Trigger as Entity: Backdoor Attacks to Graph-Based Retrieval-Augmented Generation of Large Language Models

Researchers discovered a new security vulnerability in graph-based RAG (retrieval-augmented generation, where an AI system pulls information from external knowledge graphs to answer questions) systems used with large language models. Attackers can poison the external database by inserting hidden triggers and false information into the knowledge graph, causing the AI to give wrong answers when those triggers appear in user queries while still answering normal questions correctly. The attack uses three types of triggers at different complexity levels, from simple words to semantic patterns, and tests showed the attack works across multiple AI systems.