Versatile AI Risk Assessment

AI threat catalogue Application and Integration Security Production

Graph-RAG Poisoning (Knowledge Graph Injection)

Some AI systems ground their answers in a knowledge graph, a network of concepts and their relationships (Graph RAG). Attackers insert false nodes or links and thereby deliberately shift the system's conclusions.

As of: October 2026 · Catalogue version 2026.10.24.2 · 7 mitigations · 5 verified sources

Description

Graph RAG extends the retrieval approach of RAG (retrieval-augmented generation): instead of fetching only text passages, the system follows a knowledge graph in which facts are stored as nodes (such as people, products, events) and their relationships as edges. Attackers with write access to the graph, or to the data pipelines that feed it, insert fabricated nodes and false relationships or shift existing links. Because the model follows these connections when reasoning, a single manipulated relationship distorts many answers: the forgery inherits the credibility of the whole graph. The mechanism corresponds to poisoning a knowledge base, but targets the structure of relationships rather than individual documents.

Possible impact

The system draws systematically wrong conclusions with wide reach, since one manipulated relationship affects every query that traverses it. Individual forged edges are hard to find among millions of genuine entries. Decisions, reports and automated processes built on the graph inherit the errors.

Example

A corporation maintains a knowledge graph of suppliers and their certifications, which an AI assistant uses for procurement decisions. An attacker inserts a false link presenting their company as a certified supplier; from then on the assistant recommends it as a vetted source.

Recommended mitigations (7)

Compare effects and implementation levels. Expand each entry for the additional classification and rationale.

  • Knowledge graph integrity validation

    Technical
    Effect
    Detective
    Implementation level
    Data
    Classification and rationale

    Primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators.

  • Provenance tracking per node/edge

    Technical
    Effect
    Detective
    Implementation level
    Data
    Classification and rationale

    Complementary control typeOrganizational & process-based

    Primarily technical: Cryptographic or machine-verifiable properties protect confidentiality, integrity, or provenance; complemented by binding workflows.

  • Graph anomaly detection

    Technical
    Effect
    Detective
    Implementation level
    Data
    Classification and rationale

    Primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators.

  • Access control on graph write operations

    Technical
    Effect
    Preventive
    Implementation level
    Data, Application, API & agents
    Classification and rationale

    Complementary control typeOrganizational & process-based

    Primarily technical: Machine-enforced identity, permission, or scope rules constrain unauthorized access and actions; complemented by binding workflows.

  • Multi-source corroboration of relationships

    Technical
    Effect
    Preventive, Detective
    Implementation level
    Data
    Classification and rationale

    Primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators.

  • Versioned knowledge graph snapshots

    Technical
    Effect
    Impact-limiting, Restorative
    Implementation level
    Data
    Classification and rationale

    Primarily technical: Versioned states or rollback mechanisms enable controlled recovery.

  • Regular graph audits

    Organizational & process-based
    Effect
    Detective
    Implementation level
    Data, Use & operations
    Classification and rationale

    Complementary control typeGovernance & compliance

    Primarily organizational and process-based: A planned, repeatable assessment with ownership and documented follow-up creates the protective effect; complemented by rules and oversight.

Framework mappings

Verified locations in OWASP, NIST AI RMF, MITRE ATLAS, the EU AI Act and further frameworks. The mappings are taxonomic, not evidence of compliance.

OWASP LLM Top 10 LLM05:2026NIST AI RMF NISTAML.015 · NISTAML.027EU AI Act Article 9(1), 9(2)(a), 9(2)(d)BSI R18

Verified references (5)

Every reference states the framework, the exact location and the publishing organisation.

EU AI Act obligations related to this threat

The obligations from the obligations compass whose articles the catalogue maps to this threat. Each leads to its entry with core, action step and evidence; whether it applies to you depends on role and risk class.

  • Establish and operate a risk management system Art. 9 · applies from Annex III: 2 December 2027 · Annex I: 2 August 2028

    Statutory roles: Provider, Product manufacturer. Classes: High-risk under Annex III, High-risk as a product or safety component.

    This reference is a review prompt. A threat match alone does not establish applicability.

All 62 obligations by role, risk class and deadline in the obligations compass

Terms on this page

Glossary terms that occur in this entry. Every link leads to the full explanation.

More entries from the topic group Application and Integration Security.

Insecure Output Handling The application passes an AI model's answers to downstream systems without checks, for example to databases, web pages or command lines. Insecure Tool Design Many AI applications act on their own through connected tools, for example sending emails or querying databases. Application Vulnerabilities The software around the AI model, meaning its web interface, APIs and databases, has the same weaknesses as any other application.

Matching use cases

This list shows where to review this threat, rather than how high the risk is.

For 2 further use cases, relevance depends on the system design, for example whether it uses a knowledge graph. Show these use cases

Frequently asked questions

What is Graph-RAG Poisoning (Knowledge Graph Injection)?
Some AI systems ground their answers in a knowledge graph, a network of concepts and their relationships (Graph RAG). Attackers insert false nodes or links and thereby deliberately shift the system's conclusions.
Which mitigations help against Graph-RAG Poisoning (Knowledge Graph Injection)?
The catalogue lists 7 mitigations, each with control type, effect and implementation level. First among them are Knowledge graph integrity validation, Provenance tracking per node/edge and Graph anomaly detection.
Which EU AI Act obligations does Graph-RAG Poisoning (Knowledge Graph Injection) touch?
The catalogue maps this threat to Art. 9 of the EU AI Act. In the obligations compass this leads to: Establish and operate a risk management system. Whether an obligation applies depends on role, risk class and deadline.

Assess this threat in your own system

The live demo contains all 52 threats of this catalogue, including the EU AI Act and GDPR assessment. The free single modules cover AI risk, the EU AI Act and GDPR. No sign-up; the assessment runs locally in your browser.

Start the live demo See the free modules

Cite this entry

For reports, policies or internal documents; the link leads directly to this entry.

“Graph-RAG Poisoning (Knowledge Graph Injection)”. Versatile AI Risk Assessment, AI threat catalogue, as of October 2026.
https://www.versatile-ai-risk-assessment.com/en/wissensbasis/threats/graph-rag-poisoning/

← Back to the full catalogue