🤖 AI

BadSKP: Backdoor Attacks on Knowledge Graph-Enhanced LLMs with Soft Prompts

The paper introduces BadSKP, a novel backdoor attack that exploits the graph-conditioned channel of knowledge graph-enhanced LLMs by manipulating node embeddings to override semantic anchoring, thereby achieving high attack success rates where traditional text-based attacks fail.

Original authors: Xiaoting Lyu, Yufei Han, Hangwei Qian, Haoyuan Yu, Xiang Ao, Bin Wang, Chenxu Wang, Xiaobo Ma, Wei Wang

Published 2026-05-13

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Xiaoting Lyu, Yufei Han, Hangwei Qian, Haoyuan Yu, Xiang Ao, Bin Wang, Chenxu Wang, Xiaobo Ma, Wei Wang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a very smart robot librarian (a Large Language Model, or LLM) who knows a lot of facts but sometimes makes things up. To help it, you give it a "cheat sheet" (a Knowledge Graph) containing facts about the world.

There are two ways to give this cheat sheet to the robot:

The Old Way (Text Prompts): You read the cheat sheet out loud to the robot in plain English. "Here is a list of facts: Justin Bieber has a brother named Jaxon."
The New Way (Soft Prompts): You don't read the facts out loud. Instead, you translate the entire cheat sheet into a special, invisible "vibe" or "feeling" (a continuous soft prompt) that the robot can sense directly. This is like handing the robot a secret radio signal that says, "Focus on family connections," without using any words.

The Problem: The "Robustness Gap"

The researchers discovered a surprising safety difference between these two methods.

The Old Way is fragile: If a bad guy sneaks a note into the cheat sheet saying, "Ignore the question and scream 'I don't know!'", the robot reads it and obeys immediately.
The New Way is tough: If the bad guy puts that same note into the cheat sheet, the robot ignores it. Why? Because the invisible "vibe" (the soft prompt) is so strong and focused on the actual question that it acts like an anchor. It holds the robot's attention firmly on the topic, drowning out the loud, confusing shouting from the text.

The paper calls this "Semantic Anchoring." Think of the soft prompt as a heavy anchor dropping the robot's mind into the right spot, making it hard for surface-level noise (bad text) to drag it away.

The Attack: "BadSKP"

The researchers asked: "If the anchor is so strong, can we break it?"

They realized that while the text can't break the anchor, the source of the anchor can. Since the "vibe" comes from the graph structure itself, if a bad guy can mess with the graph, they can change the vibe.

They created an attack called BadSKP. Instead of just shouting bad words, they:

Hacked the source: They secretly altered the structure of the cheat sheet (the graph) and the hidden "feelings" of the nodes.
Twisted the anchor: They made the invisible "vibe" point in the wrong direction. Instead of anchoring the robot to the question, they anchored it to a malicious command.
Made it look normal: They used a multi-step process to ensure the changes looked like normal, fluent text so no one would notice the cheat sheet was tampered with.

The Result: Even though the robot was using the "tough" new method, BadSKP successfully tricked it. When asked a normal question about a specific person, the robot would suddenly refuse to answer or give a completely wrong answer, all because the bad guy had secretly re-tuned the invisible anchor.

The Defenses (and why they failed)

The researchers tried standard defenses, like a "Perplexity Filter." Imagine this filter as a spellchecker that deletes any sentence that sounds weird or unnatural.

The Outcome: The filter failed. Because BadSKP was so clever, it made the malicious text sound perfectly natural and fluent. The filter thought it was safe, but the invisible anchor was still twisted.

The Proposed Solution

The paper suggests a new way to defend against this. Instead of checking if the words look weird, we should check if the anchor is holding.

The Idea: Monitor the robot's internal "attention." If the robot is supposed to be focused on the question, but its internal focus is drifting toward a weird, unrelated direction, flag it as suspicious.
The Analogy: It's like a security guard who doesn't just check if a visitor's ID card looks fake, but watches to see if the visitor is actually looking at the map they are supposed to be following. If they start staring at the ceiling instead, the guard knows something is wrong, even if the ID card looks perfect.

Summary

The Discovery: New AI systems that use "invisible vibes" (soft prompts) from graphs are much harder to trick with bad text than old systems.
The Breakthrough: However, if you hack the graph that creates the vibe, you can twist the vibe itself and break the system.
The Lesson: You can't just check the words; you have to check the underlying structure and the "direction" the AI is thinking.

Technical Summary: BadSKP – Backdoor Attacks on Knowledge Graph-Enhanced LLMs with Soft Prompts

Problem Statement

Recent advancements in Knowledge Graph-enhanced Large Language Models (KG-enhanced LLMs) have introduced a dual-channel architecture where retrieved subgraphs are encoded into continuous "soft prompts" via Graph Neural Networks (GNNs), operating alongside standard textual inputs. While this design improves factual grounding, its security implications remain underexplored.

Existing backdoor attacks on Retrieval-Augmented Generation (RAG) systems primarily target the textual channel by injecting malicious instructions into retrieved text. However, the authors identify a robustness gap: text-channel attacks that successfully compromise textual KG prompting systems (e.g., StructGPT, RoG) are largely ineffective against soft-prompt-based systems (e.g., G-Retriever, GNP). In soft-prompt systems, the graph-derived soft prompt appears to "anchor" the generation-driving hidden state toward query-consistent semantics, suppressing surface-level malicious instructions found in the text channel.

The core problem addressed is whether this apparent resilience is absolute. The paper posits that because the semantic anchoring effect is induced by the graph channel itself, an attacker capable of manipulating graph-level representations could potentially redirect this anchor toward adversarial semantics, bypassing the protection offered by the soft prompt.

Methodology: BadSKP

To demonstrate this vulnerability, the authors propose BadSKP, a targeted backdoor attack that exploits the graph-to-prompt interface. Unlike prior attacks that target either the prompt interface or the graph encoder in isolation, BadSKP jointly perturbs graph structure and node attributes to steer the induced soft prompt toward attacker-specified semantics.

The attack operates under two threat models:

Frozen Setting: The attacker poisons the external KG while the graph encoder and soft prompt module remain fixed and clean.
Trojaned Setting: The attacker controls the soft prompt module during pretraining or release, allowing the backdoor to persist even after downstream clean fine-tuning.

BadSKP employs a multi-stage optimization strategy to overcome the challenges of discrete-to-continuous mapping and gradient attenuation in graph aggregation:

Target Embedding Construction: The attacker constructs an adversarial target embedding ( $h_{adv}$ ) in the LLM's latent space. For Denial-of-Service (DoS) attacks, this is an average of hidden states from refusal-inducing prompts. For Irrelevant Answer (IrA) attacks, it is the negative of the clean hidden state to push generation away from the query semantics.
Node-level Embedding Optimization: The attacker optimizes the continuous embeddings of poisoned nodes (including the trigger entity and injected nodes) to steer the graph-derived soft prompt such that the final generation-driving hidden state aligns with $h_{adv}$ .
Input-space Approximation: Since the optimized embeddings are continuous, they must be mapped back to discrete, fluent adversarial node attributes. A greedy search guided by a lightweight auxiliary language model (BERT) is used to find suffixes that maximize the cosine similarity between the resulting text embedding and the optimized target embedding.
Persistence Optimization (Trojaned Setting Only): To ensure the backdoor survives downstream fine-tuning, the attacker optimizes the soft prompt parameters to align the gradients of the backdoor task and the main task (clean QA), ensuring that updates driven by benign data do not erase the backdoor.

Key Contributions

Identification of a Robustness Gap: The paper reveals that soft-prompt KG-enhanced LLMs are significantly more robust to text-level poisoning than textual KG prompting systems.
Mechanistic Interpretation (Semantic Anchoring): The authors introduce "semantic anchoring" to explain this robustness. They demonstrate that graph-derived soft prompts bias the generation-driving hidden state toward query-consistent semantics, effectively suppressing adversarial instructions injected via the text channel.
Proposal of BadSKP: A novel backdoor attack that targets the graph-to-prompt interface. By manipulating the graph structure and node attributes, BadSKP successfully redirects the semantic anchor, hijacking the latent representation.
Empirical Validation: Extensive experiments across four datasets (WebQSP, CWQ) and two victim models (G-Retriever, GNP) with various LLM backbones (LLaMA2/3, Mistral, Qwen) and GNN encoders.

Experimental Results

The evaluation demonstrates that BadSKP achieves high attack success rates (ASR) where text-only attacks fail:

Frozen Setting: BadSKP achieves ASR > 0.70 for DoS and > 0.88 for IrA across all trigger entities and models. In contrast, text-only baselines (ACPI and GCG) achieve near-zero ASR for DoS and significantly lower ASR for IrA, confirming the failure of text-only attacks against soft prompts.
Trojaned Setting: BadSKP maintains high effectiveness (ASR up to 1.00) even after the soft prompt module undergoes clean fine-tuning, whereas text-only attacks remain ineffective.
Generalization: The attack remains robust across different GNN architectures (GCN, GAT, Graph Transformer) and LLM backbones, suggesting the vulnerability is structural to the graph-text fusion mechanism rather than specific to a model.
Defense Evasion: BadSKP remains effective against perplexity-based filtering defenses. The authors note that because the adversarial suffixes are synthesized to be locally fluent, they often pass perplexity checks. Furthermore, aggressive filtering degrades the accuracy (ACC) of benign queries.

Significance and Claims

The paper claims that the intrinsic robustness of soft prompts is not a security guarantee. While soft prompts effectively neutralize surface-level textual attacks by anchoring generation to query semantics, this very mechanism creates a new attack surface: the graph-to-prompt interface.

The significance of this work lies in:

Redefining the Attack Surface: It shifts the focus from textual poisoning to the manipulation of graph-level representations in soft-prompt systems.
Mechanism-Based Defense: The authors propose that effective defense requires monitoring the "anchoring strength" (the similarity between the generation-driving hidden state and query tokens) rather than relying solely on text sanitization.
Supply Chain Risk: The results highlight the risk of distributing trojaned soft prompt modules, where the backdoor can persist even after downstream users attempt to fine-tune the model on clean data.

The authors conclude that the graph-to-prompt interface constitutes a critical security boundary that warrants dedicated defenses beyond conventional text-level analysis.