Incremental update (`graphrag update`) silently ignores removed documents; they stay indexed and retrievable
メンテナーはふだん 5 日以内に返信
まだ誰も着手していません。
評価
調査の方向性
Start with graphrag/index/update/incremental_index.py and graphrag/index/workflows/load_update_documents.py, then trace how deleted inputs are handled by the update pipeline. Check the update workflow tests for coverage of removal-only changes. Done means removed documents and their derived data are no longer retrievable, or the update clearly warns or fails if removals require a full re-index.
索引モデルが issue の本文から書いたものです。
説明
Describe the bug
In GraphRAG 3.2.0, the incremental update computes which documents were removed from
the input, but never uses that information. The update completes without error, and the
removed documents, together with their text units, entities, relationships and community
reports, stay in the index and remain retrievable by queries.
This was first reported to MSRC (VULN-235383), which confirmed the behavior and classified
it as a functional and data-lifecycle defect rather than a security vulnerability, and
suggested filing it here.
Root cause
graphrag/index/update/incremental_index.py:get_delta_docs()returns anInputDelta
with bothnew_inputsanddeleted_inputs.graphrag/index/workflows/load_update_documents.py:load_update_documents()returns only
delta_documents.new_inputs;deleted_inputsis not referenced anywhere else in the package.- When the only change is a removal, the workflow logs
No new update documents found.and
stops the pipeline normally, so every output table is left unchanged.
Two related effects:
- Each update writes a copy of the previous index, including the removed documents, to
update_output/<timestamp>/previous/. A later full re-index does not touch this directory. - The LLM cache keeps the responses derived from the removed documents, also after a full re-index.
Steps to reproduce
pip install graphrag==3.2.0, thengraphrag init --root ./projand configure a model.- Put
a.txtandb.txtinto./proj/input, whereb.txtcontains a unique fact,
e.g.Alice Costa's badge number is Q7F9K2P1XZ3A. graphrag index --root ./proj- Delete
./proj/input/b.txtand rungraphrag update --root ./proj.
The run succeeds; the log showsNo new update documents found. ./proj/output/documents.parquetstill listsb.txt,text_units.parquetstill contains
the badge number, and
graphrag query --root ./proj --method local --query "What is Alice Costa's badge number?"
still returns it../proj/update_output/<timestamp>/previous/*.parquetand./proj/cache/also contain
b.txt's content.
In a larger experiment (10 synthetic people, 20 background people, Qwen2.5-7B-Instruct via
vLLM, local search), all removed documents stayed indexed after the incremental update, and
local search recovered 77% of the removed people's unique facts, the same as before the
removal. After a full re-index, local search recovered none of them, but the LLM cache and
the update backups still contained them.
Expected Behavior
Either
- the incremental update processes
deleted_inputs: it removes those documents and their
text units and recomputes the affected entities, relationships and communities; or - at minimum, it warns or fails when the input has lost documents, and the documentation
states that removing documents requires a full re-index.
It would also help to prune, or document, the update backups and the cache entries that are
derived from removed documents. Operators commonly remove documents to honour data-erasure
requests or to take out incorrect or poisoned content, and a silent success makes them
believe the content is gone.
GraphRAG Config Used
Default settings.yaml from graphrag init, with the completion and embedding models
pointed at local OpenAI-compatible endpoints. The behavior is in the update workflow and
does not depend on the model.
Additional Information
- GraphRAG version: 3.2.0
- Python: 3.12
- OS: Ubuntu 24.04
- Scripts and raw results:
https://anonymous.4open.science/r/Palimpsest-428E/README.md
- 主要言語
- Python
- スター
- 36.6k
- フォーク
- 3.9k
- 平均マージ
- 4日 11時間
- マージ済み PR(30日)
- 1
環境構築
- Dockerfile・Docker Compose ファイルなし
- プルリクエストのテンプレートあり
- コントリビューションガイドを読む
はじめの一歩
- issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
- 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
- リポジトリをフォークし、ブランチを切って変更します。
- issue 番号を参照したプルリクエストを送ります。
microsoft/graphrag のほかの issue
-
難易度 2/5 1〜3時間 初心者へのやさしさ 74/100
microsoft/graphrag#2626 · コメント 1 件 ·
メンテナーはふだん 5 日以内に返信
-
[Bug]: response_format_json_object=True is silently dropped, so JSON mode never reaches the modelオープンbug triage
難易度 2/5 1〜3時間 初心者へのやさしさ 72/100
microsoft/graphrag#2625 · コメント 1 件 ·
メンテナーはふだん 5 日以内に返信
-
難易度 1/5 1時間未満 初心者へのやさしさ 95/100
メンテナーはふだん 5 日以内に返信
-
[Bug]: JsonCache.get() crashes with unhandled AttributeError on non-dict or invalid envelope JSON payloads再び着手できるかも このイシューのプルリクエストはマージされずにクローズされました。 オープン
難易度 2/5 1〜3時間 初心者へのやさしさ 82/100
microsoft/graphrag#2614 · コメント 2 件 ·
メンテナーはふだん 5 日以内に返信
-
[Bug]: JSONLinesFileReader drops rows containing U+2028, U+2029 or U+0085 (uses str.splitlines)オープン
難易度 2/5 1〜3時間 初心者へのやさしさ 85/100
microsoft/graphrag#2594 · コメント 1 件 ·
メンテナーはふだん 5 日以内に返信
microsoft/graphrag の issue をすべて見る
似ている issue
-
難易度 2/5 1〜3時間 初心者へのやさしさ 66/100
deepchem/deepchem#5289 · コメント 1 件 ·
メンテナーはふだん 2 日以内に返信
-
難易度 1/5 1時間未満 初心者へのやさしさ 75/100
-
難易度 2/5 1〜3時間 初心者へのやさしさ 60/100
UKGovernmentBEIS/inspect_evals#2892 · コメント 1 件 ·
メンテナーはふだん 1 日以内に返信
-
Versioning docs: say that no output from the 0.46 warning check means nothing is affected対応中かも @grelinfo が今日担当しました。 オープンdocumentation priority:low size:S
難易度 1/5 1時間未満 初心者へのやさしさ 72/100
メンテナーはふだん 1 日以内に返信
-
難易度 1/5 1時間未満 初心者へのやさしさ 88/100
alphacrack/readme2demo#293 ·