RAG Safety: Exploring Knowledge Poisoning Attacks to Retrieval-Augmented Generation

Haiping Zhu; Jiaoyan Chen; Jun Liu; Nan Hu; Qika Lin; Tianzhe Zhao; Yanchi Ru

REVIEW 3 major objections 5 minor 44 references

RAG Safety: Exploring Knowledge Poisoning Attacks to Retrieval-Augmented Generation

T0 review · 3 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Injecting 20 triples cuts a KG-RAG system's exact match by 81%.

desk verdict A genuinely new attack surface for KG-RAG poisoning, with clean empirical evidence, but the strongest results are confounded by the attacker using the same planner the targets rely on. read the letter →

arxiv 2507.08862 v1 pith:IQBN54D5 submitted 2025-07-09 cs.CR cs.CL

Tianzhe Zhao , Jiaoyan Chen , Yanchi Ru , Haiping Zhu , Nan Hu , Jun Liu , Qika Lin This is my paper

classification cs.CRcs.CL

keywords retrieval-augmentedgenerationknowledgegraphdatapoisoninglargelanguagemodelrobustnessquestionansweringadversarialattackKG-RAG

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that knowledge-graph-based retrieval-augmented generation (KG-RAG) systems are practically vulnerable to a cheap, insertion-only form of data poisoning. It proposes an attack that, knowing only the user's question and having edit access to the graph, injects a handful of triples built from entities and relations that already exist in the graph. Those triples complete misleading inference chains that lead the retriever to surface an attacker-chosen wrong answer, and the language model often goes along. On two question-answering benchmarks and four KG-RAG methods, the attack consistently degrades accuracy; for one method, exact-match accuracy falls from 45.76% to 8.85% with at most 20 injected triples per question. If the results hold, even small, stealthy edits to user-editable knowledge graphs are a realistic threat to RAG systems that rely on structured knowledge.

What carries the argument

The relation path is the load-bearing object: a sequence of relations such as (filmPlace, locatedIn, stateOf) that abstracts away intermediate entities and acts as a reusable reasoning template. The attacker obtains these templates from LLM_RoG, a KG-specific language model trained to generate relation paths grounded in Freebase, then grounds the prefix of each path in the existing graph starting from the question's topic entity. The final hop is attached to an adversarial target answer, and if the prefix cannot be grounded, random existing bridge entities fill the gap. What carries the argument is that the inserted triples look like ordinary facts and compose into exactly the paths the target retriever is built to find.

What would settle it

Re-run the attack against each KG-RAG method with relation-path templates produced by a general-purpose LLM instead of LLM_RoG, or by a KG-specific model trained on a different graph; if the exact-match drops on WebQSP fall to near the random-modification baseline, then the reported 81% drop depends on the attacker's privileged access to the target's own reasoning model rather than on an inherent graph vulnerability.

Watch

Extended reading notes

Core claim

The central discovery is that KG-RAG's vulnerability concentrates in the retrieval stage: injected triples are retrieved for over 90% of attacked questions, and once an adversarial answer reaches the final prediction it tends to dominate it. The attack works by first prompting a general-purpose LLM to produce plausible but wrong answers, aligning them to entities already in the graph, then using a KG-specific language model to generate relation paths that match how the target answers such questions. The attacker grounds the prefix of each path from the question's topic entity and attaches an adversarial answer as the final hop, inserting only triples whose entities and relations already exist. This completes a believable chain, for example linking a movie to England so that the system answers 'United Kingdom' instead of 'United States.' The paper also reports that LLMs with stronger KG reasoning are more easily misled, while a two-stage design that delegates final answer selection to a general-purpose LLM is more resistant.

Load-bearing premise

The broad effectiveness claim assumes the attacker has access to a relation-path generator that thinks about the target knowledge graph much the way the victim system does, and the paper never varies this component in its experiments.

Editorial extensions

If this is right

Deploying a KG-RAG system over an openly editable graph inherits a poisoning risk that insertion-only, existing-entity edits are enough to trigger.
Defenses that only screen for new entities or new relations will miss this attack, since all injected triples reuse existing vocabulary.
Strengthening the retriever to filter or distrust low-support triples matters more than hardening the generator, because adversarial triples already reach the prompt in over 90% of attacked questions.
Models fine-tuned on KG reasoning may be more susceptible; mixing a KG-specific planner with a general-purpose final answer selector is a more robust architecture direction.
Injecting more than four triples per adversarial answer yields diminishing returns, so attack scale alone is not a reliable detection signal.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

An implication the paper leaves implicit: because the relation-path templates come from LLM_RoG, a model trained on the same Freebase subgraphs and benchmarks as RoG and GCR, at least part of the measured attack success may reflect the attacker using the target's own reasoning model, and systems built on a different path generator remain untested.
The paper's stealth constraints suggest a defense it does not study: checking whether a retrieved path's completion is supported by independent facts in the graph could flag adversarial completions without blocking legitimate edits.
Extending the attack from per-question poisoning to reusable relation-path templates could turn a one-time editing cost into an ongoing corpus-level threat, since the same misleading chains would be retrieved by any future question that grounds on them.
The polarization result suggests a testable design: adversarially tuning the generator to prefer parametric knowledge over retrieved triples when they conflict should lower the rate at which adversarial answers are generated.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

This is the first systematic study of data poisoning against KG-based RAG, and on that ground alone it earns a serious look. The attack idea is intuitive and well executed: generate plausible wrong answers, mine relation path templates, then insert a handful of triples that complete misleading chains from the topic entity to the wrong answer. The main experiments deliver large, consistent degradation across four KG-RAG methods and two benchmarks—RoG’s EM on WebQSP drops from 45.76% to 8.85%, and the stage-wise analysis showing where those poisoned triples actually get retrieved and adopted is genuinely useful. The LLM-robustness sweep in Section 4.8 is also a nice addition.

The soft spot is real and it is the load-bearing one. The relation path templates come from LLM_RoG, the same public KG-specific model that RoG uses internally as its planner and that GCR was built from. The attack is strongest precisely against those two methods (RoG, GCR) and much weaker against the two subgraph methods (G-retriever, SubgraphRAG). The paper never varies the template source, so the claimed broad effectiveness is not yet separated from target-model alignment. This is not a fatal flaw—the vulnerability may still hold for a genuinely black-box attacker—but the evidence as presented cannot support the broad conclusion. The authors need an ablation over path-generation sources, including a generic LLM and a KG-specific model trained on a different graph, and ideally a test against a KG-RAG method that uses a substantially different planner.

Other issues are minor but worth naming: no variance or significance tests, a weak random baseline that replaces entities in existing triples (which can create nonsense that the retriever may reasonably ignore), no code or data release, and G-retriever absent on CWQ for practical reasons. The extracted text also had rendering artifacts, which made a few equations harder to check but did not block reading.

Who is this for: RAG security researchers and KG-RAG practitioners. The paper deserves peer review—it opens a previously unexamined attack surface and gives concrete evidence that insertion-only poisoning can hurt—but my own verdict is conditional. I would require the ablation, error bars, and artifact release before accepting. As it stands, I would read and cite it with the confound noted.

Referee Report

3 major / 5 minor

Summary. The paper investigates data poisoning attacks against knowledge-graph-based RAG (KG-RAG). It formalizes an insertion-only, black-box threat model, and proposes an attack that (i) uses GPT-4 to generate plausible-but-incorrect answer candidates, (ii) uses the public KG-specific LLM_RoG to generate relation-path templates, and (iii) grounds those templates to insert triples that connect the question entity to adversarial answers. The attack is evaluated on WebQSP and CWQ against four KG-RAG methods (RoG, GCR, G-retriever, SubgraphRAG), reporting large QA degradation (e.g., RoG EM drops from 45.76% to 8.85% on WebQSP) and high attack-oriented metrics, along with stage-wise analyses showing that retrieval is the main vulnerability and that more KG-capable LLMs are more sensitive. The paper concludes that KG-RAG systems are practically vulnerable to minimal perturbations.

Significance. If the empirical claims hold, this is the first systematic demonstration that structured KG sources expose RAG systems to a distinct and practical poisoning surface, and the stage-wise decomposition is a useful contribution to understanding where defenses should focus. The threat model is realistic (triples use existing entities/relations; no deletion), and the evaluation spans two benchmarks and four methods. The paper is honest about the open problem of LLM answer-selection. However, the breadth of the claim is currently limited by the attack's reliance on LLM_RoG, the same model family used internally by two of the targets, and by the absence of statistical significance testing; these gaps prevent the paper from fully supporting the 'broad effectiveness' conclusion.

major comments (3)

[Sections 3.2, 4.3, Table 3] The relation-path templates in the attack are generated by LLM_RoG, the same KG-specific model that serves as the planning module of the two path-retrieval targets (RoG and GCR). The attack thus uses a component of the target system to build the poison, which is only partially consistent with the black-box threat model in Section 2.3.2. The cross-method asymmetry in Table 3 (RoG F1 -46%, EM -81%; GCR F1 -10%, EM -22%; G-retriever F1 -12%, EM -19%; SubgraphRAG F1 -25%, EM -46%) and A-Precision in Table 4 (RoG 49.66% vs 13.52-27.02% for the other methods) suggests that the attack's success may be inflated precisely for targets whose internal reasoning is aligned with the template source. The paper never varies the template source. To support the broad claim, add an ablation that replaces LLM_RoG with a general-purpose LLM prompted for relation paths and with a relation-path source independent of the targets, and report the resulting QA and adversarial metrics on at least RoG and one subgraph method.
[Section 4.3, Tables 3-5] The random baseline is not a valid insertion-only control and is likely weak by construction: it "construct[s] corrupted variants by randomly replacing the other entity" in triples involving the question entity, which is a modification rather than an insertion, and it produces implausible triples that a generator can easily ignore. In addition, no variance or significance information is provided for any result, despite the stochastic components in the attack (GPT-4 sampling of adversarial answers, random fallback bridges in Section 3.3). Please report means and standard deviations over multiple seeds or bootstrap confidence intervals, and significance tests for the key metrics (F1, EM, A-Precision), or explicitly argue that the reported magnitudes are stable.
[Section 3.2, Eqs. (4)-(6) and Section 2.3.2] The relation-path generator is trained to maximize the likelihood of shortest relation paths between topic and gold answer entities on the target benchmarks. Even though the attacker does not query ground-truth answers at attack time, the generator's training signal encodes the gold-answer path distribution of the evaluation data. This leaks benchmark-specific information into the attack and is not disclosed in the threat model. Please clarify whether LLM_RoG is used as-is (public checkpoint) or further trained, and discuss the effect of this leakage; a test with a path generator trained on a disjoint KG or without gold-path supervision would bound the threat.

minor comments (5)

[Section 2.2.2] The method list reads "RoG [11], RCR [24], G-retriever [34], SubgraphRAG [35]" but the described method is GCR; please correct the acronym (RCR -> GCR) and ensure the reference [24] matches GCR.
[Section 4.2, Eqs. (8)-(10)] The definitions of A-Precision, A-H@1, and A-MRR assume a non-empty predicted answer set; please specify the convention when the predicted set is empty (e.g., treat as 0) to make the metrics reproducible.
[Section 4.3] The random baseline is said to "insert 20 corrupted triples per question" after being defined as replacing entities; please clarify whether the baseline performs insertion or modification, and ensure it obeys the insertion-only constraint.
[Section 6] The final sentence ends with "which needs further explora."; please complete the sentence ("exploration").
[Figures 5 and 6] Figures 5 and 6 contain garbled characters in the rendered PDF (e.g., "/uni0000..."); please regenerate the figures so the captions and labels are readable.

Circularity Check

1 steps flagged · score 4.0 of 10

Attack templates are generated by LLM_RoG, the same KG-specific planner used by the RoG target; the headline RoG result is partly self-referential, though the attack also works on non-RoG methods.

self definitional [Section 3.2 (Relation Path Extraction), Section 4.3 (Implementation Details), Tables 3-4]
"To instantiate the generation of relation paths, we adopt LLMRoG, a publicly available KG-specific language model based on LLaMA-2-7B-hf [41]. As mentioned in Section 3.2, it fits well with our needs."

LLM_RoG is the very KG-specific model that the RoG target uses for its planning module (Section 2.2.2: 'RoG applies an instruction-tuning strategy to integrate KG knowledge into the LLM, developing a KG-specific LLM used for both relation path generation and reasoning'). The attack inserts triples that complete groundings of relation paths drawn from this same model. RoG's retriever grounds the relation paths produced by the same model, so the poisoned triples are placed exactly where RoG is predisposed to look. The headline result (RoG WebQSP EM -81%) is therefore not an independent black-box measure; it shows that an attacker equipped with RoG's own planner can disrupt RoG.

full rationale

The derivation chain is not formally circular: the attack inserts real triples and is evaluated end-to-end, and the paper discloses its use of LLM_RoG. The circular element is confined to the evaluation of the headline RoG result. The attack's relation-path templates are produced by the same KG-specific model that RoG uses internally for planning, so the 81% EM drop for RoG is partly a self-consistency result rather than a fully black-box finding. The paper also states in Section 2.3.2 that the attacker has 'No Access to KG-RAG Internal Modules, including the retriever, the language model', yet later permits the use of 'the LLM employed internally by the target KG-RAG method' to build the attack; this tension further weakens the black-box framing, though it is an explicit design choice rather than a hidden circularity. Importantly, the attack also degrades G-retriever and SubgraphRAG (WebQSP EM -19% and -46%), which do not use LLM_RoG, so the central claim that KG-RAG systems are vulnerable to insertion-only poisoning has independent support beyond the self-referential RoG case. Because the strongest result is partly forced by construction while the overall conclusion retains independent evidence, a moderate score is appropriate.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The paper introduces no new entity types or theoretical constructs. Its central empirical claim rests on the availability of a KG-specific relation path generator (LLM_RoG), the assumption that the attacker knows the target query, and the assumption that inserted triples are not detected by the retriever. The only hand-chosen numbers are N=5 and K=4.

free parameters (2)

N (number of adversarial answers per question) = 5
Chosen by the authors as the number of false answers generated per question. It affects how many potential attack targets exist and sets the total perturbation budget N x K = 20 per question. It is not optimized or fitted to the reported metrics.
K (perturbation budget per adversarial answer) = 4
Set to 4 in the main experiments, capping injected triples at 20 per question. The paper analyzes larger K in Section 4.7 and reports diminishing returns, but the main claim of effectiveness under minimal perturbations depends on this hand-chosen budget rather than a fitted optimum.

assumptions (4)

domain assumption LLM_RoG generates relation paths that are faithful, KG-consistent, and semantically relevant to the target questions.
The attack builds all perturbation chains on relation paths output by this public model (Section 3.2). The success of the attack depends on these paths being plausible templates for the target retrievers and generators; the paper does not verify this assumption for other path generators.
domain assumption The attacker knows the target question and can insert question-specific triples into the KG before the query is processed.
Stated in Section 2.3: the attacker knows the question but not the ground-truth answer. The evaluation injects triples into each question's preprocessed subgraph, which assumes the injected triples are present in the graph at retrieval time.
domain assumption Injected triples composed of existing entities and relations are retrievable by the target retrievers and are not filtered out a priori.
The whole attack relies on this. The authors measure retrieval coverage (A-RR) empirically, which supports it for the tested methods, but it is not guaranteed for other KG-RAG systems.
domain assumption The benchmark subgraphs (WebQSP and CWQ, Freebase-based) represent the operational context of real KG-RAG systems.
All experiments are run on preprocessed per-question subgraphs rather than on a live full KG with a real retrieval index; the paper does not investigate whether results carry over to full-graph retrieval settings.

how reviews work

0 comments

Cite this review

Pith. "Pith review of RAG Safety: Exploring Knowledge Poisoning Attacks to Retrieval-Augmented Generation." pith.science (2026). https://pith.science/paper/IQBN54D5

@misc{pith2026250708862,
  author       = {Pith},
  title        = {Pith review of: RAG Safety: Exploring Knowledge Poisoning Attacks to Retrieval-Augmented Generation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/IQBN54D5}},
  note         = {Machine review of arXiv:2507.08862}
}

read the original abstract

Retrieval-Augmented Generation (RAG) enhances large language models (LLMs) by retrieving external data to mitigate hallucinations and outdated knowledge issues. Benefiting from the strong ability in facilitating diverse data sources and supporting faithful reasoning, knowledge graphs (KGs) have been increasingly adopted in RAG systems, giving rise to KG-based RAG (KG-RAG) methods. Though RAG systems are widely applied in various applications, recent studies have also revealed its vulnerabilities to data poisoning attacks, where malicious information injected into external knowledge sources can mislead the system into producing incorrect or harmful responses. However, these studies focus exclusively on RAG systems using unstructured textual data sources, leaving the security risks of KG-RAG largely unexplored, despite the fact that KGs present unique vulnerabilities due to their structured and editable nature. In this work, we conduct the first systematic investigation of the security issue of KG-RAG methods through data poisoning attacks. To this end, we introduce a practical, stealthy attack setting that aligns with real-world implementation. We propose an attack strategy that first identifies adversarial target answers and then inserts perturbation triples to complete misleading inference chains in the KG, increasing the likelihood that KG-RAG methods retrieve and rely on these perturbations during generation. Through extensive experiments on two benchmarks and four recent KG-RAG methods, our attack strategy demonstrates strong effectiveness in degrading KG-RAG performance, even with minimal KG perturbations. In-depth analyses are also conducted to understand the safety threats within the internal stages of KG-RAG systems and to explore the robustness of LLMs against adversarial knowledge.

Figures

Figures reproduced from arXiv: 2507.08862 by the authors.

**Figure 1.** Illustration of KG-RAG pipelines before and after data poisoning attack. unstructured text such as Wikipedia pages [18] or web documents [21], leaving the security risks of KG-RAG systems largely unexplored. Although the integration of KGs can enable faithful reasoning through explicit inference chains [11, 24], KGRAG systems are also exposed to unique vulnerabilities. In practice, many widely-used KGs, such as Wi… view at source ↗

**Figure 2.** The overall framework of our proposed data poisoning attack against KG-RAG. 3. Attack Method In this section, we detail our data poisoning attack strategy, which inserts perturbation triples into the KG to steer KG-RAG methods toward generating incorrect answers. The overall framework is illustrated in [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗

**Figure 3.** Prompt template for generating adversarial answers. ground-truth answers in advance and further enforce such type consistency through explicit supervision. To this end, we design a prompting strategy that guides an LLM to produce incorrect but semantically plausible answers, as illustrated in [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗

Figures from the paper (3 more)

**Figure 4.** Figure 4: Prompt template for relation paths. where || denotes the number of questions in the test set, 𝑖 is the predicted answer set for the 𝑖-th question, and ̂ 𝑖 denotes the adversarial target answers assigned to the 𝑖-th question during our attack strategy. ∙ Attack-orien…

**Figure 5.** Figure 5: Attack impact on different stages of KG-RAG systems. stem from its generation mechanism, where the retrieved subgraph is encoded into embeddings and concatenated as a prefix to the input text embeddings of the LLM, and then the final decoded predictions are obtained. T…

**Figure 6.** Figure 6: Attack Effectiveness across increasing poisoning scales [PITH_FULL_IMAGE:figures/full_fig_p010_6.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

44 extracted references · 27 canonical work pages

[1]

Y.Gao,Y.Xiong,X.Gao,K.Jia,J.Pan,Y.Bi,Y.Dai,J.Sun,H.Wang, H.Wang,Retrieval-augmentedgenerationforlargelanguagemodels: A survey, arXiv preprint arXiv:2312.10997 2 (1) (2023)

arXiv 2023
[2]

W. Fan, Y. Ding, L. Ning, S. Wang, H. Li, D. Yin, T.-S. Chua, Q. Li, A survey on rag meeting llms: Towards retrieval-augmented large language models, in: Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, 2024, pp. 6491–6501

work page 2024
[3]

Lewis, E

P. Lewis, E. Perez, A. Piktus, F. Petroni, V. Karpukhin, N. Goyal, H. Küttler, M. Lewis, W.-t. Yih, T. Rocktäschel, et al., Retrieval- augmented generation for knowledge-intensive nlp tasks, Advances in neural information processing systems 33 (2020) 9459–9474

2020
[4]

Siriwardhana, R

S. Siriwardhana, R. Weerasekera, E. Wen, T. Kaluarachchi, R. Rana, S. Nanayakkara, Improving the domain adaptation of retrieval aug- mentedgeneration(rag)modelsforopendomainquestionanswering, Transactions of the Association for Computational Linguistics 11 (2023) 1–17

work page 2023
[5]

Toney-Wails, R

A. Toney-Wails, R. Wails, C. Smith, Expertly informed, genera- tively summarized: A hybrid RAG approach to informed consent summarization with auxiliary expert knowledge, in: Proceedings of the 4th International Workshop on Knowledge-Augmented Methods for Natural Language Processing, Association for Computational Linguistics, Albuquerque, New Mexico, USA,...

work page doi:10.18653/v1/2025.knowledgenlp-1.23 2025
[6]

B. Peng, Y. Zhu, Y. Liu, X. Bo, H. Shi, C. Hong, Y. Zhang, S. Tang, Graph retrieval-augmented generation: A survey, arXiv preprint arXiv:2408.08921 (2024)

arXiv 2024
[7]

N. F. Liu, K. Lin, J. Hewitt, A. Paranjape, M. Bevilacqua, F. Petroni, P.Liang,Lostinthemiddle:Howlanguagemodelsuselongcontexts, Transactions of the Association for Computational Linguistics 12 (2024) 157–173. doi:10.1162/tacl_a_00638. URL https://aclanthology.org/2024.tacl-1.9/

doi:10.1162/tacl_a_00638 2024
[8]

H. Han, Y. Wang, H. Shomer, K. Guo, J. Ding, Y. Lei, M. Ha- lappanavar, R. A. Rossi, S. Mukherjee, X. Tang, et al., Retrieval- augmented generation with graphs (graphrag), arXiv preprint arXiv:2501.00309 (2024)

arXiv 2024

Show all 44 references

[9]

D.Vrandečić,M.Krötzsch,Wikidata:afreecollaborativeknowledge- base, Communications of the ACM 57 (10) (2014) 78–85

2014
[10]

K.Donnelly,etal.,Snomed-ct:Theadvancedterminologyandcoding system for ehealth, Studies in health technology and informatics 121 (2006) 279

2006
[11]

LUO, Y.-F

L. LUO, Y.-F. Li, G. Haffari, S. Pan, Reasoning on graphs: Faithful and interpretable large language model reasoning, in: The Twelfth International Conference on Learning Representations, 2024. URL https://openreview.net/forum?id=ZGNWW7xZ6Q

2024
[12]

Y.Wu,Y.Huang,N.Hu,Y.Hua,G.Qi,J.Chen,J.Pan,Cotkr:Chain- of-thought enhanced knowledge rewriting for complex knowledge graphquestionanswering,in:Proceedingsofthe2024Conferenceon EmpiricalMethodsinNaturalLanguageProcessing,2024,pp.3501– 3520

2024
[13]

S. Ji, S. Pan, E. Cambria, P. Marttinen, S. Y. Philip, A survey on knowledge graphs: Representation, acquisition, and applications, IEEE transactions on neural networks and learning systems 33 (2) (2021) 494–514

2021
[14]

19206–19214

Y.Wang,N.Lipka,R.A.Rossi,A.Siu,R.Zhang,T.Derr,Knowledge graphpromptingformulti-documentquestionanswering,in:Proceed- ingsoftheAAAIConferenceonArtificialIntelligence,Vol.38,2024, : Preprint submitted to Elsevier Page 12 of 13 pp. 19206–19214

2024
[15]

Metropolitansky, R

D.Edge,H.Trinh,N.Cheng,J.Bradley,A.Chao,A.Mody,S.Truitt, D. Metropolitansky, R. O. Ness, J. Larson, From local to global: A graph rag approach to query-focused summarization, arXiv preprint arXiv:2404.16130 (2024)

2024 arXiv
[16]

Y. Feng, C. Li, V. Ng, Legal judgment prediction: A survey of the state of the art, in: L. D. Raedt (Ed.), Proceedings of the Thirty-First International Joint Conference on Artificial Intelligence, IJCAI-22, International Joint Conferences on Artificial Intelligence Organiza- ...

2022 doi
[17]

X. Wu, J. Duan, Y. Pan, M. Li, Medical knowledge graph: Data sources, construction, reasoning, and applications, Big Data Mining and Analytics 6 (2) (2023) 201–217

2023
[18]

W.Zou,R.Geng,B.Wang,J.Jia,Poisonedrag:Knowledgecorruption attacks to retrieval-augmented generation of large language models, arXiv preprint arXiv:2402.07867 (2024)

2024 arXiv
[19]

Nazary, Y

F. Nazary, Y. Deldjoo, T. d. Noia, Poison-rag: Adversarial data poisoningattacksonretrieval-augmentedgenerationinrecommender systems,in:EuropeanConferenceonInformationRetrieval,Springer, 2025, pp. 239–251

2025
[20]

H.Zhou,K.-H.Lee,Z.Zhan,Y.Chen,Z.Li,Trustrag:Enhancingro- bustnessandtrustworthinessinrag,arXivpreprintarXiv:2501.00879 (2025)

2025 arXiv
[21]

Z. Tan, C. Zhao, R. Moraffah, Y. Li, S. Wang, J. Li, T. Chen, H. Liu, Glue pizza and eat rocks - exploiting vulnerabilities in retrieval-augmented generative models, in: Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, Association for Com...

2024 doi
[22]

J. Fan, Q. Yan, M. Li, G. Qu, Y. Xiao, A survey on data poisoning attacks and defenses, in: 2022 7th IEEE International Conference on Data Science in Cyberspace (DSC), IEEE, 2022, pp. 48–55

2022
[23]

Z. Wang, J. Ma, X. Wang, J. Hu, Z. Qin, K. Ren, Threats to training: A survey of poisoning attacks and defenses on machine learning systems, ACM Computing Surveys 55 (7) (2022) 1–36

2022
[24]

L. Luo, Z. Zhao, G. Haffari, Y.-F. Li, C. Gong, S. Pan, Graph- constrained reasoning: Faithful reasoning on knowledge graphs with large language models, arXiv preprint arXiv:2410.13080 (2024)

2024 arXiv
[25]

X. You, B. Sheng, D. Ding, M. Zhang, X. Pan, M. Yang, F. Feng, Mass: Model-agnostic, semantic and stealthy data poisoning attack on knowledge graph embedding, in: Proceedings of the ACM Web Conference 2023, 2023, pp. 2000–2010

2023
[26]

T. Zhao, J. Chen, Y. Ru, Q. Lin, Y. Geng, J. Liu, Untargeted ad- versarial attack on knowledge graph embeddings, in: Proceedings of the 47th International ACM SIGIR Conference on Research and Development in Information Retrieval, SIGIR ’24, Association for Computing Machinery,...

2024
[27]

Bratus, A

S. Bratus, A. Rumshisky, A. Khrabrov, R. Magar, P. Thompson, Domain-specificentityextractionfromnoisy,unstructureddatausing ontology-guidedsearch,InternationalJournalonDocumentAnalysis and Recognition (IJDAR) 14 (2011) 201–211

2011
[28]

W. Shen, J. Wang, J. Han, Entity linking with a knowledge base: Issues, techniques, and solutions, IEEE Transactions on Knowledge and Data Engineering 27 (2) (2014) 443–460

2014
[29]

Zhang, T

H. Zhang, T. Zheng, J. Gao, C. Miao, L. Su, Y. Li, K. Ren, Data poisoning attack against knowledge graph embedding, in: Proceed- ingsoftheTwenty-EighthInternationalJointConferenceonArtificial Intelligence, IJCAI-19, International Joint Conferences on Artificial IntelligenceOrg...

2019 doi
[30]

Bhardwaj, J

P. Bhardwaj, J. Kelleher, L. Costabello, D. O’Sullivan, Poisoning knowledge graph embeddings via relation inference patterns, in: Proceedingsofthe59thAnnualMeetingoftheAssociationforCom- putational Linguistics and the 11th International Joint Conference on Natural Language Pro...

2021 doi
[31]

Sun, Z.-H

Z. Sun, Z.-H. Deng, J.-Y. Nie, J. Tang, Rotate: Knowledge graph embedding by relational rotation in complex space, in: International Conference on Learning Representations, 2019. URL https://openreview.net/forum?id=HkgEQnRqYQ

2019
[32]

Cheng, N

K. Cheng, N. Ahmed, Y. Sun, Neural compositional rule learning for knowledge graph reasoning, in: The Eleventh International Confer- ence on Learning Representations, 2023. URL https://openreview.net/forum?id=F8VKQyDgRVj

2023
[33]

Y. Wu, Y. Huang, N. Hu, Y. Hua, G. Qi, J. Chen, J. Z. Pan, CoTKR: Chain-of-thought enhanced knowledge rewriting for complex knowl- edge graph question answering, in: Proceedings of the 2024 Confer- enceonEmpiricalMethodsinNaturalLanguageProcessing,Associ- ation for Computation...

2024 doi
[34]

Hooi, G-retriever: Retrieval-augmented generation for tex- tual graph understanding and question answering, in: A

X.He,Y.Tian,Y.Sun,N.V.Chawla,T.Laurent,Y.LeCun,X.Bres- son, B. Hooi, G-retriever: Retrieval-augmented generation for tex- tual graph understanding and question answering, in: A. Globerson, L. Mackey, D. Belgrave, A. Fan, U. Paquet, J. Tomczak, C. Zhang (Eds.),AdvancesinNeuralI...

2024
[35]

URL https://openreview.net/forum?id=JvkuZZ04O7

M.Li,S.Miao,P.Li,Simpleiseffective:Therolesofgraphsandlarge languagemodelsinknowledge-graph-basedretrieval-augmentedgen- eration, in: The Thirteenth International Conference on Learning Representations, 2025. URL https://openreview.net/forum?id=JvkuZZ04O7

2025
[36]

Reimers, I

N. Reimers, I. Gurevych, Sentence-bert: Sentence embeddings using siamese bert-networks, arXiv preprint arXiv:1908.10084 (2019)

2019 arXiv
[37]

W.-t. Yih, M. Richardson, C. Meek, M.-W. Chang, J. Suh, The value of semantic parse labeling for knowledge base question answering, in: Proceedings of the 54th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers), 2016, pp. 201– 206

2016
[38]

Talmor, J

A. Talmor, J. Berant, The web as a knowledge-base for answering complex questions, in: Proceedings of the 2018 Conference of the North American Chapter of the Association for Computational Lin- guistics: Human Language Technologies, Volume 1 (Long Papers), 2018, pp. 641–651

2018
[39]

G. He, Y. Lan, J. Jiang, W. X. Zhao, J.-R. Wen, Improving multi- hop knowledge base question answering by learning intermediate supervision signals, in: Proceedings of the 14th ACM international conference on web search and data mining, 2021, pp. 553–561

2021
[40]

Almeida, J

J.Achiam,S.Adler,S.Agarwal,L.Ahmad,I.Akkaya,F.L.Aleman, D. Almeida, J. Altenschmidt, S. Altman, S. Anadkat, et al., Gpt-4 technical report, arXiv preprint arXiv:2303.08774 (2023)

2023 arXiv
[41]

Touvron, L

H. Touvron, L. Martin, K. Stone, P. Albert, A. Almahairi, Y. Babaei, N. Bashlykov, S. Batra, P. Bhargava, S. Bhosale, et al., Llama 2: Open foundation and fine-tuned chat models, arXiv preprint arXiv:2307.09288 (2023)

2023 arXiv
[42]

B. Ni, Z. Liu, L. Wang, Y. Lei, Y. Zhao, X. Cheng, Q. Zeng, L. Dong, Y. Xia, K. Kenthapadi, et al., Towards trustworthy retrieval augmented generation for large language models: A survey, arXiv preprint arXiv:2502.06872 (2025)

2025 arXiv
[43]

J.Xue,M.Zheng,Y.Hu,F.Liu,X.Chen,Q.Lou,Badrag:Identifying vulnerabilities in retrieval augmented generation of large language models, arXiv preprint arXiv:2406.00083 (2024)

2024 arXiv
[44]

Banerjee, L

P. Banerjee, L. Chu, Y. Zhang, L. V. Lakshmanan, L. Wang, Stealthy targeted data poisoning attack on knowledge graphs, in: 2021 IEEE 37th International Conference on Data Engineering (ICDE), IEEE, 2021, pp. 2069–2074. : Preprint submitted to Elsevier Page 13 of 13

2021

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.

[1] [1]

Y.Gao,Y.Xiong,X.Gao,K.Jia,J.Pan,Y.Bi,Y.Dai,J.Sun,H.Wang, H.Wang,Retrieval-augmentedgenerationforlargelanguagemodels: A survey, arXiv preprint arXiv:2312.10997 2 (1) (2023)

arXiv 2023

[2] [2]

W. Fan, Y. Ding, L. Ning, S. Wang, H. Li, D. Yin, T.-S. Chua, Q. Li, A survey on rag meeting llms: Towards retrieval-augmented large language models, in: Proceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, 2024, pp. 6491–6501

work page 2024

[3] [3]

Lewis, E

P. Lewis, E. Perez, A. Piktus, F. Petroni, V. Karpukhin, N. Goyal, H. Küttler, M. Lewis, W.-t. Yih, T. Rocktäschel, et al., Retrieval- augmented generation for knowledge-intensive nlp tasks, Advances in neural information processing systems 33 (2020) 9459–9474

2020

[4] [4]

Siriwardhana, R

S. Siriwardhana, R. Weerasekera, E. Wen, T. Kaluarachchi, R. Rana, S. Nanayakkara, Improving the domain adaptation of retrieval aug- mentedgeneration(rag)modelsforopendomainquestionanswering, Transactions of the Association for Computational Linguistics 11 (2023) 1–17

work page 2023

[5] [5]

Toney-Wails, R

A. Toney-Wails, R. Wails, C. Smith, Expertly informed, genera- tively summarized: A hybrid RAG approach to informed consent summarization with auxiliary expert knowledge, in: Proceedings of the 4th International Workshop on Knowledge-Augmented Methods for Natural Language Processing, Association for Computational Linguistics, Albuquerque, New Mexico, USA,...

work page doi:10.18653/v1/2025.knowledgenlp-1.23 2025

[6] [6]

B. Peng, Y. Zhu, Y. Liu, X. Bo, H. Shi, C. Hong, Y. Zhang, S. Tang, Graph retrieval-augmented generation: A survey, arXiv preprint arXiv:2408.08921 (2024)

arXiv 2024

[7] [7]

N. F. Liu, K. Lin, J. Hewitt, A. Paranjape, M. Bevilacqua, F. Petroni, P.Liang,Lostinthemiddle:Howlanguagemodelsuselongcontexts, Transactions of the Association for Computational Linguistics 12 (2024) 157–173. doi:10.1162/tacl_a_00638. URL https://aclanthology.org/2024.tacl-1.9/

doi:10.1162/tacl_a_00638 2024

[8] [8]

H. Han, Y. Wang, H. Shomer, K. Guo, J. Ding, Y. Lei, M. Ha- lappanavar, R. A. Rossi, S. Mukherjee, X. Tang, et al., Retrieval- augmented generation with graphs (graphrag), arXiv preprint arXiv:2501.00309 (2024)

arXiv 2024