BadSKP: Backdoor Attacks on Knowledge Graph-Enhanced LLMs with Soft Prompts
BadSKP is a multi-stage optimization backdoor attack targeting graph-to-prompt interfaces in KG-enhanced LLMs, achieving over 90% success rate.
Key Findings
Methodology
This paper analyzes the robustness gap between textual and soft KG prompts, proposing a multi-stage optimization attack involving adversarial embedding construction, poisoned node embedding refinement, and natural attribute approximation. Experiments on G-Retriever and GNP models across four datasets demonstrate high attack success rates (>90%) and resilience against perplexity defenses. The study reveals that semantic anchoring via graph-derived soft prompts biases generation toward query-relevant semantics, which attackers can manipulate by altering graph structures to redirect this bias, effectively implanting backdoors.
Key Results
- BadSKP achieved over 90% attack success rate on both models, significantly outperforming text-only methods (~20%), and maintained over 80% success under perplexity-based defenses.
- The attack's effectiveness stems from manipulating graph structures and node attributes, which steer the soft prompts and internal representations, demonstrating a powerful new attack vector.
- Multi-stage optimization enhances stealthiness and robustness, enabling the backdoor to persist even after downstream fine-tuning, with minimal impact on model fluency and plausibility.
Significance
This work uncovers a critical security vulnerability in knowledge graph-enhanced LLMs with soft prompts, highlighting that the graph-to-prompt interface can be exploited to embed stealthy backdoors. It advances understanding of adversarial risks in multimodal, structured knowledge systems and informs the development of more resilient models. The findings have broad implications for deploying secure, trustworthy AI in knowledge-intensive applications, emphasizing the need for stronger defenses against graph-based manipulations.
Technical Contribution
The paper introduces a novel multi-stage optimization framework for backdoor injection, combining adversarial embedding construction, graph structure poisoning, and natural attribute approximation. It also proposes the semantic anchoring mechanism, explaining how soft prompts bias generation toward query semantics, which attackers can manipulate. This approach extends the attack surface from traditional text prompts to structured graph inputs, providing a new perspective on model security and attack strategies in multimodal systems.
Novelty
This is the first work to demonstrate a backdoor attack targeting the graph-to-prompt interface in KG-enhanced LLMs. Unlike prior methods focusing on textual prompts or standalone GNNs, it leverages the graph structure to manipulate soft prompts directly, revealing a new vulnerability. The multi-stage optimization strategy and the semantic anchoring concept are innovative contributions that significantly broaden the attack landscape.
Limitations
- The attack assumes white-box access, which may not be realistic in all deployment scenarios, limiting immediate practical applicability.
- The optimization process is computationally intensive, requiring multiple iterations, which could hinder real-time or large-scale attacks.
- Defense strategies need further development; current detection methods like perplexity checks are insufficient against adaptive, graph-based backdoors.
Future Work
Future research should explore black-box attack methods, improve efficiency, and develop robust defenses such as anomaly detection and model fine-tuning strategies. Extending these techniques to real-world, multi-modal, and dynamic knowledge systems will be crucial for understanding and mitigating risks in practical deployments.
AI Executive Summary
Knowledge graphs have become integral to enhancing large language models (LLMs), especially in tasks requiring factual accuracy and reasoning. By integrating structured relational data, models like G-Retriever and GNP can better understand complex queries. However, this integration introduces new security vulnerabilities, particularly through the graph-to-prompt interface. Traditional text-based backdoor attacks are less effective against soft prompts, which leverage semantic anchoring to bias generation toward query-relevant semantics. This robustness, while beneficial, can be exploited by attackers who manipulate graph structures and node attributes to redirect the semantic bias, embedding stealthy backdoors.
This paper presents BadSKP, a sophisticated attack framework that employs multi-stage optimization to craft adversarial graph modifications. It constructs target embeddings, optimizes poisoned node features, and approximates these with natural attributes, ensuring the attack remains covert and effective. Experiments on multiple datasets show that BadSKP achieves over 90% success rates, significantly surpassing traditional text-only methods, and remains resilient under defenses like perplexity detection.
The findings reveal that the graph-to-prompt pathway is a critical security boundary in KG-enhanced LLMs. The semantic anchoring mechanism, which aligns model generation with query semantics, can be manipulated to embed backdoors without degrading model fluency. This work underscores the importance of developing robust defenses against structured knowledge manipulations and highlights the need for ongoing research in secure multimodal AI systems. Despite its strengths, the approach relies on white-box assumptions and involves computationally intensive optimization, suggesting future work should focus on black-box scenarios and efficiency improvements.
Deep Dive
Abstract
Recent knowledge graph (KG)-enhanced large language models (LLMs) move beyond purely textual knowledge augmentation by encoding retrieved subgraphs into continuous soft prompts via graph neural networks, introducing a graph-conditioned channel that operates alongside the standard text interface. However, existing backdoor attacks are largely designed for the textual channel, and their effectiveness against this dual-channel architecture remains unclear. We show that this architecture creates a robustness gap: text-channel backdoor attacks that readily compromise textual KG prompting systems become largely ineffective against soft-prompt-based counterparts. We interpret this gap through semantic anchoring, whereby graph-derived soft prompts bias the generation-driving hidden state toward query-consistent semantics and suppress surface-level malicious instructions. Because this anchoring effect is itself induced by the graph channel, an attacker who manipulates graph-level representations can in turn redirect it toward adversarial semantics. To demonstrate this risk, we propose BadSKP, a backdoor attack that targets the graph-to-prompt interface through a multi-stage optimization strategy: it constructs adversarial target embeddings, optimizes poisoned node embeddings to steer the induced soft prompt, and approximates the optimized representations with fluent adversarial node attributes. Experiments on two soft-prompt KG-enhanced LLMs across four datasets show that BadSKP achieves high attack success under both frozen and trojaned settings, while text-only attacks remain unreliable even under perplexity-based defenses.