The paper introduces STAG, a stealthy trojan attack framework targeting Graph Foundation Models (GFMs) that operate on text‑attributed graphs (TAGs). STAG jointly generates graph triggers and soft‑prompt text cues so that both modalities converge to a malicious target class while keeping the trigger subgraph structurally similar to the original and the trigger text readable. Experiments on several TAG datasets and GFMs confirm that STAG achieves high attack success rates while remaining difficult to detect.
By Minhua Lin, Zhicheng Gao, Yilong Wang, Hanqing Lu, Xiang Zhang, Suhang Wang
arXiv:2607. 18567v1 Announce Type: new Abstract: A graph foundation model generalizes across graph domains by mapping every input into one shared representation before any task reasoning.
By Pankaj Kumar, Subhankar Mishra
arXiv:2607. 06807v1 Announce Type: cross Abstract: While enabling effective collaboration on complex tasks, LLM-based Multi-Agent Systems (MAS) face critical security challenges due to vulnerabilities at the agent and interaction levels.
By Haowen Xu, Xue Tan, Lei Ma, Zhihao Zhang, Chao Wang, Qingze Wang, Ping Chen, Jun Dai, Xiaoyan Sun
arXiv:2605. 01133v3 Announce Type: replace-cross Abstract: Large language model (LLM)-powered multi-agent systems (MAS) enable agents to communicate and share information, achieving strong performance on complex tasks.
By Lingxi Zhang, Guangtao Zheng, Hanjie Chen
arXiv:2607. 07903v1 Announce Type: cross Abstract: Large language models (LLMs) exhibit remarkable capabilities but remain highly vulnerable to adversarial prompts and jailbreak attacks.
By Anupam Wagle, Ifrat Ikhtear Uddin, Chaowei Zhang, Longwei Wang
FedGraph is a graph-based aggregation framework designed to defend federated large language model fine-tuning against backdoor attacks. It exploits the observation that malicious clients produce consistently similar updates, while benign clients generate diverse ones, by modeling client updates as nodes in a dynamically constructed graph and extracting structural features. The resulting compact client representations enable effective identification and suppression of malicious contributions, achieving high detection accuracy and low false positives in extensive experiments.
By Xi Chen, Chunyi Zhou, Rui Zeng, Xiaogang Xu, Zhe Liu, Shouling Ji
The paper introduces the Hop-Decayed Influence (HDI) attack, which targets auxiliary schema-level structures—semantic summaries, hierarchical edges, and pre-computed scores—used in GraphRAG pipelines for retrieval prioritisation. By propagating query-aware influence, HDI identifies high-impact targets and corrupts a minuscule fraction (as low as 0.016%) of these structures, achieving an 88–94% success rate across HotpotQA and 2WikiMultiHopQA benchmarks on Microsoft GraphRAG and HippoRAG2 architectures. The modifications affect up to six queries each, yielding a 1:N amplification that instance-level attacks cannot achieve, and they evade perplexity and paraphrase defenses with over 99% evasion, exposing a structural blind spot in current GraphRAG defenses.
By Jisung Park, John Le, Heath Cooper
arXiv:2609.37567v1 Announce Type: cross
Abstract: Driven by the rapid advancement of large language models (LLMs), LLM-based multi-agent systems (MAS) have emerged as a powerful paradigm for collabor...
By Longzhu He, Zelang Wen, Xinfeng Li, Sen Su, XiaoFeng Wang
arXiv:2606. 14517v1 Announce Type: cross Abstract: LLM-based guardrails have emerged as a highly effective defense against prompt injection and jailbreak attacks in autonomous agents.
By Yuguang Zhou, Xunguang Wang, Pingchuan Ma, Zhantong Xue, Zhaoyu Wang, Shuai Wang
GraphRAG-LTM is a Layered Threat Modeling framework designed to evaluate security vulnerabilities in Graph Retrieval-Augmented Generation (GraphRAG). It introduces three nested attacker access levels—BB Query, WB Query, and Graph-aware WB—that manipulate query ranking, retriever gradients, and graph evidence to degrade answer quality. Experiments across datasets, retrievers, and LLM backbones show that rank feedback alone lowers answer quality, gradient access amplifies query attacks, and deleting bridge triplets further disrupts multi‑hop evidence propagation.
By Yining Tang, Junyu Zhang, Haomiao Qiu, Yongchao Liu, Jiajun Zheng, Zhao Wang, Ziyue Qiao, Chao Wu
The paper introduces the Cancerous Backdoor Attack, a novel backdoor technique for large language models that activates gradually through multiple hidden stages rather than a single trigger-response. It uses invisible tokens to embed intermediate stages into the model’s reasoning process and a stage controller to monitor the attack’s progression during inference. Experiments on various reasoning datasets show that this method consistently corrupts model outputs over time and outperforms existing backdoor baselines.
By Tahmid Imtiaz Imu, Emama Nahid, Prodipta Sen Amartya, Ahsanul Jobayer, Yutong Song, Jiang Wu, Pengfei Zhang, Honghui Xu
arXiv:2608.29054v1 Announce Type: new
Abstract: Graph Neural Networks (GNNs) have emerged as a cornerstone for representing complex relational dependencies in diverse multimedia tasks, particularly i...
By Shuomin Xue, Jingyuan Li, Ju Jia, Jingxuan Yu, Xiaojun Jia