG attack surface and reports that minimal perturbations can achieve high success with 1:N amplification. It calls for further defenses and evaluation while noting limits in access assumptions, defense coverage, and backbone generalization.

Conclusion

  • HDI and the 3S Framework demonstrate high attack success from minimal perturbations, with 1:N amplification unavailable to instance-level approaches.The conclusion also states that auxiliary structures receive implicit trust without runtime validation, leaving current defenses inadequate for schema-level threats.Source: §8 · p. 12

Future work

  • Future work includes provenance-aware defenses, robust aggregation, extending HDI to temporal and multimodal retrieval, and standardized resilience benchmarks.Source: §8 · p. 12

Limitations

  • The post-indexing write-access assumption may not hold in every deployment; defense evaluation is limited to text-level detection, and generalization across backbone LLMs remains unverified.Further evaluation should include other GraphRAG applications and out-of-distribution queries.Source: §8 · p. 12

Related papers

Loading 2610.02373v1…