Retrieval-Augmented Generation (RAG) enhances LLMs by grounding generation in query-relevant external evidence. Beyond unstructured text corpora, Graph RAG integrates knowledge graphs into the retrieval pipeline, enabling LLMs to access entities, relations, and multi-hop dependencies encoded in structured knowledge. However, the same structured knowledge that empowers Graph RAG also creates a new privacy attack surface. We demonstrate that Graph RAG systems can be turned into structural oracles: through adaptive black-box interactions, an adversary can elicit sufficient relational evidence to reconstruct substantial portions of the hidden knowledge graph. We propose a structure-oriented reconstruction framework that recovers targeted graphs from both local and global perspectives. Specifically, Depth-Wise Heuristic Search extracts fine-grained node attributes by recursively expanding entity-centered evidence, while Breadth-Wise Diffusion Search infers graph topology by propagating across relation-induced neighborhoods. Experiments on generic and healthcare scenarios demonstrate that our method can recover over 90\% of the original knowledge graph from representative Graph RAG systems, revealing sensitive entities, relations, and structural dependencies with high fidelity. Existing guradrails provide limited defense against our attack, highlighting the inherent difficulty of safeguarding structural privacy in Graph RAG pipelines.

翻译：摘要：检索增强生成（RAG）通过将生成过程锚定在与查询相关的外部证据上，增强了大型语言模型（LLM）的能力。除无结构化文本语料库外，图RAG将知识图谱集成到检索流程中，使LLM能够访问结构化知识中编码的实体、关系及多跳依赖关系。然而，赋予图RAG能力的结构化知识也创造了新的隐私攻击面。我们证明，图RAG系统可被转化为结构化预言机：通过适应性黑盒交互，攻击者能够获取足够的关联证据，以重建隐藏知识图谱的绝大部分内容。我们提出一种面向结构的重建框架，可从局部与全局两个维度恢复目标图谱。具体而言，深度方向启发式搜索通过递归扩展以实体为中心的关联证据来提取细粒度节点属性，而广度方向扩散搜索则通过跨关系诱导邻域传播来推断图拓扑。在通用与医疗场景下的实验表明，我们的方法能从代表性图RAG系统中恢复超过90%的原始知识图谱，以高保真度揭示敏感实体、关系及结构依赖关系。现有防护机制对我们的攻击提供的防御有限，这凸显了在图RAG流程中保护结构隐私的固有难度。