Pith. sign in

REVIEW 2 major objections 6 minor 53 references

A query-only attacker can reconstruct a target entity's typed one-hop subgraph from a defended Graph RAG service by reframing extraction as a routine relation-extraction task, reaching F1 scores in the low 80s where prior attacks fail.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

GRASP, a closed-box multi-turn prompt attack, reconstructs type-faithful one-hop subgraphs from defended Graph RAG systems, reaching up to 82.9 F1 where prior attacks fail.

T0 review reviewed 2026-08-03 challenge →

load-bearing objection A genuinely new Graph RAG extraction attack with a real scope problem: the headline RType F1 almost certainly depends on a typed relation schema that the stock frameworks don't provide, and the paper never shows the schema. the 2 major comments →

arxiv 2602.06495 v2 pith:53EF7XZZ submitted 2026-02-06 cs.CR

Graphs Don't Stay Secret: Practical Subgraph Reconstruction Attacks on Defended Graph RAG

Minkyoo Song , Jaehan Kim , Myungchul Kang , Hanna Kim , Seungwon Shin , Sooel Son This is my paper
classification cs.CR
keywords subgraph reconstructionGraph RAGdata extraction attackrelation extractionprompt-based defenseinstance groundingadaptive query schedulingprivacy leakage
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that Graph RAG systems remain vulnerable to targeted subgraph reconstruction even when the service explicitly prohibits verbatim disclosure and graph-structure leakage. It introduces GRASP, a closed-box, multi-turn attack that reframes extraction as a legitimate relation-extraction task, and reports type-faithful F1 up to 82.9 while six prior attack prompts collapse to near zero under the same safe-prompt defense. The paper also proposes two lightweight context-construction defenses — ID Alignment and Decoy — that reduce reconstruction fidelity to the teens while preserving benign utility, yet residual leakage persists. If correct, the result means intent-detection style prompt defenses are not enough to protect graph-structured knowledge assets.

Core claim

GRASP recovers typed one-hop subgraphs from a defended, closed-box Graph RAG system by treating extraction as a constrained relation-extraction task rather than as an explicit request to repeat retrieved content. Each attack query asks the model to emit relation quadruples — (ID, src, rtype, dst) — taken verbatim from the retrieved relation tables, and only for relations incident to a target entity. The per-record ID acts as an instance delimiter that suppresses hallucinated cross-record combinations, which the paper identifies as the dominant source of false positives (83.9%). A momentum-aware scheduler then chooses among four diversity templates to keep discovering unseen relations within

What carries the argument

The central mechanism is the per-instance identifier in the quadruple format (ID, src, rtype, dst): it anchors each extracted relation to a specific retrieved record, preventing the model from composing plausible but false relations from pieces of different records. The second mechanism is the adaptive prompt scheduler, which tracks extraction momentum via an exponential moving average, uses a novelty-based stopping rule estimated from the frequency of newly seen relations, and selects among four diversity templates (context-frame drift, type expand, type explore, residual extract) to escape saturation and operate within a strict query budget.

Load-bearing premise

The attack works only when the Graph RAG service places the target entity's incident edges into the LLM's context as structured, parseable relation records in response to a generic anchor query; a deployment that hides or omits relation tables would invalidate the central feasibility claim.

What would settle it

Build a Graph RAG service that answers the same anchor query without exposing a normalized relation table — for example, by providing only narrative summaries or by fusing relation records into opaque text — then run GRASP against it. If RType F1 remains high, the attack is not as context-dependent as claimed; if it collapses to the near-zero level of the prior baselines, the paper's core mechanism is confirmed.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Prompt-level safeguards that block explicit exfiltration intent are insufficient: once extraction is framed as a legitimate processing task, the same safe prompt barely reduces reconstruction fidelity.
  • Stronger safety-aligned LLMs can execute the constrained extraction task more reliably, meaning improved model capability may amplify, not reduce, this attack surface.
  • Graph RAG deployments that serve undirected relations are more exposed, because the attacker no longer needs to recover edge direction.
  • Context-construction defenses that disrupt instance identity (ID Alignment) and field attribution (Decoy) reduce reconstruction F1 to the mid-teens while keeping utility intact, but residual leakage remains even when layered with rejection-based blocking.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • A natural extension is to use GRASP as a red-team audit tool: providers could run it against their own Graph RAG deployments to measure what fraction of the knowledge graph is query-reconstructible before an attacker exploits the same vector.
  • The scheduling and stopping dynamics suggest a possible detection signal: a sudden plateau in the novelty of extracted relations across a single user's queries could indicate automated subgraph probing, though the paper does not explore this monitoring angle.
  • Because the attack succeeds within roughly ten queries, per-account rate limiting or anomaly detection on query diversity might blunt it in practice; the paper does not test such operational countermeasures.
  • The success of the decoy defense implies that the context-table schema itself is a security parameter, so the arms race may shift toward obfuscating or randomizing the structure of retrieved relation records.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

2 major / 6 minor

Summary. The paper studies data extraction from Graph RAG systems under a closed-box threat model in which the provider installs a safe system prompt that forbids verbatim disclosure and graph-structure leakage. It first analyzes six prior extraction prompts and attributes their failure to three causes: explicit exfiltration intent triggering refusals, safety-induced rewriting breaking exact relation fidelity, and fixed-query repetition saturating quickly. The paper then proposes GRASP, a multi-turn attack that (i) reframes extraction as a legitimate relation-extraction task from retrieved context tables, (ii) uses per-instance IDs and a strictly formatted quadruple output to reduce hallucination and preserve typed relations, and (iii) schedules four diversity templates via a momentum-aware policy with a query budget and Good-Turing early stopping. Experiments on Enron and HealthCareMagic knowledge graphs with four LLMs report GRASP reaching up to 82.9 RType F1 and 83.5 Naïve F1 under the safe-prompt defense, with prior baselines collapsing to near-zero RType F1. The paper also evaluates user-prompt, summarization-based, rejection-based, and decoding-time defenses, and proposes two context-construction defenses (ID Alignment and Decoy) that reduce GRASP's F1 to mid-teens while preserving benign QA utility.

Significance. If the findings hold, the paper identifies a real and understudied confidentiality risk: prompt-level safeguards that block verbatim repetition do not prevent a task-framed attacker from recovering typed relational structure from Graph RAG context. The contribution is useful and timely. The strengths are substantive: the paper includes a concrete threat model, a failure analysis of prior attacks with rejection/rewriting measurements, a well-motivated attack design, ablations isolating each design component, a defense evaluation including a decoding-time method, and exact prompts in the appendix. The attack's transfer across three Graph RAG frameworks and four LLMs is a valuable empirical claim. The main limitation is that the central quantitative claim is contingent on the exact schema of the relation tables served by the attacked systems, and this is not documented sufficiently. Reproducibility is also weakened by the absence of code/data and of variance information for the 50-target macro-averages.

major comments (2)
  1. [§5.3, Fig. 6; §6.1.1, Tables 7 and 8; Table 4] The RType metric and the extraction template require an explicit, normalized REL_TYPE field in the served relation table: the template instructs the model to copy 'REL_TYPE' and strings 'exactly as listed in the table'. However, the paper never shows the graph-construction prompt or the actual served context schema. Table 8's typed vocabulary (compliance, request, reporting, meeting, attachment) is not part of the default Microsoft GraphRAG/LightRAG/nano-GraphRAG relationship schema, which stores relation semantics in free-text descriptions; Table 4 itself shows 'Type: call' embedded inside a description field. This raises a load-bearing scope question: either the authors modified the graph schema to add a REL_TYPE attribute, in which case the headline 'up to 82.9 RType F1' applies to schema-enriched variants rather than the cited vanilla Graph RAG frameworks and Figure 10 overstates tra
  2. [§6.1.3, Table 3, Algorithm 1] The main quantitative claims rest on macro-averages over 50 randomly sampled target entities, but the paper provides no error bars, confidence intervals, seeds, or per-target distributions. This matters because Algorithm 1 includes stochastic template sampling and the target sets are random; two target samples could plausibly move the headline numbers by several F1 points, especially for the 'baseline collapses to 0.0' comparisons. Please provide variance information, seeds, or a reproducibility artifact (code/data release) so the reader can assess the stability of the central comparison.
minor comments (6)
  1. [§5.3] The text says the ID 'need not explicitly exist in the retrieved context', but the extraction template in Figure 6 tells the model to 'use ID and strings verbatim'. These statements are in tension and should be clarified: are the IDs assigned by the model or copied from an ID column?
  2. [Fig. 8] The legend label 'recall of w.o div' appears misplaced or incomplete; it likely refers to the w.o div bar in the recall group.
  3. [References] Typographical errors: reference [3] 'Antropic' should be 'Anthropic'; reference [32] 'Micosoft' should be 'Microsoft'.
  4. [Table 3] The 'Na"ive' heading shows a raw LaTeX escape; please use the proper unicode or formatted text.
  5. [§6.1.2, Figure 13] Worm and FG are described as 'advanced attacks that iteratively optimize queries', but Table 3 evaluates them with a fixed prompt template plus static formatting (Figure 13), not the full iterative optimization. The text later says they were 'adapted' and 'strengthened', but the caption/description should state clearly that the iterative search components were not exercised for the main comparison, so readers do not infer the baselines include their full published machinery.
  6. [§4.2] The Rouge-L comparison compares responses under the original versus the safe prompt, but the safe prompt also changes system behavior beyond enforcing non-disclosure; this is acceptable as a descriptive measure but should not be read as a causal estimate of 'safety-induced paraphrasing' alone.

Circularity Check

0 steps flagged

No significant circularity: GRASP's reconstruction F1 is an empirical measurement against external ground-truth graphs; no derivation-level input is recycled as a prediction.

full rationale

The paper's argument is an empirical attack evaluation, not a derivation. GRASP's pipeline (Eq. 3, Section 5) issues benign anchor queries, the closed-box Graph RAG returns a context of retrieved entities, relations, and texts (Eq. 1, Section 2.1), and the extraction template (Section 5.3, Fig. 6) asks the target LLM to emit quadruples (ID, SRC_ENTITY, REL_TYPE, DST_ENTITY) 'exactly as listed in the table.' Success is measured by macro-averaged Precision/Recall/F1 against the ground-truth typed relation set E_t defined in Eq. 2, which is built externally from the Enron and HealthCareMagic corpora (Section 6.1.1). The high F1 values are therefore not defined in terms of any fitted parameter or of the attack's own outputs; they quantify whether the served context, once elicited under safe prompts, contains and reveals the external ground-truth edges. The reliance on a structured relation table in the served context is an explicit deployment assumption (Sections 2.1, 6.1.1, Fig. 6) rather than a self-referential construct, and the paper's defenses (ID Alignment, Decoy) are evaluated by measuring whether they disrupt the same externally grounded metric. No load-bearing uniqueness theorem, author self-citation chain, or ansatz smuggled via citation appears in the derivation. The use of GPT4o-mini both to construct the graph and as one of the chat models is a possible transferability/confound concern, but it does not make the F1 measure circular: the attack remains effective when the target chat model is GPT5-mini, Claude Haiku 4.5, or Qwen3 30B (Table 3), and the ground-truth graph is independent of the attack queries. Accordingly, no specific reduction of a claimed result to its own inputs can be exhibited, and the circularity score is 0.

Axiom & Free-Parameter Ledger

7 free parameters · 6 axioms · 0 invented entities

The central claim rests on threat-model access, structured context exposure, and LLM compliance. No new physical or formal entities are introduced. The main free parameters are scheduler hyperparameters and hand-built anchor frames; these affect the attack's efficiency but not the existence of the leakage.

free parameters (7)
  • EMA coefficient α = 0.6
    Hand-set in Algorithm 1; controls scheduler state updating and template reweighting. No sensitivity analysis is reported.
  • Momentum thresholds for Surge/Steady/Stall = 2.0 and 0.5
    Hand-set per-target discovery-rate boundaries in §5.5; no held-out tuning or robustness check.
  • Good-Turing stopping threshold and diversity activation threshold = 0.3 and 0.9
    Hand-set in Algorithm 1; directly determines when the attack stops or enters diversity phase.
  • Template-selection base weights = Table 2 values (e.g., (0.7,0,0,0.3), (0.5,0,0.2,0.3), ...)
    Hand-authored policy weights; no ablation or evidence that they generalize across datasets/LLMs.
  • Type scarcity/saturation threshold τ = 3
    Hand-set in Table 2 to define scar/sat; not derived from data.
  • Per-target query budget Qmax = 10
    Chosen to be 'small' under threat model; these attack results are budget-conditional, and Figure 9 shows F1 peaks early.
  • Anchor frame lists and k=3 dissimilar-frame selection = Domain keyword sets in Table 6; k=3
    Hand-constructed from coarse domain knowledge; the attack requires such frames to exist and to be effective for the target domain.
axioms (6)
  • domain assumption Attacker can issue arbitrary open-ended queries through the standard API/UI and observe responses without rate-limit or anomaly-detection intervention.
    Closed-box threat model in §3.1; a stricter access-control layer would invalidate the attack.
  • domain assumption The Graph RAG service exposes retrieved entities and relations as structured tables/lists inside the LLM context (Eq. 1).
    GRASP's extraction template parses 'relation table' context; if the service serves graph evidence in unstructured prose only, the attack loses its grounding.
  • domain assumption Target graph relation types are natural-language phrases produced by LLM-based entity/relation extraction.
    Graph construction uses GPT4o-mini extraction (§6.1.1); the attack's type-faithful matching depends on readable, extractable relation types.
  • domain assumption The safe system prompt does not modify retrieved context or remove graph content; it only instructs the model to avoid disclosure.
    Defense considered in §3.1 and Figure 1 is prompt-level; context-construction defenses are treated separately in §7.
  • domain assumption Instruction-following LLMs will comply with extraction framed as constrained relation extraction, rather than refusing.
    Empirical premise validated only on the four tested models; the paper's own defense evaluation shows robust models still leak, but stronger refusal or decoding defenses could break this.
  • domain assumption Good-Turing novelty estimation predicts marginal extraction yield from a sliding window of previously extracted relations.
    Used as early-stopping rule (Eq. 4); assumes relation sampling is approximately i.i.d., which is questionable under retrieval steering.

reviewed 2026-08-03 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Graphs Don't Stay Secret: Practical Subgraph Reconstruction Attacks on Defended Graph RAG." pith.science (2026). https://pith.science/paper/53EF7XZZ

@misc{pith2026260206495,
  author       = {Pith},
  title        = {Pith review of: Graphs Don't Stay Secret: Practical Subgraph Reconstruction Attacks on Defended Graph RAG},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/53EF7XZZ}},
  note         = {Machine review of arXiv:2602.06495}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Graph-based retrieval-augmented generation (Graph RAG) is increasingly deployed to support LLM applications by augmenting user queries with structured knowledge retrieved from a knowledge graph. While Graph RAG improves relational reasoning, it introduces a largely understudied threat: adversaries can reconstruct subgraphs from a target RAG system's knowledge graph, enabling privacy inference and replication of curated knowledge assets. We show that existing attacks are largely ineffective against Graph RAG even with simple prompt-based safeguards, because these attacks expose explicit exfiltration intent and are therefore easily suppressed by lightweight safe prompts. We identify three technical challenges for practical Graph RAG extraction under realistic safeguards and introduce GRASP, a closed-box, multi-turn subgraph reconstruction attack. GRASP (i) reframes extraction as a context-processing task, (ii) enforces format-compliant, instance-grounded outputs via per-record identifiers to reduce hallucinations and preserve relational details, and (iii) diversifies goal-driven attack queries using a discovery-aware scheduler to operate within strict query budgets. Across two real-world knowledge graphs, four safety-aligned LLMs, and multiple Graph RAG frameworks, GRASP attains the strongest type-faithful reconstruction where prior methods fail, reaching up to 82.9 F1. We further evaluate defenses and propose two mitigations that effectively reduce reconstruction fidelity without utility loss.

Figures

Figures reproduced from arXiv: 2602.06495 by Hanna Kim, Jaehan Kim, Minkyoo Song, Myungchul Kang, Seungwon Shin, Sooel Son.

Figure 1
Figure 1. Figure 1: Safe system prompt of Microsoft GraphRAG [ [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Closed-box subgraph reconstruction attack scenario against Graph RAG. [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Prompts used for baseline attacks. Original prompt Safe prompt 0 20 40 60 Extraction Recall 18.8 20.7 0.2 0.2 55.3 11.9 61.1 16.6 19.3 16.8 0.1 0.0 P1 P2 P3 P4 P_Worm P_FG [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figure 5
Figure 5. Figure 5: Cumulative naïve recall of baseline attack prompts [PITH_FULL_IMAGE:figures/full_fig_p005_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Extraction template that requests extraction of re [PITH_FULL_IMAGE:figures/full_fig_p006_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Diversity templates used for prompt scheduling in [PITH_FULL_IMAGE:figures/full_fig_p007_7.png] view at source ↗
Figure 9
Figure 9. Figure 9: Attack performance over iterative attempts. [PITH_FULL_IMAGE:figures/full_fig_p010_9.png] view at source ↗
Figure 10
Figure 10. Figure 10: Attack performance across Graph RAG systems. [PITH_FULL_IMAGE:figures/full_fig_p010_10.png] view at source ↗
Figure 11
Figure 11. Figure 11: Defense–utility trade-off under PAD [42]. [PITH_FULL_IMAGE:figures/full_fig_p012_11.png] view at source ↗
Figure 12
Figure 12. Figure 12: Prompt used by the post-processor for relation [PITH_FULL_IMAGE:figures/full_fig_p013_12.png] view at source ↗
Figure 13
Figure 13. Figure 13: Adversarial prompt in Worm / FG adapted for [PITH_FULL_IMAGE:figures/full_fig_p014_13.png] view at source ↗
Figure 14
Figure 14. Figure 14: Prompts used for summarization and rejection [PITH_FULL_IMAGE:figures/full_fig_p014_14.png] view at source ↗
Figure 15
Figure 15. Figure 15: Node-degree distributions of the constructed [PITH_FULL_IMAGE:figures/full_fig_p014_15.png] view at source ↗
Figure 16
Figure 16. Figure 16: Attack performance with varying top-k relations. [PITH_FULL_IMAGE:figures/full_fig_p015_16.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

53 extracted references · 10 linked inside Pith

  1. [1]

    Alibaba. 2025. Qwen3-30B-A3B. https://huggingface.co/Qwen/Qwen3-30B-A3B

    2025

  2. [2]

    Maya Anderson, Guy Amit, and Abigail Goldsteen. 2025. Is My Data in Your Retrieval Database? Membership Inference Attacks Against Retrieval Augmented Generation. InInternational Conference on Information Systems Security and Privacy, Vol. 2. Science and Technology Publications, Lda, 474–485

    2025

  3. [3]

    Antropic. 2025. Introducing Claude Haiku 4.5. https://www.anthropic.com/news /claude-haiku-4-5

    2025

  4. [4]

    Atousa Arzanipour, Rouzbeh Behnia, Reza Ebrahimi, and Kaushik Dutta. 2025. RAG Security and Privacy: Formalizing the Threat Model and Attack Surface. arXiv preprint arXiv:2509.20324(2025)

    Pith/arXiv arXiv 2025

  5. [5]

    Zhuo Chen, Yuyang Gong, Jiawei Liu, Miaokun Chen, Haotan Liu, Qikai Cheng, Fan Zhang, Wei Lu, and Xiaozhong Liu. 2025. Flippedrag: Black-box opinion manipulation adversarial attacks to retrieval-augmented generation models. In Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security. 4109–4123

    2025

  6. [6]

    Stav Cohen, Ron Bitton, and Ben Nassi. 2024. Unleashing worms and extracting data: Escalating the outcome of attacks against rag-based inference in scale and severity using jailbreaking.arXiv preprint arXiv:2409.08045(2024)

    Pith/arXiv arXiv 2024

  7. [7]

    Tiago da Cruz, Bernardo Tavares, and Francisco Belo. 2025. Ontology Learning and Knowledge Graph Construction: A Comparison of Approaches and Their Impact on RAG Performance.arXiv preprint arXiv:2511.05991(2025)

    arXiv 2025

  8. [8]

    Haoyu Dong, Jianbo Zhao, Yuzhang Tian, Junyu Xiong, Mengyu Zhou, Yun Lin, José Cambronero, Yeye He, Shi Han, and Dongmei Zhang. 2024. Encoding spreadsheets for large language models. InProceedings of the 2024 Conference on Empirical Methods in Natural Language Processing. 20728–20748

    2024

  9. [9]

    Darren Edge, Ha Trinh, Newman Cheng, Joshua Bradley, Alex Chao, Apurva Mody, Steven Truitt, Dasha Metropolitansky, Robert Osazuwa Ness, and Jonathan Larson. 2024. From local to global: A graph rag approach to query-focused summarization.arXiv preprint arXiv:2404.16130(2024)

    Pith/arXiv arXiv 2024

  10. [10]

    Wenqi Fan, Yujuan Ding, Liangbo Ning, Shijie Wang, Hengyun Li, Dawei Yin, Tat-Seng Chua, and Qing Li. 2024. A survey on rag meeting llms: Towards retrieval-augmented large language models. InProceedings of the 30th ACM SIGKDD conference on knowledge discovery and data mining. 6491–6501

    2024

  11. [11]

    Irving J Good. 1953. The population frequencies of species and the estimation of population parameters.Biometrika40, 3-4 (1953), 237–264

    1953

  12. [12]

    Zirui Guo, Lianghao Xia, Yanhua Yu, Tu Ao, and Chao Huang. 2025. LightRAG: Simple and Fast Retrieval-Augmented Generation. InFindings of the Association for Computational Linguistics: EMNLP 2025, Christos Christodoulopoulos, Tanmoy Chakraborty, Carolyn Rose, and Violet Peng (Eds.). Association for Computational Linguistics, Suzhou, China, 10746–10761. doi...

    doi:10.18653/v1/2025.findings-emnlp 2025

  13. [13]

    Hyeonjeong Ha, Qiusi Zhan, Jeonghwan Kim, Dimitrios Bralios, Saikrishna Sanniboina, Nanyun Peng, Kai-Wei Chang, Daniel Kang, and Heng Ji. 2025. MM-PoisonRAG: Disrupting Multimodal RAG with Local and Global Poisoning Attacks.arXiv preprint arXiv:2502.17832(2025)

    Pith/arXiv arXiv 2025

  14. [14]

    HIPAA. 2024. HIPAA and Reproductive Health. https://www.hhs.gov/hipaa/for- professionals/special-topics/reproductive-health/

    2024

  15. [15]

    Aidan Hogan, Eva Blomqvist, Michael Cochez, Claudia d’Amato, Gerard De Melo, Claudio Gutierrez, Sabrina Kirrane, José Emilio Labra Gayo, Roberto Navigli, Sebastian Neumaier, et al. 2021. Knowledge graphs.ACM Computing Surveys (Csur)54, 4 (2021), 1–37

    2021

  16. [16]

    Michael Hunger. 2024. What Is GraphRAG? https://neo4j.com/blog/genai/what- is-graphrag/. 12 Subgraph Reconstruction Attacks on Graph RAG Deployments with Practical Defenses Conference’17, July 2017, Washington, DC, USA

    2024

  17. [17]

    indigo.ai. 2025. Retrieval Augmented Generation use cases for enterprise. https: //indigo.ai/en/blog/retrieval-augmented-generation/

    2025

  18. [18]

    MS Jawad, Chitra Dhawale, Azizul Azhar Bin Ramli, and Hairulnizam Mahdin

  19. [19]

    Changyue Jiang, Xudong Pan, Geng Hong, Chenfu Bao, and Min Yang. 2024. Rag- thief: Scalable extraction of private data from retrieval-augmented generation applications with agent-based attacks.arXiv preprint arXiv:2411.14110(2024)

    Pith/arXiv arXiv 2024

  20. [20]

    Bernal Jimenez Gutierrez, Yiheng Shu, Yu Gu, Michihiro Yasunaga, and Yu Su

  21. [21]

    Bryan Klimt and Yiming Yang. 2004. The enron corpus: A new dataset for email classification research. InEuropean conference on machine learning. Springer, 217–226

    2004

  22. [22]

    Susan Landau. 2020. Categorizing uses of communications metadata: System- atizing knowledge and presenting a path for privacy. InProceedings of the New Security Paradigms Workshop 2020. 1–19

    2020

  23. [23]

    Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen-tau Yih, Tim Rocktäschel, et al. 2020. Retrieval-augmented generation for knowledge-intensive nlp tasks. Advances in neural information processing systems33 (2020), 9459–9474

    2020

  24. [24]

    Yunxiang Li, Zihan Li, Kai Zhang, Ruilong Dan, Steve Jiang, and You Zhang. 2023. Chatdoctor: A medical chat model fine-tuned on a large language model meta-ai (llama) using medical domain knowledge.Cureus15, 6 (2023)

    2023

  25. [25]

    Yuying Li, Gaoyang Liu, Chen Wang, and Yang Yang. 2025. Generating is believ- ing: Membership inference attacks against retrieval-augmented generation. In ICASSP 2025-2025 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 1–5

    2025

  26. [26]

    Zehan Li, Xin Zhang, Yanzhao Zhang, Dingkun Long, Pengjun Xie, and Meishan Zhang. 2023. Towards general text embeddings with multi-stage contrastive learning.arXiv preprint arXiv:2308.03281(2023)

    Pith/arXiv arXiv 2023

  27. [27]

    Jiacheng Liang, Yuhui Wang, Changjiang Li, Rongyi Zhu, Tanqiu Jiang, Neil Gong, and Ting Wang. 2025. Graphrag under fire.arXiv preprint arXiv:2501.14050 (2025)

    arXiv 2025

  28. [28]

    Jiale Liu, Jiahao Zhang, and Suhang Wang. 2025. Exposing Privacy Risks in Graph Retrieval-Augmented Generation.arXiv preprint arXiv:2508.17222(2025)

    Pith/arXiv arXiv 2025

  29. [29]

    Weizheng Lu, Jing Zhang, Ju Fan, Zihao Fu, Yueguo Chen, and Xiaoyong Du

  30. [30]

    Linhao Luo, Zicheng Zhao, Gholamreza Haffari, Dinh Phung, Chen Gong, and Shirui Pan. 2025. GFM-RAG: graph foundation model for retrieval augmented generation.arXiv preprint arXiv:2502.01113(2025)

    arXiv 2025

  31. [31]

    MarketsandMarkets. 2025. Knowledge Graph Market. https://www.marketsand markets.com/Market-Reports/knowledge-graph-market-217920811.html

    2025

  32. [32]

    Micosoft. 2024. GraphRAG. https://github.com/microsoft/graphrag

    2024

  33. [33]

    OpenAI. 2024. GPT-4o mini: advancing cost-efficient intelligence. https://openai .com/index/gpt-4o-mini-advancing-cost-efficient-intelligence/

    2024

  34. [34]

    OpenAI. 2024. text-embedding-3-small. https://platform.openai.com/docs/model s/text-embedding-3-small

    2024

  35. [35]

    OpenAI. 2025. gpt-5-mini-2025-08-07. https://platform.openai.com/docs/models/ gpt-5-mini

    2025

  36. [36]

    Zhenting Qi, Hanlin Zhang, Eric P Xing, Sham M Kakade, and Himabindu Lakkaraju. 2024. Follow My Instruction and Spill the Beans: Scalable Data Ex- traction from Retrieval-Augmented Generation Systems. InICLR 2024 Workshop on Navigating and Addressing Data Problems for Foundation Models

    2024

  37. [37]

    Nils Reimers and Iryna Gurevych. 2019. Sentence-BERT: Sentence Embeddings using Siamese BERT-Networks. InProceedings of the 2019 Conference on Em- pirical Methods in Natural Language Processing. Association for Computational Linguistics. https://arxiv.org/abs/1908.10084

    Pith/arXiv arXiv 2019

  38. [38]

    Avital Shafran, Roei Schuster, and Vitaly Shmatikov. 2025. Machine Against the {RAG}: Jamming{Retrieval-Augmented} Generation with Blocker Documents. In34th USENIX Security Symposium (USENIX Security 25). 3787–3806

    2025

  39. [39]

    Brian Shi. 2025. Boosting Q&A Accuracy with GraphRAG Using PyG and Graph Databases. https://developer.nvidia.com/blog/boosting-qa-accuracy-with- graphrag-using-pyg-and-graph-databases

    2025

  40. [40]

    Kurt Shuster, Spencer Poff, Moya Chen, Douwe Kiela, and Jason Weston. 2021. Retrieval Augmentation Reduces Hallucination in Conversation. InFindings of the Association for Computational Linguistics: EMNLP 2021. 3784–3803

    2021

  41. [41]

    Yuan Sui, Mengyu Zhou, Mingjie Zhou, Shi Han, and Dongmei Zhang. 2024. Table meets llm: Can large language models understand structured table data? a benchmark and empirical study. InProceedings of the 17th ACM International Conference on Web Search and Data Mining. 645–654

    2024

  42. [42]

    Haoran Wang, Xiongxiao Xu, Baixiang Huang, and Kai Shu. 2025. Privacy- aware decoding: Mitigating privacy leakage of large language models in retrieval- augmented generation.arXiv preprint arXiv:2508.03098(2025)

    Pith/arXiv arXiv 2025

  43. [43]

    Jiayi Wen, Tianxin Chen, Zhirun Zheng, and Cheng Huang. 2025. A Few Words Can Distort Graphs: Knowledge Poisoning Attacks on Graph-based Retrieval-Augmented Generation of Large Language Models.arXiv preprint arXiv:2508.04276(2025)

    Pith/arXiv arXiv 2025

  44. [44]

    Gustavo Ye. 2024. nano-graphrag. https://github.com/gusye1234/nano-graphrag

    2024

  45. [45]

    Shenglai Zeng, Jiankun Zhang, Pengfei He, Yiding Liu, Yue Xing, Han Xu, Jie Ren, Yi Chang, Shuaiqiang Wang, Dawei Yin, et al. 2024. The good and the bad: Exploring privacy issues in retrieval-augmented generation (rag). InFindings of the Association for Computational Linguistics: ACL 2024. 4505–4524

    2024

  46. [46]

    Shenglai Zeng, Jiankun Zhang, Pengfei He, Jie Ren, Tianqi Zheng, Hanqing Lu, Han Xu, Hui Liu, Yue Xing, and Jiliang Tang. 2025. Mitigating the privacy issues in retrieval-augmented generation (rag) via pure synthetic data. InProceedings of the 2025 Conference on Empirical Methods in Natural Language Processing. 24538–24569

    2025

  47. [47]

    Qinggang Zhang, Shengyuan Chen, Yuanchen Bei, Zheng Yuan, Huachi Zhou, Zijin Hong, Hao Chen, Yilin Xiao, Chuang Zhou, Junnan Dong, et al . 2025. A survey of graph retrieval-augmented generation for customized large language models.arXiv preprint arXiv:2501.13958(2025)

    arXiv 2025

  48. [48]

    Zhikun Zhang, Min Chen, Michael Backes, Yun Shen, and Yang Zhang. 2022. Infer- ence attacks against graph neural networks. In31st USENIX Security Symposium (USENIX Security 22). 4543–4560

    2022

  49. [49]

    Tianzhe Zhao, Jiaoyan Chen, Yanchi Ru, Haiping Zhu, Nan Hu, Jun Liu, and Qika Lin. 2025. Exploring knowledge poisoning attacks to retrieval-augmented generation.Information Fusion(2025), 103900

    2025

  50. [50]

    <SRC_ENTITY> <REL_TYPE> <DST_ENTITY>

    Wei Zou, Runpeng Geng, Binghui Wang, and Jinyuan Jia. 2025.{PoisonedRAG}: Knowledge corruption attacks to{Retrieval-Augmented} generation of large language models. In34th USENIX Security Symposium (USENIX Security 25). 3827–3844. A Prompts We include the exact prompts used in our experiments: (i) the post- processing parser (Figure 12), (ii) the adapted W...

    2025

  51. [2023]

    Adoption of knowledge-graph best development practices for scalable and optimized manufacturing processes.MethodsX10 (2023), 102124

    2023

  52. [2024]

    Hipporag: Neurobiologically inspired long-term memory for large language models.Advances in Neural Information Processing Systems37 (2024), 59532– 59569

    2024

  53. [2025]

    Large language model for table processing: A survey.Frontiers of Computer Science19, 2 (2025), 192350

    2025

This paper was first reviewed by deepseek-v4-flash on August 3, 2026.