Elamur Research⌕
☰
home / papers / 2026 / Defense Against Knowledge Poisoning Attack on GraphRAG

Defense Against Knowledge Poisoning Attack on GraphRAG

Paper · 2026 · Havva Alizadeh Noughabi, Fattane Zarrinkalam and Ali Dehghantanha

Summary

GraphRAG systems build a knowledge graph from a text corpus. This opens a structural weakness: an attacker can plant adversarial text that adds false entities and relations to the graph, which then mislead the model on multi-hop questions. Existing defenses work at the query or passage level and do not handle this graph-level corruption. The authors propose HoG-GRAG, a defense module placed between the retriever and the generator.

HoG-GRAG works in two stages:

  • Detection: it splits each question into ordered subqueries and answers them one hop at a time with a lightweight LLM. A hop is flagged when it yields no candidate answer or more than one.
  • Repair: it rebuilds a compact subgraph by backtracking, trying stored alternative candidates, and pulling only the necessary evidence from the full knowledge graph.

Tests used poisoned subsets of HotpotQA and MuSiQue on Microsoft GraphRAG and LightRAG. HoG-GRAG flags most attacked questions, restores the correct answer in most of them, and removes most injected content. Accuracy on clean questions is barely affected. The work offers a practical, structure-aware safeguard for graph-based retrieval.

Key points

  • Data and setup: 300 poisoned questions per dataset (HotpotQA, MuSiQue), plus 300 benign questions each to measure over-triggering. Decompositions come from MuSiQue itself and from BREAK for HotpotQA. Poisoning sentences were generated with gpt-5-mini, following Liang et al. (2025).
  • Detection: TPR ranges from 70.67% to 82.67%. Most flags come from hop failure (70.71–83.96%) rather than hop ambiguity.
  • Repair:
    • Answer Match: 61.32–84.52%.
    • Repaired subgraphs are 19.38–36.65% of the original size.
    • Poison Removal Rate: 66.38–91.64.
  • Benign questions: FPR is 6.33–9.33% and Answer Match stays at 97.67–99%. A McNemar test (α = 0.01) found no significant drop.
  • Limitations: the method adds about 3.1–4.0 extra GPT-5-mini calls per query. It was evaluated only on 2-hop questions and assumes the query decomposition is accurate. Code is available at github.com/CyberScienceLab/HoG-GRAG.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓University of GuelphGuelph · Canada4 works · 266 citations

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 16,667 worksArtificial Intelligence · 16,194 worksArts and Humanities · 16,039 worksLanguage and Linguistics · 15,891 works

Cite

Cite as Havva Alizadeh Noughabi, Fattane Zarrinkalam and Ali Dehghantanha. 2026. Defense Against Knowledge Poisoning Attack on GraphRAG. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers).

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.acl-short.47

@inproceedings{noughabi2026defense,
  title = {{Defense Against Knowledge Poisoning Attack on GraphRAG}},
  author = {Havva Alizadeh Noughabi, Fattane Zarrinkalam and Ali Dehghantanha},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-short.47},
  url = {https://doi.org/10.18653/v1/2026.acl-short.47}
}

References

14 references, 5 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Havva Alizadeh Noughabi, Julien Serbanescu, Fattane Zarrinkalam, and Ali Dehghantanha. 2025. Uncovering the persuasive fingerprint of llms in jailbreaking attacks. In Proceedings of the 34th ACM International Conference on Information and Knowledge Management, pages 4608–4612. find
  2. Darren Edge, Ha Trinh, Newman Cheng, Joshua Bradley, Alex Chao, Apurva Mody, Steven Truitt, Dasha Metropolitansky, Robert Osazuwa Ness, and Jonathan Larson. 2024. From local to global: A graph rag approach to query-focused summarization. arXiv preprint arXiv:2404.16130. find
  3. Zirui Guo, Lianghao Xia, Yanhua Yu, Tu Ao, and Chao Huang. 2024. Lightrag: Simple and fast retrieval-augmented generation. arXiv preprint arXiv:2410.05779.
  4. Haoyu Han, Li Ma, Harry Shomer, Yu Wang, Yongjia Lei, Kai Guo, Zhigang Hua, Bo Long, Hui Liu, Charu C Aggarwal, and 1 others. 2025. Rag vs. graphrag: A systematic evaluation and key insights. arXiv preprint arXiv:2502.11371. — [arXiv:2502.11371](https://arxiv.org/abs/2502.11371) find
  5. Yutong Hu, Quzhe Huang, Mingxu Tao, Chen Zhang, and Yansong Feng. 2024. Can perplexity reflect large language model’s ability in long text understanding? In The Second Tiny Papers Track at ICLR 2024. find
  6. GenAI Usage Disclosure Neel Jain, Avi Schwarzschild, Yuxin Wen, Gowthami Somepalli, John Kirchenbauer, Ping-yeh Chiang, Micah Goldblum, Aniruddha Saha, Jonas Geiping, and Tom Goldstein. 2023. Baseline defenses for adversarial attacks against aligned language models. arXiv preprint arXiv:2309.00614.
  7. OpenAI’s ChatGPT was used to improve the clarity and grammar of sentences during the writing process. find
  8. Jiacheng Liang, Yuhui Wang, Changjiang Li, Rongyi Zhu, Tanqiu Jiang, Neil Gong, and Ting Wang. 2025. Graphrag under fire. arXiv preprint arXiv:2501.14050. \#\# Acknowledgments Boci Peng, Yun Zhu, Yongchao Liu, Xiaohe Bo, Haizhou Shi, Chuntao Hong, Yan Zhang, and Siliang Tang. 2024. Graph retrieval-aug…
  9. This work was supported in part by the NSERC-CSE Research Community Grants (ALLRP Ahmmad OM Saleh, Gokhan Tur, and Yucel Saygin. 2024. Sg-rag: Multi-hop question answering with large language models through knowledge graphs. In Proceedings of the 7th International Conference on Natural Language and… find
  10. Mohsen Sorkhpour, Abbas Yazdinejad, and Ali Dehghantanha. 2025. Redhit: Adaptive red-teaming of large language models via search, reasoning, and preference optimization. In Proceedings of the The First Workshop on LLM Security (LLMSEC), pages 7–16. find
  11. Harsh Trivedi, Niranjan Balasubramanian, Tushar Khot, and Ashish Sabharwal. 2022. ♪ musique: Multi-hop questions via single-hop question composition. Transactions of the Association for Computational Linguistics, 10:539–554. find
  12. Jiayi Wen, Tianxin Chen, Zhirun Zheng, and Cheng Huang. 2025. A few words can distort graphs: Knowledge poisoning attacks on graph-based retrieval-augmented generation of large language models. arXiv preprint arXiv:2508.04276. — [arXiv:2508.04276](https://arxiv.org/abs/2508.04276) find
  13. Tomer Wolfson, Mor Geva, Ankit Gupta, Matt Gardner, Yoav Goldberg, Daniel Deutch, and Jonathan Berant. 2020. Break it down: A question understanding benchmark. Transactions of the Association for Computational Linguistics, 8:183–198.
  14. Zhilin Yang, Peng Qi, Saizheng Zhang, Yoshua Bengio, William Cohen, Ruslan Salakhutdinov, and Christopher D Manning. 2018. Hotpotqa: A dataset for diverse, explainable multi-hop question answering. In Proceedings of the 2018 conference on empirical methods in natural language processing, pages 2369–…

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/noughabi-2026-defense-against-knowledge-poisoning-attack/