Knowledge Graph Poisoning: How Attackers Corrupt RAG at the Source

Retrieval-augmented generation has a trust model, whether you designed one or not. Whatever the retriever returns is treated as ground truth by the generator. With vector RAG, that trust is diffused across thousands of ephemeral chunks — a poisoned chunk surfaces for a query, maybe resurfaces, and eventually drowns in re-indexing. With graph RAG, trust gets a permanent address: a node with relationships, a triple in a curated ontology, a fact that traverses the graph into every answer that touches it.

That durability is the entire engineering argument for knowledge graphs. It is also the attack surface. This article maps how knowledge graph poisoning works, why modern graph construction pipelines make it easier, and which defenses hold — because most of the advice floating around treats a graph like a pile of documents, and that is exactly wrong.

Why graphs change the threat model

Three properties distinguish a poisoned knowledge graph from a poisoned corpus:

Persistence. A chunk with a false claim competes with every other chunk at retrieval time. A false triple — (AcmeCorp, acquiredBy, RivalCorp) — competes with nothing. It sits in the graph, indexed, typed, validated against your schema, until someone deletes it. Deletion, not competition, is the remediation model.

Amplification through traversal. Vector retrieval answers the query you asked. Graph retrieval answers along paths you didn't. A poisoned node connected to high-degree hubs propagates into multi-hop queries its attacker never conceived: "which companies did Acme's subsidiaries partner with?" traverses the false edge you planted without ever naming it. The attack surface is the product of the graph's connectivity, not the size of your corpus.

Trust transfer. Graph content looks curated, because it usually is. Schema-validated triples with provenance metadata read as verified fact — to humans reviewing the graph and to LLMs synthesizing answers from it. A well-formed triple inherits the credibility of the pipeline that produced it.

The attack patterns that matter

Entity injection with hub-attachment. The attacker introduces a fake entity and links it to real, high-degree nodes. The fake node is otherwise unremarkable — plausible labels, correct schema types — but its edges make it reachable from everywhere. Detection by isolation fails; the poison hides in plain relational sight.

Relation flipping. Cheaper and harder to spot than injection: take an existing, correct triple and invert or redirect the predicate. (ExecA, boardMemberOf, CompanyB) becomes (ExecA, boardMemberOf, CompanyC). The node types validate, the schema validates, only the fact is wrong. If your write path checks shape and never checks truth, this passes every gate.

Ontology confusion. Introduce a plausible-but-wrong relationship type or class ("subsidiaryOf" vs "partnerOf", or a subtly misspelled property) and let downstream consumers misinterpret legitimately correct data. The graph is intact; its interpretation is poisoned. This attacks the schema contract rather than the data.

Staleness weaponization. The most underrated pattern: a triple that was true when written. Mergers dissolve, executives rotate, CVEs get fixed. An attacker doesn't need to inject anything — they need your graph to keep asserting expired facts with confident timestamps and no expiry semantics. Every answer built on the stale edge is wrong, and every provenance record says "verified."

Extraction-time laundering. Where do most enterprise graphs come from now? LLM-powered extraction over crawled documents, emails, and wikis. The extractor is a prompt, and prompts accept instructions — deliberately planted or organically repeated claims in source documents become triples with no verification step. If your extraction prompt says "extract all acquisitions mentioned," an attacker only needs one authoritative-looking page to say Acme acquired Rival.

Defenses that actually hold

Provenance on every edge — with timestamps and confidence, not just sources. The minimum viable provenance is (source, extraction_method, timestamp, confidence) per triple. Without it, "which claims came from the untrusted crawl?" is unanswerable. With it, poisoning remediation becomes a query, not an archaeology project.

Write-path gates proportional to hub proximity. Not all writes are equal. An edit touching a node with degree > 100 deserves friction that a leaf node never sees: schema validation plus entity-resolution deduplication plus a human review queue. Attackers optimize for the path of least resistance; make the hub-adjacent path resistant.

Read-path corroboration for consequential claims. Before an answer asserts an acquisition, a board membership, or a security relationship, require the fact to be corroborated by N independent provenance sources or fall back to "unverified." This is the graph equivalent of the two-source rule in journalism, and like journalism, it is precisely the step automated pipelines skip.

Temporal semantics. Every fact gets a valid-from and — where the domain allows — a valid-until. Staleness weaponization dies when triples expire instead of lurking. For high-churn domains (corporate, security, infrastructure), this is not optional hardening; it is correctness.

Monitoring the graph's vital signs. New-node velocity per source, edit rates around hub nodes, distribution shifts in predicate usage. Poisoning campaigns have shape: bursts of edits, unusual relation types, clusters of new entities that all connect to the same few hubs. A weekly graph-diff review catches what per-write validation misses.

The uncomfortable comparison

A supply-chain attacker who wants to corrupt what an organization knows now has two targets: the document corpus or the knowledge graph built from it. We have a decade of institutional memory about corpus attacks — the Miasma worm's exploitation of dependency trust graphs was the same lesson in a different layer: trust flows along edges, and edges are where you defend.

Graph RAG is more ambitious than vector RAG, and its defenses must be too. The good news: graphs make provenance cheap — every fact already has an address, so stamping it costs nothing structurally. The bad news: most production graph pipelines today have no provenance at all, because the extraction LLM was the whole plan.

Build the write-path gates. Stamp the edges. Watch the deltas. The graph will remember everything anyway — the only question is whether it remembers what happened, or what an attacker wanted it to remember.