Knowledge Graph Retrieval-Augmented Generation (KG-RAG) extends the RAG paradigm by incorporating structured knowledge from knowledge graphs, enabling Large Language Models (LLMs) to perform more precise and explainable reasoning. While KG-RAG improves factual accuracy in complex tasks, existing KG-RAG models are often severely overconfident, producing high-confidence predictions even when retrieved sub-graphs are incomplete or unreliable, which raises concerns for deployment in high-stakes domains. To address this issue, we propose Ca2KG, a Causality-aware Calibration framework for KG-RAG. Ca2KG integrates counterfactual prompting, which exposes retrieval-dependent uncertainties in knowledge quality and reasoning reliability, with a panel-based re-scoring mechanism that stabilises predictions across interventions. Extensive experiments on two complex QA datasets demonstrate that Ca2KG consistently improves calibration while maintaining or even enhancing predictive accuracy. The source code can be found at~ https://aisuko.github.io/ca2kg/.
论文检索
输入标题、作者或关键词，从 15,207 篇学术成果中精准定位
Large Language Models (LLMs) power numerous AI applications, yet updating their knowledge remains costly. Model editing provides a lightweight alternative through targeted parameter modifications, with meta-learning-based model editing (MLME) demonstrating strong effectiveness and efficiency. However, we find that MLME struggles in low-data regimes and incurs high training costs due to the use of KL divergence. To address these issues, we propose Efficient Multi-Step Edit (EMSEdit), which leverages multi-step backpropagation (MSBP) to effectively capture gradient-activation mapping patterns within editing samples, performs multi-step edits per sample to enhance editing performance under limited data, and introduces norm-based regularization to preserve unedited knowledge while improving training efficiency. Experiments on two datasets and three LLMs show that EMSEdit consistently outperforms state-of-the-art methods in both sequential and batch editing. Moreover, MSBP can be seamlessly integrated into existing approaches to yield additional performance gains. Further experiments on a multi-hop reasoning editing task demonstrate EMSEdit's robustness in handling complex edits, while ablation studies validate the contribution of each design component. Our code is available at https://github.com/xpq-tech/emsedit.
Dual History Enhancement with Hybrid Hypergraph-Graph Networks for Temporal Knowledge Graph Reasoning
PDF ↗Temporal Knowledge Graph (TKG) reasoning seeks to predict future events by analyzing historical data, where the effective leverage of both local and global historical facts proves crucial. Existing approaches employ graph neural networks (GNNs) and recurrent neural networks (RNNs) for local evolution patterns, complemented by statistical methods to enhance attention to global facts, demonstrating efficient predictive capabilities. However, traditional GNNs, constrained by their low-order neighborhood aggregation design, inherently fail to model potential high-order dependencies among facts. Furthermore, existing global history modeling approaches may introduce irrelevant historical information that interferes with prediction tasks. To address these limitations, we propose a Dual History-aware HyperGraph Network for TKG reasoning, namely DHHGN. Specifically, for local history modeling, we design a hybrid hypergraph-graph joint recurrent convolution module that simultaneously captures low-order neighborhood information and high-order interaction patterns among entities, employing a gating mechanism to adaptively blend their contributions. For global history modeling, we propose a dual history enhancement module that amplifies attention on pivotal historical facts while ensuring holistic integration of all historical contexts. Extensive experiments on four public benchmarks validate that DualHist-HGN consistently outperforms existing state-of-the-art methods across TKG reasoning tasks.
With the rapid growth of multi-modal content on the Web, robust vision-language models are essential for semantic understanding and classification of web images under diverse and dynamic contexts, supporting Web applications such as multimedia search and recommendation. Prompt learning has proven effective for enhancing vision-language models in semantic image classification tasks. However, previous methods often suffer from poor generalization: the learned prompts tend to overfit the base classes seen during training, leading to poor performance on unseen classes and under distribution shifts. This issue is especially challenging in Web-scale data, where new classes emerge and distributions shift dynamically. To address these limitations, we propose PLIKD, a novel prompt learning method that integrates instance-aware knowledge distillation for robust Web-scale semantic image classification. Specifically, PLIKD introduces an instance-aware knowledge extraction module, which leverages multi-modal large language models through a step-by-step strategy to extract external knowledge for each image instance. To incorporate this extracted knowledge, PLIKD further introduces an instance-aware knowledge distillation module, which consists of two key steps: (1) a dual-teacher strategy for robust and informative knowledge distillation, and (2) fine-grained cross-modal alignment via Smooth and Sparse Optimal Transport. Extensive experiments demonstrate that PLIKD significantly improves generalization to both seen and unseen classes, and remains robust under distribution shifts, outperforming existing state-of-the-art methods on Web-scale semantic image classification.
Multi-domain knowledge graph completion (MKGC) aims to improve missing triple prediction in a target KG by transferring knowledge from other support KGs. Existing methods typically enforce consistency constraints on equivalent entities across KGs to transfer knowledge, which risks suppressing domain-specific contextual information of entities. This design can also compromise entity representation information from all KG domains, impeding performance improvements, especially in low-resource data scenarios. To address this, we pioneer a generation-based paradigm for MKGC and propose DMKGC, a conditional diffusion-guided knowledge transfer framework. Our key insight is to treat each KG as a partial view of the entity entire information, and generate informative domain-general entity embeddings through diffusion models conditioned on support KGs. Particularly, we first initialize domain-agnostic entity embeddings as prior entity embeddings, and then encode them within individual KGs. Afterward, we fuse equivalent entities from support KGs as the conditional diffusion generation guidance. We leverage the prior entity embeddings as the proxy generation objective, which ensures this conditional generation to be unbiased towards any conditioned KGs. Simultaneously, we also train the generated embeddings to be predictive across KGs, thus preserving domain-specific information. Extensive experiments on 14 KGs in 3 benchmarks demonstrate a 4.3% average MRR improvement in tail entity prediction over state-of-the-art methods, with sustained gains in low-resource data settings.
CausalSKyHop: Knowledge-Aware Causal Explanation of Dynamic GNNs via Higher-Order Semantic Reasoning
Dynamic Graph Neural Networks (DyGNNs) are widely used to model web-scale semantic-rich graph data (e.g., social networks, knowledge graphs), but their inability to explain predictions ground-ed in structured knowledge remains a challenge, especially when predictions rely on complex higher-order substructures. We propose CausalSKyHop, a semantic- and knowledge-aware framework that explains DyGNNs by uncovering causal higher-order patterns in evolving knowledge structures. To model the semantic fabric of the graph, CausalSKyHop incorporates a Higher-Order Structural Causal Model to capture multi-node knowledge dependencies, and uses contrastive learning to isolate semantically-meaningful causal relationships from spurious ones. A dynamic correlation module further separates persistent knowledge from evolving semantic contexts. Through knowledge-infused, structure-aware variational graph autoencoders, our method produces interpretable causal subgraphs that capture the dynamic flow of knowledge and semantics. Experimental evaluations on multiple web and knowledge-rich graph benchmarks demonstrate that CausalSKyHop consistently outperforms state-of-the-art explainable DyGNNs, achieving notable improvements in both explanation fidelity and downstream prediction accuracy. A detailed case study further illustrates how our method uncovers stable, semantically coherent causal pathways—in contrast to the fragmented explanations of baseline methods—providing intuitive evidence for its superior interpretability. This work establishes the critical role of explicit semantic and knowledge integration through higher-order causal reasoning for building transparent and trustworthy DyGNNs on the web.
The explosive growth of multimodal web data demands communication that transmits meaning rather than raw bits. Existing semantic-communication systems often fail under noise, missing modalities, and distribution shifts because they optimize surface features instead of modality-invariant knowledge. We present Grasp, a knowledge-centric framework for cross-modal communication. Grasp segments streams into semantic blocks and builds a graph over them; a lightweight Graph Neural Networks (GNN) produces schedulable, importance-weighted representations. At its core is knowledge purification : we minimize a conditional mutual information upper bound to perform a three-way disentanglement—strongly related, weakly related, and task-irrelevant components—so that only essential semantics are transmitted while non-essential factors are suppressed. To maintain synchrony, we introduce one-to-two temporal contrastive learning to achieve triple alignment of video, audio, and text despite sampling asynchrony. For efficient transmission, Grasp uses a cross-modal shared vector-quantization codebook—a discrete knowledge codebook —updated by multimodal attention. At the receiver, a soft-recovery mechanism leverages this shared knowledge to robustly reconstruct semantics under low signal-to-noise ratio (SNR) or missing modalities, yielding graceful degradation. Across web tasks—including cross-modal retrieval and missing-modality inference—Grasp improves knowledge consistency, semantic fidelity, and downstream performance over strong baselines while maintaining low latency. These results show that communication structured around purified knowledge is key to building robust, semantic-aware systems for the modern web.
As knowledge and semantics on the web grow increasingly complex, enhancing Large Language Models (LLMs)' comprehension and reasoning capabilities has become particularly important. Chain-of-Thought (CoT) prompting has been shown to enhance the reasoning capabilities of LLMs. However, it still falls short on logical reasoning tasks that rely on symbolic expressions and strict deductive rules. Neuro-symbolic methods address this gap by enforcing formal correctness through external solvers. Yet these solvers are highly format-sensitive, and small instabilities in model outputs can lead to frequent processing failures. The LLM-driven approaches avoid parsing brittleness, but they lack structured representations and process-level error-correction mechanisms. To further enhance the logical reasoning capabilities of LLMs, we propose MatrixCoT, a structured CoT framework with a matrix-based plan. Specifically, we normalize and type natural language expressions and attach explicit citation fields, and introduce a matrix-based planning method to preserve global relations among steps. The plan thus becomes a verifiable artifact and execution becomes more stable. For verification, we also add a feedback-driven replanning mechanism. Under semantic-equivalence constraints, it identifies omissions and defects, rewrites and compresses the dependency matrix, and produces a more trustworthy final answer. Experiments on five logical-reasoning benchmarks and five LLMs show that, without relying on external solvers, MatrixCoT enhances both the robustness and interpretability of LLMs when tackling complex symbolic reasoning tasks, while maintaining competitive performance.
Multi-modal knowledge graphs (MMKGs) enrich traditional knowledge graphs by incorporating heterogeneous modalities such as textual descriptions and visual content, offering complementary semantic cues for knowledge reasoning. However, existing approaches often overlook the structural dependencies within each modality, apply static or coarse-grained fusion strategies, and insufficiently model relational semantics. We propose a Multi-Granularity Multi-Modal Knowledge Graph Representation Learning Method via Subgraph-aware Adaptive Fusion and Hierarchical Relation Modeling (SAFER ), which implement multi-modal knowledge representation through adaptive fusion of multi-granularity information such as multi-modal semantics, knowledge structures and relations. SAFER explicitly constructs modality-specific subgraphs and employs structure-aware graph attention networks to effectively capture intra-modal structural dependencies. We propose an adaptive multi-modal fusion mechanism, which aggregates modality-specific embeddings at the semantic level by dynamically assigning entity-specific modality weights. We design a two-stage multi-granularity knowledge relation modeling strategy, which utilizes a structure-aware multi-modal adaptive pre-fusion to preserve topological information and a relation-aware graph attention network (RGAT) post-fusion to encode relational semantics. Extensive experiments on several benchmark datasets demonstrate that the proposed SAFER significantly outperforms competitive baselines on link prediction and relation reasoning tasks.
Knowledge Graph Question Answering (KGQA) aims to answer natural language questions by reasoning over structured knowledge graphs (KGs). While large language models (LLMs) have advanced KGQA through their strong reasoning capabilities, existing methods continue to struggle to fully exploit both the rich knowledge encoded in KGs and the reasoning capabilities of LLMs, particularly in complex scenarios. They often assume complete KG coverage and lack mechanisms to judge when external information is needed, and their reasoning remains locally myopic, failing to maintain coherent multi-step planning, leading to reasoning failures even when relevant knowledge exists. We propose Graph-RFT, a novel two-stage reinforcement fine-tuning KGQA framework with a ''plan–KGsearch–and–Websearch–during–think'' paradigm, that enables LLMs to perform autonomous planning and adaptive retrieval scheduling across KG and web sources under incomplete knowledge conditions. Graph-RFT introduces a chain-of-thought (CoT) fine-tuning method with a customized plan–retrieval dataset activates structured reasoning and resolves the GRPO cold-start problem. It then introduces a novel plan–retrieval guided reinforcement learning process integrates explicit planning and retrieval actions with a multi-reward design, enabling coverage-aware retrieval scheduling. It employs a Cartesian-inspired planning module to decompose complex questions into ordered sub-questions, and logical expression to guide tool invocation for globally consistent multi-step reasoning. This reasoning–retrieval process is optimized with a multi-reward combining outcome and retrieval-specific signals, enabling the model to learn when and how to combine KG and web retrieval effectively. Experiments on multiple KGQA benchmarks demonstrate that Graph-RFT achieves superior performance over strong baselines, even with smaller LLM backbones, and substantially improves complex question decomposition, factual coverage, and tool coordination.
Temporal Knowledge Graph Completion (TKGC) aims to predict missing entities or relations based on historical facts, thereby facilitating the understanding of dynamic system evolution and supporting downstream reasoning tasks. However, existing methods predominantly focus on modeling sequential and structural dependencies, often overlooking the rich semantic information embedded in entities and relations, as well as the higher-order interactions among them, which limits their ability to handle complex, evolving scenarios effectively. To address these limitations, we propose DSTAG, a novel TKGC approach based on a semantic tag-enhanced dual-graph convolutional network. Our method leverages large language models to generate contextualized semantic multi-tags for both entities and relations (e.g., ''political event,'' ''economic activity''), thereby enriching their semantic representations. Furthermore, we introduce a semantic tag representation mechanism that captures higher-order dependencies during the aggregation and propagation of semantic tag information across graphs. DSTAG adopts a dual-graph convolutional network architecture, where the relation graph convolution extracts semantic features between temporal relationships and injects this information into the entity graph convolution, enabling joint modeling of entities and relations. We evaluate DSTAG on three widely used TKG benchmarks: ICEWS14, ICEWS18, and ICEWS05-15. Experimental results show that DSTAG achieves substantial MRR improvements over state-of-the-art baselines by 8.64%, 9.81% and 4.56%, respectively.
Deductive and abductive reasoning are two critical paradigms for analyzing knowledge graphs, enabling applications from financial query answering to scientific discovery. Deductive reasoning on knowledge graphs usually involves retrieving entities that satisfy a complex logical query, while abductive reasoning generates plausible logical hypotheses from observations. Despite their clear synergistic potential, where deduction can validate hypotheses and abduction can uncover deeper logical patterns, existing methods address them in isolation. To bridge this gap, we propose DARK, a unified framework for Deductive and Abductive Reasoning in Knowledge graphs. As a masked diffusion model capable of capturing the bidirectional relationship between queries and conclusions, DARK has two key innovations. First, to better leverage deduction for hypothesis refinement during abductive reasoning, we introduce a self-reflective denoising process that iteratively generates and validates candidate hypotheses against the observed conclusion. Second, to discover richer logical associations, we propose a logic-exploration reinforcement learning approach that simultaneously masks queries and conclusions, enabling the model to explore novel reasoning compositions. Extensive experiments on multiple benchmark knowledge graphs show that DARK achieves competitive performance on both deductive and abductive reasoning tasks, demonstrating the significant benefits of our unified approach.
Entity alignment (EA) is to identify equivalent entities across different knowledge graphs (KGs), which can help fuse these KGs into a more comprehensive one. Previous EA methods mainly focus on aligning a pair of KGs, and to the best of our knowledge, no existing EA method considers aligning multiple (more than two) KGs. To fill this research gap, in this work, we study a novel problem of aligning multiple KGs and propose an effective framework named MultiEA to solve the problem. First, we embed the entities of all the candidate KGs into a common feature space by a shared KG encoder. Then, we explore three alignment strategies to minimize the distances among pre-aligned entities. In particular, we propose an innovative inference enhancement technique to improve the alignment performance by incorporating high-order similarities. Finally, to verify the effectiveness of MultiEA, we construct two new real-world benchmark datasets and conduct extensive experiments on them. The results show that our MultiEA can effectively and efficiently align multiple KGs in a single pass. We release the source code at: https://github.com/wzCSDN/MultiEA.
Open-source ecosystems such as NPM and PyPI are increasingly targeted by supply chain attacks, yet existing detection methods either depend on fragile handcrafted rules or data-driven features that fail to capture evolving attack semantics. We present IntelGuard, a retrieval-augmented generation (RAG) based framework that integrates expert analytical reasoning into automated malicious package detection. IntelGuard constructs a structured knowledge base from over 8,000 threat intelligence reports, linking malicious code snippets with behavioral descriptions and expert reasoning. When analyzing new packages, it retrieves semantically similar malicious examples and applies LLM-guided reasoning to assess whether code behaviors align with intended functionality. Experiments on 4,027 real-world packages show that IntelGuard achieves 99% accuracy and a 0.50% false positive rate, while maintaining 96.5% accuracy on obfuscated code. Deployed on PyPI.org, it discovered 54 previously unreported malicious packages, demonstrating interpretable and robust detection guided by expert knowledge.
Phishing is a threat in which attackers masquerade as legitimate entities to steal sensitive data. While understanding the phishing ecosystem is critical for developing effective countermeasures, prior research has largely studied phishing through post-attack data, with limited examination of the attacker's perspective and how phishing campaigns are built. Critically, the Deep and Dark Web (D2Web) serves as the primary marketplace and knowledge-sharing platform where attackers acquire phishing tools (e.g., phishing kits), exchange techniques, and trade compromised credentials. Analyzing D2Web forums therefore provides unique visibility into the supply chain of phishing attacks pre-deployment, enabling proactive understanding of emerging threats and attack methodologies. This study addresses this gap through a comprehensive analysis of 394,034 posts (343,334 unique) collected from 13 D2Web forums spanning 2013 to 2025, from which 70,055 phishing-related posts are identified. We employ a LLM-based approach to efficiently extract key information, including phishing attack components (e.g., credentials, phishing pages, SMTP servers), targeted services (e.g., PayPal, Netflix), and component authors. This extracted data is mapped to a seven-stage attack scenario framework derived from empirical case studies. Our analysis reveals longitudinal trends in component availability, target service distribution, post type evolution, and the most active contributors annually, while characterizing pricing dynamics across different attack components. The results provide the first attacker-centric, macro-level longitudinal analysis of the phishing ecosystem, offering insights into how phishing infrastructure and markets have evolved over more than a decade. These findings contribute to a deeper understanding of the phishing supply chain and inform more effective detection and prevention strategies.
Finality gadget is a critical component in modern blockchain systems. Ever since Ethereum used the Casper finality gadget, many variants of finality approaches have been adopted to make it possible to finalize blocks, i.e., when a block is finalized, its order will never be reversed. In this work, we study the finality approach by VeChainThor, the consensus protocol of VeChain blockchain. We propose greedy attack, an attack in which a block proposed by an honest sealer can be finalized with a probability of only 0.19%. We validate our results via theoretical analysis and extensive experimentation. Our findings have been disclosed and acknowledged by the VeChain team, and we are currently working with them to improve the VeChainThor protocol.
With the growing importance of content safety, toxic language detection, especially in Chinese online environments, has become a key task in natural language processing. However, real-world toxic expressions often appear in obfuscated forms such as pinyin abbreviations, symbol insertion, or visually similar substitutions, making them difficult to detect using traditional rule-based or static models. To address this challenge, we propose a dynamic knowledge graph construction method for toxic text variants, named Variant-KG. This graph encodes diverse structural relations between canonical toxic terms and their variants based on phonetic similarity, visual resemblance, and contextual co-occurrence. A small amount of labeled data is further used to fine-tune large language models (LLMs), enabling initial normalization and variant recognition. On top of this, we design a collaborative detection framework that combines the Variant-KG with frozen LLMs. It performs graph augmented prompting for structure-aware reasoning and adopts a Think-Search-Generate paradigm to dynamically recover broken paths when graph connections are incomplete, enabling both data self-enhancement and knowledge completion during inference. Evaluations on multiple Chinese toxic language datasets show that our model consistently outperforms both non-knowledge-enhanced and existing knowledge-enhanced baselines, demonstrating the effectiveness of our proposed dynamic reasoning framework in handling diverse toxic expressions.
The real-time demand for web security makes Security Information and Event Management (SIEM) platforms and their applied security rule an integral part of the intrusion detection life-cycle. However, the heterogeneity of vendor-specific rules (e.g., Splunk SPL, Microsoft KQL, IBM AQL, Google YARA-L, and RSA ESA) makes cross-platform rule reuse extremely difficult, requiring deep domain knowledge for reliable conversion. As a result, an autonomous and accurate rule conversion framework can significantly lead to effort savings, preserving the value of existing rules. In this paper, we propose ARuleCon, an agentic SIEM-rule conversion approach. Using ARuleCon, the security professionals do not need to distill the source rules' logic and re-map it to target vendors, instead, they provide the source rules, the documentation of the target rules and ARuleCon can purposely convert to the target vendors without more intervention. To achieve this, ARuleCon is equipped with intermediate representation (IR) that aligns core detection logic into vendor-neutral layer, agentic RAG pipeline that retrieves authoritative official vendor documentation to address the convension/schema mismatches, and Python-based consistency check that running both source and target rules in controlled test environments to mitigate subtle semantic drifts. We present a comprehensive evaluation of ARuleCon ranging from textual alignment between the source and target rules, and the execution success of target rules, showcasing ARuleCon can convert rules with higher fidelity, outperforming the baseline LLM models by 15% averagely. Finally, we perform a case study and interview with our industry collaborators 1, which showcases that ARuleCon can significantly save the expert's time on understanding the cross-SIEM's documentation and remapping the logic.
While Tor's strong anonymity shields users' privacy, it also enables malicious activities, motivating attacks that bypass its protections. Website Fingerprinting (WF) has emerged as a primary threat in this domain. However, existing WF methods struggle with realistic multi-tab browsing scenarios, often relying on prior knowledge of the number of open tabs and lacking robustness against network noise and defenses. To address these challenges, we propose Forge, a robust WF attack framework inspired by the classic cocktail party problem. Specifically, Forge reframes multi-tab WF as a task of Blind Source Separation(BSS), decomposing mixed traffic into individual signals without requiring a predefined number of concurrent tabs. A robust website identifier then classifies separated components using a dual-domain attention mechanism across time and frequency, allowing Forge to effectively resist WF defenses and network noise. We evaluate our model on a comprehensive collection of datasets covering open-world, defense-enabled, and dynamic scenarios. The results demonstrate that Forge can improve Mean Average Precision by 78.6% over the state-of-the-art average in the challenging multi-tab open-world scenario.
LLM-powered agents are evolving from passive recommenders into autonomous executors, leveraging tools via the Model Context Protocol (MCP) for web automation. However, this paradigm introduces a new vulnerability: tool poisoning attacks that manipulate the MCP context can corrupt an agent's reasoning. Existing methods focus on anomaly detection and lack autonomous correction mechanisms, hindering their real-world deployment. In this paper, we introduce MCPFixGen, to the best of our knowledge, the first framework to provide automated anomaly detection and correction. We tackle three fundamental challenges: (1) when to initiate anomaly inspection with minimal overhead, (2) what features effectively characterize abnormality, and (3) how to automatically execute remedial actions. MCPFixGen achieves this through a novel multi-checkpoint rollback mechanism for anomaly management. MCPFixGen proposes a multi-checkpoint rollback anomaly management mechanism. Strategically places checkpoints at high-risk operations based on the tools-calling risk distribution. Then it identifies unanticipated tool behaviors by leveraging the correlation between attention activation values and tool calls. Finally, it introduces an attention-mask-based backtracking and correction mechanism. By masking the root cause of the anomaly, the LLM is prompted to re-infer, facilitating efficient and low-cost anomaly resolution. Our evaluation on real-world datasets demonstrates that MCPFixGen reduces interruptions caused by anomalies to below 13%, decreases the success rate of tool poisoning attacks to less than 0.3%, and significantly improves the robustness, computational efficiency, and task completion rate of web intelligence applications compared to existing approaches.