ML Security PapersSubgraph Reconstruction Attacks on Graph RAG Deployments with Practical Defenses
Minkyoo Song 1, Jaehan Kim 1, Myungchul Kang 2,1, Hanna Kim 1, Seungwon Shin 1, Sooel Son 1
Published on arXiv
2602.06495
Sensitive Information Disclosure
OWASP LLM Top 10 — LLM06
Key Finding
GRASP achieves up to 82.9 F1 in type-faithful subgraph reconstruction against four safety-aligned LLMs where all prior extraction methods fail under realistic prompt-based safeguards.
GRASP
Novel technique introduced
Graph-based retrieval-augmented generation (Graph RAG) is increasingly deployed to support LLM applications by augmenting user queries with structured knowledge retrieved from a knowledge graph. While Graph RAG improves relational reasoning, it introduces a largely understudied threat: adversaries can reconstruct subgraphs from a target RAG system's knowledge graph, enabling privacy inference and replication of curated knowledge assets. We show that existing attacks are largely ineffective against Graph RAG even with simple prompt-based safeguards, because these attacks expose explicit exfiltration intent and are therefore easily suppressed by lightweight safe prompts. We identify three technical challenges for practical Graph RAG extraction under realistic safeguards and introduce GRASP, a closed-box, multi-turn subgraph reconstruction attack. GRASP (i) reframes extraction as a context-processing task, (ii) enforces format-compliant, instance-grounded outputs via per-record identifiers to reduce hallucinations and preserve relational details, and (iii) diversifies goal-driven attack queries using a momentum-aware scheduler to operate within strict query budgets. Across two real-world knowledge graphs, four safety-aligned LLMs, and multiple Graph RAG frameworks, GRASP attains the strongest type-faithful reconstruction where prior methods fail, reaching up to 82.9 F1. We further evaluate defenses and propose two lightweight mitigations that substantially reduce reconstruction fidelity without utility loss.
Key Contributions
- GRASP: a closed-box, multi-turn subgraph reconstruction attack that reframes extraction as a context-processing task, uses per-record identifiers to reduce hallucinations, and employs a momentum-aware query scheduler to operate under strict query budgets
- Empirical demonstration that existing attacks expose exfiltration intent and are easily suppressed by lightweight safe prompts, while GRASP bypasses these safeguards to achieve up to 82.9 F1 across four safety-aligned LLMs and multiple Graph RAG frameworks
- Two lightweight defense mitigations that substantially reduce reconstruction fidelity without degrading RAG utility