Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Making Theft Useless: Adulteration-Based Protection of Proprietary Knowledge Graphs in GraphRAG Systems

Weijie Wang, Peizhuo Lv, Yan Wang, Rujie Dai, Guokun Xu, Qiujian Lv, Hangcheng Liu, Weiqing Huang, Wei Dong, Jiaheng Zhang

TL;DR

AURA, a novel framework based on Data Adulteration designed to make any stolen KG unusable to an adversary, is proposed, which pre-emptively injects plausible but false adulterants into the KG.

Abstract

Graph Retrieval-Augmented Generation (GraphRAG) has emerged as a key technique for enhancing Large Language Models (LLMs) with proprietary Knowledge Graphs (KGs) in knowledge-intensive applications. As these KGs often represent an organization's highly valuable intellectual property (IP), they face a significant risk of theft for private use. In this scenario, attackers operate in isolated environments. This private-use threat renders passive defenses like watermarking ineffective, as they require output access for detection. Simultaneously, the low-latency demands of GraphRAG make strong encryption which incurs prohibitive overhead impractical. To address these challenges, we propose AURA, a novel framework based on Data Adulteration designed to make any stolen KG unusable to an adversary. Our framework pre-emptively injects plausible but false adulterants into the KG. For an attacker, these adulterants deteriorate the retrieved context and lead to factually incorrect responses. Conversely, for authorized users, a secret key enables the efficient filtering of all adulterants via encrypted metadata tags before they are passed to the LLM, ensuring query results remain completely accurate. Our evaluation demonstrates the effectiveness of this approach: AURA degrades the performance of unauthorized systems to an accuracy of just 5.3%, while maintaining 100% fidelity for authorized users with negligible overhead. Furthermore, AURA proves robust against various sanitization attempts, retaining 80.2% of its adulterants.

Making Theft Useless: Adulteration-Based Protection of Proprietary Knowledge Graphs in GraphRAG Systems

TL;DR

AURA, a novel framework based on Data Adulteration designed to make any stolen KG unusable to an adversary, is proposed, which pre-emptively injects plausible but false adulterants into the KG.

Abstract

Graph Retrieval-Augmented Generation (GraphRAG) has emerged as a key technique for enhancing Large Language Models (LLMs) with proprietary Knowledge Graphs (KGs) in knowledge-intensive applications. As these KGs often represent an organization's highly valuable intellectual property (IP), they face a significant risk of theft for private use. In this scenario, attackers operate in isolated environments. This private-use threat renders passive defenses like watermarking ineffective, as they require output access for detection. Simultaneously, the low-latency demands of GraphRAG make strong encryption which incurs prohibitive overhead impractical. To address these challenges, we propose AURA, a novel framework based on Data Adulteration designed to make any stolen KG unusable to an adversary. Our framework pre-emptively injects plausible but false adulterants into the KG. For an attacker, these adulterants deteriorate the retrieved context and lead to factually incorrect responses. Conversely, for authorized users, a secret key enables the efficient filtering of all adulterants via encrypted metadata tags before they are passed to the LLM, ensuring query results remain completely accurate. Our evaluation demonstrates the effectiveness of this approach: AURA degrades the performance of unauthorized systems to an accuracy of just 5.3%, while maintaining 100% fidelity for authorized users with negligible overhead. Furthermore, AURA proves robust against various sanitization attempts, retaining 80.2% of its adulterants.
Paper Structure (59 sections, 16 equations, 8 figures, 10 tables, 2 algorithms)

This paper contains 59 sections, 16 equations, 8 figures, 10 tables, 2 algorithms.

Table of Contents

  1. Introduction
  2. Background
  3. Graph Retrieval-Augmented Generation
  4. Link Prediction Model
  5. Problem Statement
  6. An Motivating Example
  7. Threat Model
  8. Attacker's Target
  9. Attacker's Capabilities
  10. Independent System Deployment
  11. Knowledge Sanitization Attempts
  12. Lack of Secret Key
  13. The Philosophy of Our Approach
  14. Defending Requirements
  15. Approach
  16. ...and 44 more sections

Figures (8)

  • Figure 1: By stealing the Knowledge Graph of a GraphRAG system, the adversary can almost completely replicate the original system's functionality in a private environment avoiding costly investments.
  • Figure 2: By adulterating the KG, we create an information asymmetry. The authorized user can filter the adulterants to get the correct answer, while the unauthorized user's LLM is misled by the adulterated context.
  • Figure 3: Overview of the AURA
  • Figure 4: Percentage of adulterants retained after different sanitization methods.
  • Figure 5: Impact of Link Prediction Models
  • ...and 3 more figures