Blast Radius Characterization of Triple-Level Poisoning Attacks in Knowledge Graph Retrieval-Augmented Generation Systems

Imagine the internet as a giant, chaotic library where every book is a piece of information. For a long time, computers trying to answer questions (like our super-smart AI assistants) would just grab the single most similar book from a shelf, read it, and guess the answer. It was like asking a librarian for a recipe and getting a random cookbook that happened to have the word "chicken" on the cover. But recently, scientists started building a different kind of library: a Knowledge Graph. Instead of just piles of books, this library is a massive, glowing web where every fact is a node (a dot) and every relationship is a string connecting them. If you ask about "chicken," the system doesn't just find a book; it follows the strings to see what the chicken eats, what diseases it might carry, and what recipes use it. This is called Retrieval-Augmented Generation (RAG). It's like giving the AI a map instead of just a list of words, allowing it to reason through complex chains of facts.

However, this new web-like library has a scary new weakness. In the old book-shelf system, if someone slipped a fake page into one book, only the people looking for that specific book would get fooled. But in a web of connected dots, if you poison one single string in the middle of the map, that lie can travel down dozens of different paths at once. It's like dropping a single drop of red dye into the center of a river; suddenly, every stream, pond, and waterfall connected to that river turns pink. This paper investigates exactly how far that "dye" spreads. The researchers wanted to know: if a bad actor injects just one lie into this connected web, how many different questions will the AI get wrong because of it? They call this the "Blast Radius." It's a measure of how much damage one tiny mistake can cause when the system is built on a tangled web of connections.

The Big Experiment: How Far Does the Poison Spread?

The authors of this paper set up a digital experiment to measure this "Blast Radius" in a very specific, high-stakes environment: a medical knowledge graph. They used a system called Microsoft GraphRAG powered by an AI model named Gemma 2 9B, feeding it a collection of real medical abstracts about things like cancer, diabetes, and viruses.

To test the system, they didn't try to trick the AI with complex code or secret passwords. Instead, they played a game of "structural sabotage." They injected three different types of fake facts (called "triples") into the graph to see how the damage spread:

1. The "Edge" Attack: They planted a lie about a minor, obscure medical fact (like a specific drug for a rare condition) that only had a few connections to other facts.
2. The "Hub" Attack: They targeted a superstar medical fact—a "Hub"—that is connected to dozens of other things. In their experiment, they chose p53, a famous protein that is a central character in cancer research, connecting to genes, diseases, and treatments everywhere. They injected a lie saying p53 causes tumors instead of stopping them.
3. The "Chain" Attack: They created a fake story made of three connected lies, linking four different medical topics together in a chain that didn't exist in real life.

The Shocking Results: One Lie, Fourteen Mistakes

The results were a wake-up call. The researchers found that the shape of the web matters more than the content of the lie.

• The "Edge" Attack: When they lied about the minor, obscure fact, the damage was contained. For every one lie they injected, the AI gave 7 wrong answers. The poison spread, but it stayed mostly local.
• The "Hub" Attack: This is where things got wild. When they injected just one lie about the super-connected protein p53, the blast radius exploded. That single false fact caused the AI to give 14 wrong answers. This means the "Hub" attack was twice as dangerous as the Edge attack, even though they only used one piece of fake data. The lie didn't just stay with p53; it traveled through the web, corrupting answers about cancer treatments, gene therapy, and drug mechanisms that the user never even asked about p53 directly.
• The "Chain" Attack: When they built the fake chain of three lies, the damage was deep but slightly less explosive per lie (about 4 wrong answers per lie). However, it was very good at tricking the AI on complex, multi-step questions.

The "Two-Hop" Sweet Spot

One of the most interesting discoveries was which questions got messed up the most. The researchers tested questions that required the AI to take one step (1-hop), two steps (2-hop), or three steps (3-hop) through the web to find an answer.

They found that two-step questions were the most vulnerable. It seems that when the AI has to jump over one intermediate fact to get to the answer, it's most likely to stumble into the poisoned zone. In the Hub attack, 6 out of 10 two-step questions were corrupted. The "Cascade Effect" was real: the AI didn't just get the direct question wrong; it got the consequences of that lie wrong, too. In fact, in every scenario, the "cascade" damage (indirectly affected answers) was much larger than the "direct" damage (answers that explicitly mentioned the lie).

Why This Matters and How to Fix It

The paper concludes that in a Knowledge Graph, location is everything. If you poison a quiet corner of the library, it's a small problem. If you poison the main intersection where all the roads meet, the whole city gets lost. This is a huge problem for fields like medicine, law, and business, where a single wrong fact could lead to a bad diagnosis or a wrong legal strategy.

To fight back, the authors propose a new defense called "Degree-Weighted Trust Scoring." Imagine a security guard at the library entrance. Instead of just reading the book to see if it's fake, this guard looks at the author and the topic. If a new fact is about a "Hub" (a super-connected entity like p53), the guard gets very suspicious and flags it for a human to double-check before letting it into the system. If the fact is about a minor, obscure topic, the guard lets it pass quickly. This way, the system focuses its energy on protecting the most dangerous parts of the map.

In short, this paper shows us that while connecting our AI's knowledge into a web makes it smarter, it also makes it more fragile. A single lie in the right (or wrong) place can ripple out and confuse the system in ways we didn't expect, turning a small mistake into a massive disaster.