Knowledge graphsexplained at five levels

Last level we called them bubbles and strings. Time for the real names.

A bubble is an entity. Santiago is an entity. Chile is an entity. So are people, languages, continents — anything you can point at and say "that thing". A string is a relation, and it has a name written on it: capitalOf. Put a head entity, a relation and a tail entity together and you have a triple:

(Q2887, capitalOf, Q298)   # Santiago, capital of, Chile

Those Q codes are not decoration. Real graphs don't store the word "Santiago" as the identity of the thing — the word is ambiguous and language-specific. They store an opaque id and hang labels off it. Wikidata, the graph that feeds a lot of Wikipedia's infoboxes, really does call Santiago Q2887. Open the triple table under the panel and you're looking at the same shape a real graph uses: three columns, one row per fact.

Strings have arrows

Here's the first thing level one lied about by omission. Edges are directed and typed. capitalOf and hasCapital are two different relations pointing opposite ways. Swap the head and tail on capitalOf and you don't get a slightly odd sentence, you get a false one: Chile is not the capital of Santiago. Click a row in the table, hit the flip arrow button, and read what it says. Direction is meaning.

Some relations do survive the flip. borders is symmetric: if Chile borders Argentina then Argentina borders Chile, always. locatedIn is transitive: Santiago in Chile, Chile in South America, therefore Santiago in South America — even though nobody typed that row. Those properties are facts about the relation itself, not about any one pair of entities.

Two kinds of statement

"Santiago is the capital of Chile" is about two specific things. "All capitals are cities" is about every capital that has ever existed or will. You could try to write the second one as a million edges, or you can write it once, as a rule, in a separate layer called the ontology.

Flip show classes in the panel. Class boxes appear beside the entities — City, Country, Place — joined by subclass arrows: Capital ⊑ City ⊑ PopulatedPlace ⊑ Place. Thin edges say which class each entity belongs to. That's the schema. It's a graph too, sitting on top of the facts.

Now flip apply rules. Derived edges appear. Santiago was only ever typed as a City, but a City is a PopulatedPlace, which is a Place — so those types get derived, and the transitive locatedIn hop to South America appears too. Nobody wrote those. A program worked them out from rules you wrote once.

Answers nobody typed

Tap the question chip Which cities are in South America? and watch the panel walk it: start at every entity of class City, follow locatedIn one hop, follow it again. The readout tags each answer ASSERTED if a row in the table says it outright, or DERIVED if the machine reasoned it out. That distinction is the whole point of the level. Turn the rules off and half the answers vanish — the facts didn't change, only what you were allowed to conclude from them.

Last level we called them bubbles, strings and labels. The real words: a knowledge graph is a graph of data intended to accumulate and convey knowledge of the real world, whose nodes represent entities of interest and whose edges represent relations between these entities ¹. Formally it is a set of triples G = {(h, r, t)} over an entity set and a relation set ²³. Our running edge is (Q2887, capitalOf, Q298).

Two data models, not one

The graph model is not fixed. It may be a directed edge-labelled graph — RDF — or a property graph ¹. The difference bites the moment you want to say something about a statement. Santiago has been capital since 1818, and one particular reference vouches for it. In a property graph that is two key/value pairs hanging off the edge. In plain RDF an edge has nowhere to hang anything, so you mint a statement node and point at it — reification:

# RDF: reified statement
:s1 a rdf:Statement ;
    rdf:subject :Q2887 ; rdf:predicate :capitalOf ; rdf:object :Q298 ;
    :start "1818" ; :source <wikidata:Q2887#ref1> .

// Property graph: attributes on the edge itself
(:City {id:'Q2887'})-[:capitalOf {start:1818, source:'wikidata:Q2887#ref1'}]->(:Country {id:'Q298'})

Flip the property-graph view switch in the panel and watch the qualifiers on Santiago's edge migrate between a green statement node and a label on the edge. Same information, four extra triples versus zero.

Querying is relational algebra plus paths

A triple store is a three-column table, so a basic pattern query is a self-join. That part you already know. What graph query languages add is the second half of this sentence: they support not only standard relational operators (joins, unions, projections, etc.), but also navigational operators for recursively finding entities connected through arbitrary-length paths ¹. Arbitrary length is the bit plain SQL-92 cannot express.

# SPARQL
SELECT ?city WHERE {
  ?city :capitalOf ?c . ?c :locatedIn+ :Q18 }

// Cypher, same answer
MATCH (city)-[:capitalOf]->(c)-[:locatedIn*1..3]->(:Q18) RETURN city

Run them side by side in the panel. Then set the path length back to *1..1 and the containment hop that needed two steps disappears: with a fixed-length join you must know the depth in advance. That is the navigational operator earning its keep.

Deduction adds edges nobody wrote

Level 2's "rule" has a name and a formalism. Knowledge splits into simple statements, such as "Santiago is the capital of Chile", which live as edges, and quantified statements, such as "all capitals are cities", which need something more expressive ¹. That something is an ontology or a rule language, which define and reason about the semantics of the terms used to label and describe the nodes and edges ¹³. Turn on RDFS entailment and two rules fire over our data: rdfs:subClassOf transitivity up the Capital ⊑ City ⊑ PopulatedPlace ⊑ Place chain, and transitivity of locatedIn, which materialises (Q2887, locatedIn, Q18). Those rows are marked DERIVED in the binding table. Turn entailment off and the same query returns fewer answers — the query did not change, the semantics did.

The open-world assumption

Your database says NOT EXISTS means false. A knowledge graph does not. There is no edge saying Valparaíso is not the capital of Chile, and there is no edge saying Michelle Bachelet does not speak Spanish; under the open-world assumption both are simply unknown. So FILTER NOT EXISTS answers "not in my graph", never "not true in the world". Tick the OWA check in the panel and any query whose answer depends on absence gets flagged. Deduction only ever adds what follows necessarily — which is why the next level stops deducing and starts predicting.

Last level the graph was something you queried. A query engine only ever returns what someone wrote down, and under the open-world assumption a missing edge means nothing at all. So take the incompleteness seriously and make it the task.

The task, stated properly

Write the graph as a set of triples, G = {(h, r, t)} ⊆ E × R × E ²⁴. Most graphs of this shape are badly incomplete, and completion means inferring the missing links — concretely, predicting the missing head or tail given (h, r) or (r, t) ². You learn a scoring function s(h, r, t) that measures the plausibility of a triple from its embeddings, then rank every candidate entity in the tail slot. That framing is pointwise learning-to-rank ⁴, and it is why your metric is a ranking metric and not accuracy.

Three geometries, one interface

The scoring functions split into translational-distance and semantic-matching families ². Pick a model in the panel and the formula renders above the plot:

# translational
TransE   s = −‖es + rr − eo‖p        rr ∈ ℝk
# bilinear / semantic matching
DistMult s = ⟨es, rr, eo⟩            rr ∈ ℝk
ComplEx  s = ⟨es, rr, eo⟩            rr ∈ ℂk
# rotation
RotatE   dr(h,t) = ‖h ∘ r − t‖

The formulas and the O(n_ek + n_rk) space costs are lifted verbatim from the ConvE table ⁴; RotatE's is the Hadamard rotation with p(h,r,t) = sigmoid(γ − dr(h,t)) ⁵. The geometry buys you specific algebra. DistMult's trilinear product is symmetric in s and o, so it literally cannot separate capitalOf from hasCapital; ComplEx fixes that by moving rr into ℂ^k and conjugating the object ⁴. Train DistMult in the panel and watch borders — the symmetric relation — come out fine while the capital pair collapses.

Negatives are half the model

Graphs contain positives only, so you manufacture negatives by corrupting h or t; the established variants are uniform and Bernoulli sampling ². The loss you actually optimise is

L = −log σ(γ − dr(h,t)) − Σi wi · log σ(dr(h′i,t′i) − γ)

with wi = 1/n under uniform sampling ⁵. Self-adversarial sampling replaces that with wi = p(h′i,r,t′i) = softmax(α · f(h′i,r,t′i)), weighting each negative by the current model's own score ⁵. Push the α slider up and most of the gradient goes to the handful of hard negatives; that is where a large part of the reported gain over uniform sampling comes from, which is the first reason to distrust family-versus-family comparisons.

The pitfall your supervisor will lead with

Mean Reciprocal Rank plus Hits@k, computed filtered: when ranking candidates for (h, r, ?) you remove every other tail known to be true from the candidate list, otherwise a correct alternative fact penalises you. Flip filtered off in the panel and watch MRR sag for no modelling reason.

Then the real hazard. WN18 and FB15k suffer test-set leakage from inverse relations of training triples appearing in the test set, and the effect is severe enough that a simple rule-based model achieves state-of-the-art results ⁴. Our TRIPLES carry the same defect by construction: capitalOf and hasCapital are stored as mirrored pairs. Flip leak inverses and the leakage banner reports how much of the MRR a memorise-the-inverse baseline explains on its own. The remedy in the literature was to derive robust variants of the datasets — FB15k-237 and WN18RR, with the inverse relations removed ⁴⁵.

Four levels in, we have a graph of data whose nodes are entities and whose edges are relations ¹, a split between simple statements as edges and quantified statements as axioms ¹, a query layer that adds navigational operators to the relational core ¹, and a scoring function s(h,r,t) ranked pointwise over candidates ⁴. Now the honest part. Some of what I told you at level 4 is folklore, and the part of this level that you probably care about most — attacks — is mostly not in my evidence ledger. I will label it as such, in the panel and here.

What level 4 oversold

The family-versus-family story (translational vs. semantic-matching ², TransE ‖e_s+r_r−e_o‖_p vs. ⟨e_s,r_r,e_o⟩ with r_r∈ℝ^k or ℂ^{k 4}, RotatE's d_r(h,t)=‖h∘r−t‖ ⁵) is usually told as geometry: ComplEx handles antisymmetry, RotatE handles composition. That is true about the hypothesis class and mostly silent about the leaderboard. The training regime moves the numbers just as hard: uniform vs. Bernoulli corruption of h or t ², and self-adversarial weights p(h′_i,r,t′_i) ∝ exp(α·f) replacing the 1/n in the negative-sampling loss ⁵⁵. My position: attribute a gain to geometry only when negatives, dimension and budget are matched — and remember that on WN18/FB15k a rule-based model reached state of the art because inverse relations leaked into test, which is why FB15k-237 and WN18RR exist ⁴⁵.

Three frameworks, and where the trust boundary sits

The canonical taxonomy is three-way: KG-enhanced LLMs, LLM-augmented KGs, synergized LLMs + KGs ⁶, motivated by a symmetry — LLMs fall short of accessing factual knowledge, KGs are hard to construct ⁶. Under LLM-augmented KGs you get LLM-augmented embedding, completion, KG-to-text and KGQA ⁶; under the other direction, KG-guided planning, neuro-symbolic reasoning, and post-hoc factuality checking of LLM output ⁷; and construction/canonicalization across heterogeneous sources ⁷. GraphRAG is the concrete instance: "a data pipeline and transformation suite … designed to extract meaningful, structured data from unstructured text using the power of LLMs" ⁸, using "knowledge graph memory structures to enhance LLM outputs" ⁸ to "form a targeted context for question answering" ⁸. Graph-model-plus-LLM retrieval is still active work ⁶.

Flip the pattern switch in the panel and watch the boundary move. In KG-enhanced-LLM the graph is read-only at inference and the attack surface is retrieval ranking. In LLM-augmented-KG the extractor writes, so attacker-supplied text becomes attacker-authored triples. Synergized closes the loop, and a poisoned write returns as retrieved context on the next question.

The argument I will actually defend

KGs are attractive because their knowledge is "accurate, explicit and easily-modifiable" ⁷. That third adjective is the whole security story. Explicit means a grounded answer is a deterministic function of a small retrieved subgraph; easily-modifiable means one edge changes that function. Add (Valparaiso, capitalOf, Chile) in the panel and every downstream answer rewrites — no gradient, no jailbreak string, one row. The control point is therefore not the prompt: it is provenance. Our shared data already carries it — source, start, trust per statement — so turn trust weighting on and set the threshold above user-upload.

Boundary of the ledger

Nothing in my sources demonstrates a KG poisoning or prompt-injection attack. The propagation claim is an inference from the explicit/easily-modifiable property ⁷ combined with the extraction-from-unstructured-text pipeline ⁸; the panel labels it INFERRED. Passage p3's injection succeeding against a real extractor is speculative here. One thing is documented and worth your operational attention: the reference implementation "is largely in maintenance mode, and won't be accepting new PRs or implementing new features … particularly to address CVEs as they arise" ⁸. Build on it if you like; own the patch path. And note the level-3 asymmetry never went away — under the open-world assumption a missing edge is not a false one, so a defence that filters low-trust triples buys precision by refusing to answer.