Researchers Manipulate Stolen Data to Corrupt AI Models and Generate Inaccurate Outputs

Cybersecurity: AURA Framework for Knowledge Graph Protection

Researchers from the Chinese Academy of Sciences and Nanyang Technological University have developed AURA, a novel framework designed to protect proprietary knowledge graphs (KGs) in GraphRAG systems from theft and unauthorized use.

The study, available on arXiv, describes how introducing fake yet plausible data into KGs renders stolen copies ineffective for attackers while maintaining full functionality for authorized users.

AURA employs a devaluation approach by injecting "adulterants," or false data, into critical nodes of the KG. This strategy involves selecting key nodes using the Minimum Vertex Cover (MVC) method, which is adaptively solved with Integer Linear Programming (ILP) for small graphs or the Malatya heuristic for larger graphs, ensuring minimal changes cover all edges.

To ensure structural and semantic plausibility, adulterants are created using link prediction models like TransE and RotatE, combined with large language models (LLMs). The Semantic Deviation Score (SDS), calculated as the Euclidean distance in sentence embeddings, identifies the most impactful adulterants per node.

AES-encrypted metadata flags allow authorized systems to filter these adulterants post-retrieval, achieving provable IND-CPA security.

Testing on datasets such as MetaQA, WebQSP, FB15k-237, and HotpotQA with models including GPT-4o and Llama2-7B demonstrated a 94-96% Harmfulness Score (HS) in flipping correct answers to incorrect ones and a 100% Adulterant Retrieval Rate (ARR).

Adulterants effectively bypassed detection methods (ODDBALL: 4.1%, Node2Vec: 3.3%) and sanitization systems (SEKA: 94.5% retention, KGE: 80.2%). Multi-hop reasoning showed an increased HS, maintaining robustness across various retrievers and frameworks like Microsoft's GraphRAG.

Ablation studies highlighted the advantages of hybrid generation, as LLM-only methods are prone to structural checks, while link-prediction-only methods face semantic challenges. A single adulterant per node was sufficient for achieving over 94% high scores, with additional adulterants offering marginal benefits.

Limitations of AURA include issues with node text descriptions and insider distillation risks, which can be mitigated through API controls. AURA represents a shift towards "active degradation" for KG intellectual property protection, differing from offensive poisoning or passive watermarking techniques.

As GraphRAG adoption grows, companies like Microsoft, Google, and Alibaba are investing in tools like AURA to enhance enterprise protection against data theft in the AI era.

Based on reporting by Cyber Security News.