LogicPoison
An ACL paper's official code for a logical data-poisoning attack on GraphRAG systems, which swaps entities of the same type to corrupt a corpus's implicit reasoning graph while keeping the poisoned text locally plausible.
LogicPoison attacks GraphRAG systems not by injecting fabricated facts or adversarial instructions, but by perturbing the implicit reasoning topology built from a corpus, through type-preserving entity swapping. It runs in three stages: a global logic poison stage builds corpus-level entity statistics to identify high-frequency entities that act as global logic hubs, a query-centric stage uses query-side reasoning signals to identify bridge entities needed for multi-hop answers, and a final stage bijectively swaps selected entities within the same semantic type, such as one person's name for another's, so the corpus stays grammatically and semantically plausible at the local text level while its reasoning chains are corrupted.
The result is a poisoned corpus that causes GraphRAG systems to follow corrupted reasoning chains and produce incorrect answers, while looking like ordinary text on inspection. The paper was accepted as an oral presentation at ACL 2026, and an enhanced follow-up version is included alongside the original code and its evaluation datasets; it optionally supports GPU acceleration through CuPy.