一句话：AURA 向专有知识图谱预注入看似合理的虚假信息，使被盗图谱对攻击者不可用，授权用户则可用密钥高效过滤。
GraphRAG 已成为用专有知识图谱增强大模型的基础架构，其中的知识图谱往往是企业核心知识产权，面临被窃取后在隔离环境中私自使用的风险。此类私有化使用场景使水印等被动防御失效（检测需访问输出），而强密码学方案又因开销过高难以满足可靠软件的性能要求。本文提出 AURA：一种基于数据掺假的主动防御框架，在知识图谱中预先注入看似合理但实为虚假的掺假数据，使攻击者检索到的上下文被污染并产生事实性错误回答；授权用户则凭借密钥与加密元数据标签，在送入 LLM 前高效过滤全部掺假项，保证查询结果完全准确。评估显示，AURA 将未授权系统的准确率降至 5.3%，同时对授权用户保持 100% 的保真度且开销可忽略；面对清洗攻击仍能保留 80.2% 的掺假数据，具有较强鲁棒性。
Graph Retrieval-Augmented Generation (GraphRAG) has emerged as a foundational architecture for modern intelligent software systems, enhancing Large Language Models (LLMs) with proprietary Knowledge Graphs (KGs) in knowledge-intensive and automated tasks. As these KGs often represent an organization's highly valuable intellectual property (IP), they face a significant risk of theft for private use. In this scenario, attackers operate in isolated environments. This private-use threat renders passive defenses like watermarking ineffective, as they require output access for detection. Simultaneously, the strict performance requirements of dependable software operations make strong cryptographic solutions, which incur prohibitive overhead, impractical. To address these challenges, we propose AURA, a novel framework based on Data Adulteration designed to make any stolen KG unusable to an adversary. Our framework pre-emptively injects plausible but false adulterants into the KG. For an attacker, these adulterants deteriorate the retrieved context and lead to factually incorrect responses. For authorized users, a secret key enables the efficient filtering of all adulterants via encrypted metadata tags before they are passed to the LLM, ensuring query results remain completely accurate. Our evaluation demonstrates the effectiveness of this approach: AURA degrades the performance of unauthorized systems to an accuracy of just 5.3%, while maintaining 100% fidelity for authorized users with negligible overhead. Furthermore, AURA proves robust against sanitization attempts, retaining 80.2% of adulterants.
@inproceedings{abs-2601-00274,
title = {Making Theft Useless: Adulteration-Based Protection of Proprietary Knowledge Graphs in GraphRAG Systems},
author = {Weijie Wang and Peizhuo Lv and Yan Wang and Weiqing Huang and Rujie Dai and Guokun Xu and Qiujian Lv and Hangcheng Liu and Hao Hu and Jiaheng Zhang},
booktitle = {ASE},
year = {2026},
doi = {10.1145/3832783.3837418}
}