---
title: "LogicPoison — paper by Xiao et al. (2026) — summary and ideas"
description: "The authors argue that the real weak point is the graph's topology. 40 references, cited by 1 paper here."
authors: ["Yilin Xiao", "Jin Chen", "Qinggang Zhang", "Yujing Zhang", "Chuang Zhou", "Longhao Yang", "Lingfei Ren", "Xin Yang", "Xiao Huang"]
year: 2026
venue: "Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)"
source: "https://aclanthology.org/2026.acl-long.252/"
doi: "10.18653/v1/2026.acl-long.252"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/xiao-2026-logicpoison-logical-attacks-graph-retrieval/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/xiao-2026-logicpoison-logical-attacks-graph-retrieval/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/14/) / LogicPoison: Logical Attacks on Graph Retrieval-Augmented Generation

# LogicPoison: Logical Attacks on Graph Retrieval-Augmented Generation

**Authors:** [Yilin Xiao](https://md.research.elamur.ai/free/en/authors/yilin-xiao/), Jin Chen, [Qinggang Zhang](https://md.research.elamur.ai/free/en/authors/qinggang-zhang/), Yujing Zhang, [Chuang Zhou](https://md.research.elamur.ai/free/en/authors/chuang-zhou/), Longhao Yang, Lingfei Ren, [Xin Yang](https://md.research.elamur.ai/free/en/authors/xin-yang/) and [Xiao Huang](https://md.research.elamur.ai/free/en/authors/xiao-xia-huang/) · **Year:** 2026 · **Venue:** [Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)](https://md.research.elamur.ai/free/en/venues/acl/) ([ACL 2026](https://md.research.elamur.ai/free/en/venues/acl/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2026.acl-long.252/) · [PDF](https://aclanthology.org/2026.acl-long.252.pdf) · [DOI 10.18653/v1/2026.acl-long.252](https://doi.org/10.18653/v1/2026.acl-long.252) · [OpenAlex](https://openalex.org/W7166829655)

**Citations:** 0 citations (OpenAlex, 2026-10-14) · 1 in our library, of the 149,439 papers whose bibliographies we read

## Summary
GraphRAG systems answer questions by reasoning over a knowledge graph built from a text corpus. They tend to resist classic RAG attacks for three reasons: injected documents end up isolated in the graph, embedded instructions are lost when text becomes entity–relation structures, and redundant paths compensate for local damage. The authors argue that the real weak point is the graph's topology. Their attack, LogicPoison, edits the corpus by swapping entities with others of the same type, using cyclic permutation within type buckets. Sentences stay fluent, but the extracted graph is rewired. Targets come from two sources. The first is frequent "logic hub" entities that hold global connectivity together, a choice motivated by spectral graph arguments. The second is query-specific bridge entities that an LLM identifies through Chain-of-Thought extraction for multi-hop questions. The authors tested the attack on three multi-hop QA benchmarks, three LLMs and three GraphRAG methods. It degrades accuracy more than prior attacks such as GRAGPOISON, costs less in time and tokens, and slips past perplexity filtering and query paraphrasing. The work exposes a structural, hard-to-detect threat to GraphRAG deployments.

## Key points
- Evaluation uses HotpotQA, 2WikiMultiHopQA and MuSiQue. Part of the comparisons fix the backbone LLM to GPT-4o-mini.
- The attack has two target-selection strategies, Global Logic Poison (hub entities) and Query-Centric Logic Poison (reasoning bridges). Both feed a single type-preserving entity-swapping step.
- Perplexity-based detection (tiktoken cl100k_base, 500 clean vs. 500 poisoned texts) reaches only AUC = 0.57, close to random guessing.
- Query paraphrasing as a defense reduces attack effectiveness by less than 1.0%.
- The authors acknowledge two limitations: the attack was tested only on static graphs and English data. Code is available at github.com/Jord8061/logicPoison.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [Hong Kong Polytechnic University](https://md.research.elamur.ai/free/en/universities/hong-kong-polytechnic-university/) — University, Hong Kong, China · 84 works · 4,956 citations
- [Jilin University](https://md.research.elamur.ai/free/en/universities/jilin-university/) — University, Changchun, China · 25 works · 5,252 citations
- [Southwestern University of Finance and Economics](https://md.research.elamur.ai/free/en/universities/southwestern-university-of-finance-and-economics/) — University, Chengdu, China · 4 works · 1 citation

📚 Shelves (4): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 16,667 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 16,194 works · [🎭 Arts and Humanities](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/) · 16,039 works · [🗣️ Language and Linguistics](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/language-and-linguistics/) · 15,891 works

🧭 Topics (1): [🔍 Information retrieval & search](https://md.research.elamur.ai/free/en/topics/information-retrieval/) · 473 works

## Cite

Cite as: Yilin Xiao, Jin Chen, Qinggang Zhang, Yujing Zhang, Chuang Zhou, Longhao Yang, Lingfei Ren, Xin Yang and Xiao Huang. 2026. LogicPoison: Logical Attacks on Graph Retrieval-Augmented Generation. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{xiao2026logicpoison,
  title = {{LogicPoison: Logical Attacks on Graph Retrieval-Augmented Generation}},
  author = {Yilin Xiao, Jin Chen, Qinggang Zhang, Yujing Zhang, Chuang Zhou, Longhao Yang, Lingfei Ren, Xin Yang and Xiao Huang},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.252},
  url = {https://doi.org/10.18653/v1/2026.acl-long.252}
}
```

- [← previous Logic Haystacks: Probing LLMs' Long-Context Logical Reasoning (Without Easily Identifiable Unrelated Padding)](https://md.research.elamur.ai/free/en/papers/sileo-2026-logic-haystacks-probing-llms-long/)
- [next → LombardoGraphia: Automatic Classification of Lombard Orthography Variants](https://md.research.elamur.ai/free/en/papers/signoroni-2026-lombardographia-automatic-classification-lombard-orthography/)
- [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/14/)

## References

40 references, 15 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Gabriel Alon and Michael Kamfonas. 2023. [Detecting language model attacks with perplexity](https://md.research.elamur.ai/free/en/papers/alon-2023-detecting-language-model-attacks-perplexity/). Preprint, arXiv:2308.14132.
2. Anthropic. 2024. The claude 3 model family: Opus, sonnet, haiku. Claude-3 Model Card. [find](https://scholar.google.com/scholar?q=Anthropic%2E+2024%2E+The+claude+3+model+family%3A+Opus%2C+sonnet%2C+haiku%2E+Claude%2D3+Model+Card%2E)
3. Hezekiah J. Branch, Jonathan Rodriguez Cefalu, Jeremy McHugh, Leyla Hujer, Aditya Bahl, Daniel del Castillo Iglesias, Ron Heichman, and Ramesh Darwishi. 2022. Evaluating the susceptibility of pre-trained language models via handcrafted adversarial examples. Preprint, arXiv:2209.02128. — [arXiv:2209.02128](https://arxiv.org/abs/2209.02128) [find](https://scholar.google.com/scholar?q=Hezekiah+J%2E+Branch%2C+Jonathan+Rodriguez+Cefalu%2C+Jeremy+McHugh%2C+Leyla+Hujer%2C+Aditya+Bahl%2C+Daniel+del+Castillo+Iglesias%2C+Ron+Heichman%2C+and+Ramesh+Darwishi%2E+2022%2E+Evaluating+the+susceptibility+of+pre%2Dtrai)
4. Pengzhou Cheng, Yidong Ding, Tianjie Ju, Zongru Wu, Wei Du, Ping Yi, Zhuosheng Zhang, and Gongshen Liu. 2024. Trojanrag: Retrieval-augmented generation can be backdoor driver in large language models. Preprint, arXiv:2405.13401. — [arXiv:2405.13401](https://arxiv.org/abs/2405.13401) [find](https://scholar.google.com/scholar?q=Pengzhou+Cheng%2C+Yidong+Ding%2C+Tianjie+Ju%2C+Zongru+Wu%2C+Wei+Du%2C+Ping+Yi%2C+Zhuosheng+Zhang%2C+and+Gongshen+Liu%2E+2024%2E+Trojanrag%3A+Retrieval%2Daugmented+generation+can+be+backdoor+driver+in+large+language+models%2E)
5. Gelei Deng, Yi Liu, Yuekang Li, Kailong Wang, Ying Zhang, Zefeng Li, Haoyu Wang, Tianwei Zhang, and Yang Liu. 2024a. Masterkey: Automated jailbreaking of large language model chatbots. In Proc. ISOC NDSS. [find](https://scholar.google.com/scholar?q=Gelei+Deng%2C+Yi+Liu%2C+Yuekang+Li%2C+Kailong+Wang%2C+Ying+Zhang%2C+Zefeng+Li%2C+Haoyu+Wang%2C+Tianwei+Zhang%2C+and+Yang+Liu%2E+2024a%2E+Masterkey%3A+Automated+jailbreaking+of+large+language+model+chatbots%2E+In+Proc%2E+ISOC+N)
6. Gelei Deng, Yi Liu, Kailong Wang, Yuekang Li, Tianwei Zhang, and Yang Liu. 2024b. Pandora: Jailbreak gpts by retrieval augmented generation poisoning. Preprint, arXiv:2402.08416. — [arXiv:2402.08416](https://arxiv.org/abs/2402.08416) [find](https://scholar.google.com/scholar?q=Gelei+Deng%2C+Yi+Liu%2C+Kailong+Wang%2C+Yuekang+Li%2C+Tianwei+Zhang%2C+and+Yang+Liu%2E+2024b%2E+Pandora%3A+Jailbreak+gpts+by+retrieval+augmented+generation+poisoning%2E+Preprint%2C+arXiv%3A2402%2E08416%2E+%E2%80%94+%5BarXiv%3A2402%2E08416%5D%28)
7. Yibing Du, Antoine Bosselut, and Christopher D. Manning. 2022. Synthetic disinformation attacks on automated fact verification systems. In Proceedings of the Thirty-Sixth AAAI Conference on Artificial Intelligence. [find](https://scholar.google.com/scholar?q=Yibing+Du%2C+Antoine+Bosselut%2C+and+Christopher+D%2E+Manning%2E+2022%2E+Synthetic+disinformation+attacks+on+automated+fact+verification+systems%2E+In+Proceedings+of+the+Thirty%2DSixth+AAAI+Conference+on+Artificial)
8. Xanh Ho, Anh-Khoa Duong Nguyen, Saku Sugawara, and Akiko Aizawa. 2020. [Constructing a multi-hop qa dataset for comprehensive evaluation of reasoning steps](https://md.research.elamur.ai/free/en/papers/ho-2020-constructing-multi-hop-qa-dataset/). In Proceedings of the 28th International Conference on Computational Linguistics, pages 6609– 6625, Barcelona, Spain (Online). International Com…
9. Neel Jain, Avi Schwarzschild, Yuxin Wen, Gowthami Somepalli, John Kirchenbauer, Ping yeh Chiang, Micah Goldblum, Aniruddha Saha, Jonas Geiping, and Tom Goldstein. 2023. [Baseline defenses for adversarial attacks against aligned language models](https://md.research.elamur.ai/free/en/papers/jain-2023-baseline-defenses-adversarial-attacks-against/). Preprint, arXiv:2309.00614.
10. Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen-tau Yih, Tim Rocktäschel, Sebastian Riedel, and Douwe Kiela. 2020. [Retrieval-augmented generation for knowledge-intensive nlp tasks](https://md.research.elamur.ai/free/en/papers/lewis-2020-retrieval-augmented-generation-knowledge-intensive/). In Proceedings of the 34th Internation…
11. Jiacheng Liang, Yuhui Wang, Changjiang Li, Rongyi Zhu, Tanqiu Jiang, Neil Gong, and Ting Wang. 2025. Graphrag under fire. Preprint, arXiv:2501.14050. — [arXiv:2501.14050](https://arxiv.org/abs/2501.14050) [find](https://scholar.google.com/scholar?q=Jiacheng+Liang%2C+Yuhui+Wang%2C+Changjiang+Li%2C+Rongyi+Zhu%2C+Tanqiu+Jiang%2C+Neil+Gong%2C+and+Ting+Wang%2E+2025%2E+Graphrag+under+fire%2E+Preprint%2C+arXiv%3A2501%2E14050%2E+%E2%80%94+%5BarXiv%3A2501%2E14050%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2501%2E14)
12. Darren Edge, Ha Trinh, Newman Cheng, Joshua Bradley, Alex Chao, Apurva Mody, Steven Truitt, Dasha Metropolitansky, Robert Osazuwa Ness, and Jonathan Larson. 2025. From local to global: A graph rag approach to query-focused summarization. Preprint, arXiv:2404.16130. [find](https://scholar.google.com/scholar?q=Darren+Edge%2C+Ha+Trinh%2C+Newman+Cheng%2C+Joshua+Bradley%2C+Alex+Chao%2C+Apurva+Mody%2C+Steven+Truitt%2C+Dasha+Metropolitansky%2C+Robert+Osazuwa+Ness%2C+and+Jonathan+Larson%2E+2025%2E+From+local+to+global%3A+A+graph+rag+app)
13. Yi Liu, Gelei Deng, Yuekang Li, Kailong Wang, Zihao Wang, Xiaofeng Wang, Tianwei Zhang, Yepang Liu, Haoyu Wang, Yan Zheng, Leo Yu Zhang, and Yang Liu. 2025. [Prompt injection attack against llm-integrated applications](https://md.research.elamur.ai/free/en/papers/liu-2023-prompt-injection-attack-against-llm/). Preprint, arXiv:2306.05499.
14. Yunfan Gao, Yun Xiong, Xinyu Gao, Kangxiang Jia, Jinliu Pan, Yuxi Bi, Yi Dai, Jiawei Sun, and Haofen Wang. 2023. [Retrieval-augmented generation for large language models: A survey](https://md.research.elamur.ai/free/en/papers/gao-2023-retrieval-augmented-generation-large-language/). arXiv preprint arXiv:2312.10997.
15. Yupei Liu, Yuqi Jia, Runpeng Geng, Jinyuan Jia, and Neil Zhenqiang Gong. 2024. Formalizing and benchmarking prompt injection attacks and defenses. In Proceedings of the 33rd USENIX Conference on Security Symposium, SEC ’24, USA. USENIX Association. [find](https://scholar.google.com/scholar?q=Yupei+Liu%2C+Yuqi+Jia%2C+Runpeng+Geng%2C+Jinyuan+Jia%2C+and+Neil+Zhenqiang+Gong%2E+2024%2E+Formalizing+and+benchmarking+prompt+injection+attacks+and+defenses%2E+In+Proceedings+of+the+33rd+USENIX+Conference+on+Secur)
16. Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Peiyi Wang, Qihao Zhu, Runxin Xu, Ruoyu Zhang, Shirong Ma, Xiao Bi, Xiaokang Zhang, Xingkai Yu, Yu Wu, Z. F. Wu, Zhibin Gou, Zhihong Shao, Zhuoshu Li, Ziyi Gao, Aixin Liu, and 175 others. 2025. Deepseek-r1 incentivizes reasoning in llms through rein… [find](https://scholar.google.com/scholar?q=Daya+Guo%2C+Dejian+Yang%2C+Haowei+Zhang%2C+Junxiao+Song%2C+Peiyi+Wang%2C+Qihao+Zhu%2C+Runxin+Xu%2C+Ruoyu+Zhang%2C+Shirong+Ma%2C+Xiao+Bi%2C+Xiaokang+Zhang%2C+Xingkai+Yu%2C+Yu+Wu%2C+Z%2E+F%2E+Wu%2C+Zhibin+Gou%2C+Zhihong+Shao%2C+Zhuoshu+Li)
17. Bernal Jiménez Gutiérrez, Yiheng Shu, Yu Gu, Michihiro Yasunaga, and Yu Su. 2024. [Hipporag: Neurobiologically inspired long-term memory for large language models](https://md.research.elamur.ai/free/en/papers/gutierrez-2024-hipporag-neurobiologically-inspired-long-term/). In The Thirty-eighth Annual Conference on Neural Information Processing Systems.
18. Bernal Jiménez Gutiérrez, Yiheng Shu, Weijian Qi, Sizhe Zhou, and Yu Su. 2025. From rag to memory: Non-parametric continual learning for large language models. In Forty-second International Conference on Machine Learning. [find](https://scholar.google.com/scholar?q=Bernal+Jim%C3%A9nez+Guti%C3%A9rrez%2C+Yiheng+Shu%2C+Weijian+Qi%2C+Sizhe+Zhou%2C+and+Yu+Su%2E+2025%2E+From+rag+to+memory%3A+Non%2Dparametric+continual+learning+for+large+language+models%2E+In+Forty%2Dsecond+International+Conference)
19. Keegan Hines, Gary Lopez, Matthew Hall, Federico Zarfati, Yonatan Zunger, and Emre Kiciman. 2024. Defending against indirect prompt injection attacks with spotlighting. Preprint, arXiv:2403.14720. — [arXiv:2403.14720](https://arxiv.org/abs/2403.14720) [find](https://scholar.google.com/scholar?q=Keegan+Hines%2C+Gary+Lopez%2C+Matthew+Hall%2C+Federico+Zarfati%2C+Yonatan+Zunger%2C+and+Emre+Kiciman%2E+2024%2E+Defending+against+indirect+prompt+injection+attacks+with+spotlighting%2E+Preprint%2C+arXiv%3A2403%2E14720%2E+%E2%80%94+%5B)
20. Linhao Luo, Zicheng Zhao, Gholamreza Haffari, Dinh Phung, Chen Gong, and Shirui Pan. 2025. GFM-RAG: Graph foundation model for retrieval augmented generation. In The Thirty-ninth Annual Conference on Neural Information Processing Systems. [find](https://scholar.google.com/scholar?q=Linhao+Luo%2C+Zicheng+Zhao%2C+Gholamreza+Haffari%2C+Dinh+Phung%2C+Chen+Gong%2C+and+Shirui+Pan%2E+2025%2E+GFM%2DRAG%3A+Graph+foundation+model+for+retrieval+augmented+generation%2E+In+The+Thirty%2Dninth+Annual+Conference+on+)
21. Meta. 2024. [The llama 3 herd of models](https://md.research.elamur.ai/free/en/papers/grattafiori-2024-llama-3-herd-models/). Preprint, arXiv:2407.21783.
22. OpenAI, :, Aaron Hurst, Adam Lerer, Adam P. Goucher, Adam Perelman, Aditya Ramesh, Aidan Clark, AJ Ostrow, Akila Welihinda, Alan Hayes, Alec Radford, Aleksander M adry, Alex Baker-Whitcomb, Alex Beutel, Alex Borzunov, Alex Carney, Alex Chow, Alex Kirillov, and 401 others. 2024. [Gpt-4o system card](https://md.research.elamur.ai/free/en/papers/openai-2024-gpt-4o-system-card/).…
23. Rodrigo Pedro, Daniel Castro, Paulo Carreira, and Nuno Santos. 2025. From prompt injections to sql injection attacks: How protected is your llm-integrated web application? Preprint, arXiv:2308.01990. — [arXiv:2308.01990](https://arxiv.org/abs/2308.01990) [find](https://scholar.google.com/scholar?q=Rodrigo+Pedro%2C+Daniel+Castro%2C+Paulo+Carreira%2C+and+Nuno+Santos%2E+2025%2E+From+prompt+injections+to+sql+injection+attacks%3A+How+protected+is+your+llm%2Dintegrated+web+application%3F+Preprint%2C+arXiv%3A2308%2E01990%2E+)
24. Boci Peng, Yun Zhu, Yongchao Liu, Xiaohe Bo, Haizhou Shi, Chuntao Hong, Yan Zhang, and Siliang Tang. 2024. [Graph retrieval-augmented generation: A survey](https://md.research.elamur.ai/free/en/papers/peng-2024-graph-retrieval-augmented-generation-survey/). arXiv preprint arXiv:2408.08921.
25. Avital Shafran, Roei Schuster, and Vitaly Shmatikov. 2025. Machine against the rag: jamming retrieval-augmented generation with blocker documents. In Proceedings of the 34th USENIX Conference on Security Symposium, SEC ’25, USA. USENIX Association. [find](https://scholar.google.com/scholar?q=Avital+Shafran%2C+Roei+Schuster%2C+and+Vitaly+Shmatikov%2E+2025%2E+Machine+against+the+rag%3A+jamming+retrieval%2Daugmented+generation+with+blocker+documents%2E+In+Proceedings+of+the+34th+USENIX+Conference+on+Secur)
26. Daniel Spielman. 2012. Spectral graph theory. Combinatorial scientific computing, 18(18). [find](https://scholar.google.com/scholar?q=Daniel+Spielman%2E+2012%2E+Spectral+graph+theory%2E+Combinatorial+scientific+computing%2C+18%2818%29%2E)
27. Xuchen Suo. 2024. Signed-prompt: A new approach to prevent prompt injection attacks against llm-integrated applications. AIP Conference Proceedings, 3194(1):040013. [find](https://scholar.google.com/scholar?q=Xuchen+Suo%2E+2024%2E+Signed%2Dprompt%3A+A+new+approach+to+prevent+prompt+injection+attacks+against+llm%2Dintegrated+applications%2E+AIP+Conference+Proceedings%2C+3194%281%29%3A040013%2E)
28. Harsh Trivedi, Niranjan Balasubramanian, Tushar Khot, and Ashish Sabharwal. 2022. Musique: Multi-hop questions via single-hop question composition. Trans. Assoc. Comput. Linguistics, 10:539–554. [find](https://scholar.google.com/scholar?q=Harsh+Trivedi%2C+Niranjan+Balasubramanian%2C+Tushar+Khot%2C+and+Ashish+Sabharwal%2E+2022%2E+Musique%3A+Multi%2Dhop+questions+via+single%2Dhop+question+composition%2E+Trans%2E+Assoc%2E+Comput%2E+Linguistics%2C+10%3A539%E2%80%93554%2E)
29. Eric Wallace, Shi Feng, Nikhil Kandpal, Matt Gardner, and Sameer Singh. 2019. Universal adversarial triggers for attacking and analyzing NLP. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Proce… [find](https://scholar.google.com/scholar?q=Eric+Wallace%2C+Shi+Feng%2C+Nikhil+Kandpal%2C+Matt+Gardner%2C+and+Sameer+Singh%2E+2019%2E+Universal+adversarial+triggers+for+attacking+and+analyzing+NLP%2E+In+Proceedings+of+the+2019+Conference+on+Empirical+Methods)
30. Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. 2023. [Jailbroken: How does LLM safety training fail?](https://md.research.elamur.ai/free/en/papers/wei-2023-jailbroken-llm-safety-training-fail/) In Thirty-seventh Conference on Neural Information Processing Systems.
31. Yilin Xiao, Junnan Dong, Chuang Zhou, Su Dong, Qian wen Zhang, Di Yin, Xing Sun, and Xiao Huang. 2025. Graphrag-bench: Challenging domain-specific reasoning for evaluating graph retrieval-augmented generation. Preprint, arXiv:2506.02404. — [arXiv:2506.02404](https://arxiv.org/abs/2506.02404) [find](https://scholar.google.com/scholar?q=Yilin+Xiao%2C+Junnan+Dong%2C+Chuang+Zhou%2C+Su+Dong%2C+Qian+wen+Zhang%2C+Di+Yin%2C+Xing+Sun%2C+and+Xiao+Huang%2E+2025%2E+Graphrag%2Dbench%3A+Challenging+domain%2Dspecific+reasoning+for+evaluating+graph+retrieval%2Daugmented+ge)
32. Chang Yang, Chuang Zhou, Yilin Xiao, Su Dong, Luyao Zhuang, Yujing Zhang, Zhu Wang, Zijin Hong, Zheng Yuan, Zhishang Xiang, Shengyuan Chen, Huachi Zhou, Qinggang Zhang, Ninghao Liu, Jinsong Su, Xinrun Wang, Yi Chang, and Xiao Huang. 2026. Graph-based agent memory: Taxonomy, techniques, and applicati… — [arXiv:2602.05665](https://arxiv.org/abs/2602.05665) [find](https://scholar.google.com/scholar?q=Chang+Yang%2C+Chuang+Zhou%2C+Yilin+Xiao%2C+Su+Dong%2C+Luyao+Zhuang%2C+Yujing+Zhang%2C+Zhu+Wang%2C+Zijin+Hong%2C+Zheng+Yuan%2C+Zhishang+Xiang%2C+Shengyuan+Chen%2C+Huachi+Zhou%2C+Qinggang+Zhang%2C+Ninghao+Liu%2C+Jinsong+Su%2C+Xinrun)
33. Zhilin Yang, Peng Qi, Saizheng Zhang, Yoshua Bengio, William Cohen, Ruslan Salakhutdinov, and Christopher D. Manning. 2018. [Hotpotqa: A dataset for diverse, explainable multi-hop question answering](https://md.research.elamur.ai/free/en/papers/yang-2018-hotpotqa-dataset-diverse-explainable-multi/). In Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing, pages 2369…
34. Shenglai Zeng, Jiankun Zhang, Pengfei He, Yiding Liu, Yue Xing, Han Xu, Jie Ren, Yi Chang, Shuaiqiang Wang, Dawei Yin, and Jiliang Tang. 2024. The good and the bad: Exploring privacy issues in retrieval-augmented generation (RAG). In Findings of the Association for Computational Linguistics: ACL 202… [find](https://scholar.google.com/scholar?q=Shenglai+Zeng%2C+Jiankun+Zhang%2C+Pengfei+He%2C+Yiding+Liu%2C+Yue+Xing%2C+Han+Xu%2C+Jie+Ren%2C+Yi+Chang%2C+Shuaiqiang+Wang%2C+Dawei+Yin%2C+and+Jiliang+Tang%2E+2024%2E+The+good+and+the+bad%3A+Exploring+privacy+issues+in+retriev)
35. Qinggang Zhang, Shengyuan Chen, Yuanchen Bei, Zheng Yuan, Huachi Zhou, Zijin Hong, Junnan Dong, Hao Chen, Yi Chang, and Xiao Huang. 2025. [A survey of graph retrieval-augmented generation for customized large language models](https://md.research.elamur.ai/free/en/papers/zhang-2025-survey-graph-retrieval-augmented-generation/). arXiv preprint arXiv:2501.13958.
36. Andy Zou, Zifan Wang, J. Zico Kolter, and Matt Fredrikson. 2023. [Universal and transferable adversarial attacks on aligned language models](https://md.research.elamur.ai/free/en/papers/zou-2023-universal-transferable-adversarial-attacks-aligned/). Preprint, arXiv:2307.15043.
37. Wei Zou, Runpeng Geng, Binghui Wang, and Jinyuan Jia. 2025. {PoisonedRAG}: Knowledge corruption attacks to {Retrieval-Augmented} generation of large language models. In 34th USENIX Security Symposium (USENIX Security 25), pages 3827–3844. [find](https://scholar.google.com/scholar?q=Wei+Zou%2C+Runpeng+Geng%2C+Binghui+Wang%2C+and+Jinyuan+Jia%2E+2025%2E+%7BPoisonedRAG%7D%3A+Knowledge+corruption+attacks+to+%7BRetrieval%2DAugmented%7D+generation+of+large+language+models%2E+In+34th+USENIX+Security+Symposium+)
38. Yilin Xiao, Chuang Zhou, Qinggang Zhang, Bo Li, Qing Li, and Xiao Huang. 2026a. Reliable reasoning path: Distilling effective guidance for llm reasoning with knowledge graphs. IEEE Transactions on Knowledge and Data Engineering, 38(4):2380–2393. [find](https://scholar.google.com/scholar?q=Yilin+Xiao%2C+Chuang+Zhou%2C+Qinggang+Zhang%2C+Bo+Li%2C+Qing+Li%2C+and+Xiao+Huang%2E+2026a%2E+Reliable+reasoning+path%3A+Distilling+effective+guidance+for+llm+reasoning+with+knowledge+graphs%2E+IEEE+Transactions+on+Kno)
39. Yilin Xiao, Chuang Zhou, Yujing Zhang, Qinggang Zhang, Su Dong, Shengyuan Chen, Chang Yang, and Xiao Huang. 2026b. Lag: Logic-augmented generation from a cartesian perspective. Preprint, arXiv:2508.05509. — [arXiv:2508.05509](https://arxiv.org/abs/2508.05509) [find](https://scholar.google.com/scholar?q=Yilin+Xiao%2C+Chuang+Zhou%2C+Yujing+Zhang%2C+Qinggang+Zhang%2C+Su+Dong%2C+Shengyuan+Chen%2C+Chang+Yang%2C+and+Xiao+Huang%2E+2026b%2E+Lag%3A+Logic%2Daugmented+generation+from+a+cartesian+perspective%2E+Preprint%2C+arXiv%3A2508%2E05)
40. An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, Chujie Zheng, Dayiheng Liu, Fan Zhou, Fei Huang, Feng Hu, Hao Ge, Haoran Wei, Huan Lin, Jialong Tang, and 41 others. 2025. [Qwen3 technical report](https://md.research.elamur.ai/free/en/papers/yang-2025-qwen3-technical-report/). Preprint, arXiv:2505.09388.

*Updated 1 November 2026*