Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Subgraph Reconstruction Attacks on Graph RAG Deployments with Practical Defenses

Minkyoo Song, Jaehan Kim, Myungchul Kang, Hanna Kim, Seungwon Shin, Sooel Son

TL;DR

This work identifies three technical challenges for practical Graph RAG extraction under realistic safeguards and introduces GRASP, a closed-box, multi-turn subgraph reconstruction attack that attains the strongest type-faithful reconstruction where prior methods fail.

Abstract

Graph-based retrieval-augmented generation (Graph RAG) is increasingly deployed to support LLM applications by augmenting user queries with structured knowledge retrieved from a knowledge graph. While Graph RAG improves relational reasoning, it introduces a largely understudied threat: adversaries can reconstruct subgraphs from a target RAG system's knowledge graph, enabling privacy inference and replication of curated knowledge assets. We show that existing attacks are largely ineffective against Graph RAG even with simple prompt-based safeguards, because these attacks expose explicit exfiltration intent and are therefore easily suppressed by lightweight safe prompts. We identify three technical challenges for practical Graph RAG extraction under realistic safeguards and introduce GRASP, a closed-box, multi-turn subgraph reconstruction attack. GRASP (i) reframes extraction as a context-processing task, (ii) enforces format-compliant, instance-grounded outputs via per-record identifiers to reduce hallucinations and preserve relational details, and (iii) diversifies goal-driven attack queries using a momentum-aware scheduler to operate within strict query budgets. Across two real-world knowledge graphs, four safety-aligned LLMs, and multiple Graph RAG frameworks, GRASP attains the strongest type-faithful reconstruction where prior methods fail, reaching up to 82.9 F1. We further evaluate defenses and propose two lightweight mitigations that substantially reduce reconstruction fidelity without utility loss.

Subgraph Reconstruction Attacks on Graph RAG Deployments with Practical Defenses

TL;DR

This work identifies three technical challenges for practical Graph RAG extraction under realistic safeguards and introduces GRASP, a closed-box, multi-turn subgraph reconstruction attack that attains the strongest type-faithful reconstruction where prior methods fail.

Abstract

Graph-based retrieval-augmented generation (Graph RAG) is increasingly deployed to support LLM applications by augmenting user queries with structured knowledge retrieved from a knowledge graph. While Graph RAG improves relational reasoning, it introduces a largely understudied threat: adversaries can reconstruct subgraphs from a target RAG system's knowledge graph, enabling privacy inference and replication of curated knowledge assets. We show that existing attacks are largely ineffective against Graph RAG even with simple prompt-based safeguards, because these attacks expose explicit exfiltration intent and are therefore easily suppressed by lightweight safe prompts. We identify three technical challenges for practical Graph RAG extraction under realistic safeguards and introduce GRASP, a closed-box, multi-turn subgraph reconstruction attack. GRASP (i) reframes extraction as a context-processing task, (ii) enforces format-compliant, instance-grounded outputs via per-record identifiers to reduce hallucinations and preserve relational details, and (iii) diversifies goal-driven attack queries using a momentum-aware scheduler to operate within strict query budgets. Across two real-world knowledge graphs, four safety-aligned LLMs, and multiple Graph RAG frameworks, GRASP attains the strongest type-faithful reconstruction where prior methods fail, reaching up to 82.9 F1. We further evaluate defenses and propose two lightweight mitigations that substantially reduce reconstruction fidelity without utility loss.
Paper Structure (35 sections, 8 equations, 16 figures, 9 tables, 1 algorithm)

This paper contains 35 sections, 8 equations, 16 figures, 9 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Background
  3. Graph RAG
  4. Data Extraction against (Graph) RAG
  5. Problem Formulation
  6. Threat Model
  7. Subgraph Reconstruction
  8. Failure Analysis of Prior Attacks
  9. Setup
  10. Analysis
  11. GRASP Methodology
  12. Attack Query Structure
  13. Target Template
  14. Extraction Template
  15. Diversity Template
  16. ...and 20 more sections

Figures (16)

  • Figure 1: Safe system prompt of Microsoft GraphRAG edge2024local chat model, with added safety constraints highlighted in blue.
  • Figure 2: Closed-box subgraph reconstruction attack scenario against Graph RAG.
  • Figure 3: Prompts used for baseline attacks.
  • Figure 4: Naïve relation extraction recall of baseline attack prompts under original and safe system prompts.
  • Figure 5: Cumulative naïve recall of baseline attack prompts across iterative attempts under safe system prompts.
  • ...and 11 more figures