攻击者用少次查询就能偷走GraphRAG的隐藏知识图谱
Query-Efficient Agentic Graph Extraction Attacks on GraphRAG Systems
- 用智能体策略+外部记忆，分两阶段高效发现图结构
- 在有限查询下恢复90%实体与关系，精度高
- 揭示GraphRAG系统在真实场景下的安全漏洞
基于图的检索增强生成（GraphRAG）系统通过文档集合构建知识图谱以支持多跳推理。尽管已有研究指出GraphRAG响应可能泄露检索子图，但在实际查询预算下，对隐藏图结构进行高效重构的可行性仍未知。本文研究了受限黑盒场景中，攻击者通过自适应查询窃取系统内隐的实体-关系图。提出AGEA（Agentic Graph Extraction Attack）框架，采用新颖性引导的探索-利用策略、外部图记忆模块，以及结合轻量发现与LLM过滤的两阶段提取流程。在医疗、农业和文学数据集上，对Microsoft-GraphRAG和LightRAG系统进行评估。相同查询预算下，AGEA显著优于现有攻击基线，最高可恢复90%的实体与关系，同时保持高精确度。结果表明，即使在严格查询限制下，现代GraphRAG系统也极易受到结构化智能体攻击。代码已开源：https://github.com/shuashua0608/AGEA。
原文摘要 · Abstract (English)
Graph-based retrieval-augmented generation (GraphRAG) systems construct knowledge graphs over document collections to support multi-hop reasoning. While prior work shows that GraphRAG responses may leak retrieved subgraphs, the feasibility of query-efficient reconstruction of the hidden graph structure remains unexplored under realistic query budgets. We study a budget-constrained black-box setting where an adversary adaptively queries the system to steal its latent entity-relation graph. We propose AGEA (Agentic Graph Extraction Attack), a framework that leverages a novelty-guided exploration-exploitation strategy, external graph memory modules, and a two-stage graph extraction pipeline combining lightweight discovery with LLM-based filtering. We evaluate AGEA on medical, agriculture, and literary datasets across Microsoft-GraphRAG and LightRAG systems. Under identical query budgets, AGEA significantly outperforms prior attack baselines, recovering up to 90% of entities and relationships while maintaining high precision. These results demonstrate that modern GraphRAG systems are highly vulnerable to structured, agentic extraction attacks, even under strict query limits. The code is available at https://github.com/shuashua0608/AGEA.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。