Characterizing the blast radius of triple level poisoning attacks in knowledge graph retrieval augmented generation systems

KG-RAG (Knowledge Graph RAG) systems link entities by typed relational edges and support multi-hop reasoning chains in which one corrupted fact can spread across many inference paths at once. In this paper, we formally define and quantitatively assess the blast radius (corrupted queries per injected triple) of three triple-level poisoning strategies on Knowledge Graph RAG: edge poisoning, hub poisoning, and chain poisoning. Experiments on a biomedical knowledge graph built with Microsoft GraphRAG v0.3.6 and Gemma 2 9B show hub poisoning reaches a blast radius of 14.0× , against 7.0× for edge poisoning and 4.0× per triple for chain poisoning, from a $$0%$$ pre-poisoning baseline. Two-hop queries show the steadiest effect, and cascade corruption exceeds direct impact in every condition. We implement a graph-aware defense based on a degree-weighted trust score that uses entity centrality as a proxy for injection risk. At the reported operating point the filter queues the hub injection and $$4.1%$$ of baseline triples, and does not queue the edge or chain injections.