AI threat catalogueApplication and Integration SecurityProduction
Graph-RAG Poisoning (Knowledge Graph Injection)
Some AI systems ground their answers in a knowledge graph, a network of concepts and their relationships (Graph RAG). Attackers insert false nodes or links and thereby deliberately shift the system's conclusions.
Description
Graph RAG extends the retrieval approach of RAG (retrieval-augmented generation): instead of fetching only text passages, the system follows a knowledge graph in which facts are stored as nodes (such as people, products, events) and their relationships as edges. Attackers with write access to the graph, or to the data pipelines that feed it, insert fabricated nodes and false relationships or shift existing links. Because the model follows these connections when reasoning, a single manipulated relationship distorts many answers: the forgery inherits the credibility of the whole graph. The mechanism corresponds to poisoning a knowledge base, but targets the structure of relationships rather than individual documents.
Possible impact
The system draws systematically wrong conclusions with wide reach, since one manipulated relationship affects every query that traverses it. Individual forged edges are hard to find among millions of genuine entries. Decisions, reports and automated processes built on the graph inherit the errors.
Example
A corporation maintains a knowledge graph of suppliers and their certifications, which an AI assistant uses for procurement decisions. An attacker inserts a false link presenting their company as a certified supplier; from then on the assistant recommends it as a vetted source.
Recommended mitigations (7)
Every mitigation states its control type, effect, implementation level and the reason for the classification.
Knowledge graph integrity validationTechnical
- Effect
- Detective
- Implementation level
- Data
- Reason for the classification
- “Knowledge graph integrity validation” is primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators.
Provenance tracking per node/edgeTechnical
- Effect
- Detective
- Implementation level
- Data
- Complementary control type
- Organizational & process-based
- Reason for the classification
- “Provenance tracking per node/edge” is primarily technical: Cryptographic or machine-verifiable properties protect confidentiality, integrity, or provenance; complemented by binding workflows.
Graph anomaly detectionTechnical
- Effect
- Detective
- Implementation level
- Data
- Reason for the classification
- “Graph anomaly detection” is primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators.
Access control on graph write operationsTechnical
- Effect
- Preventive
- Implementation level
- Data, Application, API & agents
- Complementary control type
- Organizational & process-based
- Reason for the classification
- “Access control on graph write operations” is primarily technical: Machine-enforced identity, permission, or scope rules constrain unauthorized access and actions; complemented by binding workflows.
Multi-source corroboration of relationshipsTechnical
- Effect
- Preventive, Detective
- Implementation level
- Data
- Reason for the classification
- “Multi-source corroboration of relationships” is primarily technical: Software or analytical tools systematically produce and evaluate measurements, deviations, or attack indicators.
Versioned knowledge graph snapshotsTechnical
- Effect
- Impact-limiting, Restorative
- Implementation level
- Data
- Reason for the classification
- “Versioned knowledge graph snapshots” is primarily technical: Versioned states or rollback mechanisms enable controlled recovery.
Regular graph auditsOrganizational & process-based
- Effect
- Detective
- Implementation level
- Data, Use & operations
- Complementary control type
- Governance & compliance
- Reason for the classification
- “Regular graph audits” is primarily organizational and process-based: A planned, repeatable assessment with ownership and documented follow-up creates the protective effect; complemented by rules and oversight.
Framework mappings
Verified locations in OWASP, NIST AI RMF, MITRE ATLAS, the EU AI Act and further frameworks. The mappings are taxonomic, not evidence of compliance.
Verified references (5)
Every reference states the framework, the exact location and the publishing organisation.
- OWASP LLM Top 10 LLM04:2025 Data and Model PoisoningLLM04:2025 Data and Model Poisoning, official category page OWASP FoundationOriginal
- NIST AI RMF NISTAML.015 Indirect Prompt InjectionTaxonomy Index, pp. x–xi; Section 3.4, pp. 50–53; Glossary, p. 110 National Institute of Standards and Technology (NIST)Original
- NIST AI RMF NISTAML.027 Misaligned OutputsTaxonomy Index, p. xi; Section 3.4.2, pp. 51–52 National Institute of Standards and Technology (NIST)Original
- EU AI Act Article 9(1), 9(2)(a), 9(2)(d) Risk management systemArticle 9(1), 9(2)(a), 9(2)(d), read with Article 9(3) European Union (EUR-Lex)Original
- BSI R18 Vergiftung von hinterlegten Wissensdaten (Knowledge Poisoning) (Text, Bild, Video)Kap. 4, R18, p. 26 Bundesamt für Sicherheit in der Informationstechnik (BSI)Original
Terms on this page
Glossary terms that occur in this entry. Every link leads to the full explanation.
- RAG (retrieval augmented generation) The model pulls matching documents from your own knowledge base before answering.
Related threats
More entries from the topic group Application and Integration Security.
Assess this threat in your own system
The live demo contains all 52 threats of this catalogue, including the EU AI Act and GDPR assessment. The free single modules cover AI risk, the EU AI Act and GDPR. No sign-up; the assessment runs locally in your browser.
Cite this entry
For reports, policies or internal documents; the link leads directly to this entry.
“Graph-RAG Poisoning (Knowledge Graph Injection)”. Versatile AI Risk Assessment, AI threat catalogue, as of July 2026. https://www.versatile-ai-risk-assessment.com/en/wissensbasis/threats/graph-rag-poisoning/