← Back to Library

LogicPoison: Logical Attacks on Graph Retrieval-Augmented Generation

Authors: Yilin Xiao, Jin Chen, Qinggang Zhang, Yujing Zhang, Chuang Zhou, Longhao Yang, Lingfei Ren, Xin Yang, Xiao Huang

Published: 2026-04-03

arXiv ID: 2604.02954v1

Added to Library: 2026-04-06 02:04 UTC

Red Teaming

📄 Abstract

Graph-based Retrieval-Augmented Generation (GraphRAG) enhances the reasoning capabilities of Large Language Models (LLMs) by grounding their responses in structured knowledge graphs. Leveraging community detection and relation filtering techniques, GraphRAG systems demonstrate inherent resistance to traditional RAG attacks, such as text poisoning and prompt injection. However, in this paper, we find that the security of GraphRAG systems fundamentally relies on the topological integrity of the underlying graph, which can be undermined by implicitly corrupting the logical connections, without altering surface-level text semantics. To exploit this vulnerability, we propose \textsc{LogicPoison}, a novel attack framework that targets logical reasoning rather than injecting false contents. Specifically, \textsc{LogicPoison} employs a type-preserving entity swapping mechanism to perturb both global logic hubs for disrupting overall graph connectivity and query-specific reasoning bridges for severing essential multi-hop inference paths. This approach effectively reroutes valid reasoning into dead ends while maintaining surface-level textual plausibility. Comprehensive experiments across multiple benchmarks demonstrate that \textsc{LogicPoison} successfully bypasses GraphRAG's defenses, significantly degrading performance and outperforming state-of-the-art baselines in both effectiveness and stealth. Our code is available at \textcolor{blue}https://github.com/Jord8061/logicPoison.

🔍 Key Points

  • Introduction of LogicPoison, a novel attack framework specifically targeting the logical integrity of GraphRAG systems.
  • The framework utilizes type-preserving entity swapping to disrupt global connectivity and reasoning paths without altering surface-level semantics.
  • Comprehensive experiments show that LogicPoison outperforms existing attack methods in efficiency and stealth, significantly degrading the performance of various GraphRAG architectures.
  • Identification of a critical vulnerability in GraphRAG systems, shifting attack strategies from content injection to logic corruption.
  • Proposition of potential defensive measures against LogicPoison, highlighting the importance of understanding and fortifying the topological integrity of knowledge graphs.

💡 Why This Paper Matters

The LogicPoison framework reveals a significant vulnerability in GraphRAG systems by demonstrating that logical structure can be exploited to undermine the reasoning capabilities of models. This work contributes to advancing the understanding of security in AI systems that leverage structured knowledge and offers insights into both the weaknesses of current defenses and the pathways toward developing more robust models.

🎯 Why It's Interesting for AI Security Researchers

This paper is highly relevant for AI security researchers as it uncovers new attack vectors that target the foundational logical structures of Graph Retrieval-Augmented Generation systems. By shifting the focus from traditional content-based poisoning attacks to logical corruption, researchers can explore novel defense mechanisms and enhance the resilience of AI systems against sophisticated adversarial strategies.

📚 Read the Full Paper