Aegis: Searching for and Defending Against Harmful Ontology Edits in Ontology-Grounded Retrieval

Code Manual

Highlights

• At equal harm evaluations, the bandit search finds chains up to 64% more harmful than greedy and beam search on XRD, and reaches beam's best on MatProc and mouse anatomy with 200 evaluations and no spread across seeds.
• Best-response locking is never worse than locking the highest-impact triples, and leaves 0.133 residual harm where they leave 0.400; ten locks remove all of a two-action attacker's harm on four real ontologies.

Abstract

Retrieval over a knowledge graph is shaped by its ontology: the ontology decides which nodes match a query, which edges may be followed, and what an answer means. An attacker who edits a few ontology triples, and no graph facts, can therefore change what an agent retrieves and answers. This white paper asks two adversarial questions. Attack: given a query workload, a library of edit operators, and a budget of k actions, which chain of edits does the most harm? Harm is not submodular in the edits, so greedy search carries no guarantee; Aegis searches the tree of chains with UCT, a bandit at every node. Protection: given a budget of M triples the defender may lock, which locks minimize the harm of the attacker's best response? Aegis locks triples one at a time against the attacker's current best chain, on a transactional ontology store that logs every edit with its undo, detects the first harmful commit, and rolls back.

Cite

@misc{nguyen2026aegis,
  title  = {Aegis: Searching for and Defending Against Harmful Ontology Edits in Ontology-Grounded Retrieval},
  author = {Nguyen, Lam and Mehdi, Redad and French, Roger H. and Wu, Yinghui},
  year   = {2026},
  note   = {White paper},
  url    = {https://github.com/lamng3/aegis}
}