Trigger as Entity: Backdoor Attacks to Graph-Based Retrieval-Augmented Generation of Large Language Models

Summary

Researchers present the first backdoor attacks against graph-based Retrieval-Augmented Generation (RAG) systems used with LLMs. The attacker poisons a crafted corpus in the external database so that trigger entities are inserted into the knowledge graph, causing the model to give attacker-chosen answers only for trigger-containing queries while answering other queries correctly. The authors evaluate three trigger types (word-level, topic-level and semantic-level) with increasing stealth across multiple knowledge databases and language models, and warn of risks to chatbots and agents built on such systems.

Topics

• Adversarial machine learning
• Retrieval-augmented generation

Related items

• MediumResearchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User InteractionSimilar attack · The Hacker News
• MediumChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data ExfiltrationSimilar attack · Check Point Research
• MediumTop AI agent security resources — November 2026Similar attack · Adversa AI Blog
• MediumResearchers Uncover Prompt Adware Hidden in OpenAI Codex Jailbreak ToolkitSimilar attack · The Hacker News
• InfoAddition by Subtraction: Toward Mitigating Fragile Safety Alignment in Large Language ModelsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)