A Secure Structure-Aware GraphRAG Framework for Indonesian Statutory Law: Cryptographic Integrity, Access Control, and Multi-Hop Reasoning for Legal Question Answering
Abstract
Indonesian statutory law spans a strict five-level hierarchy, is frequently amended through omnibus legislation, and contains dense cross-references that flat-text embeddings cannot capture. Current retrieval-augmented generation (RAG) systems remain prone to hallucination on roughly one in six legal queries, while existing GraphRAG approaches neither model Indonesian-specific drafting conventions nor address three under-recognised security requirements of legal AI: knowledge graph integrity, access control, and query non-repudiation. We propose SecureGraphRAG, a Secure Structure-Aware GraphRAG framework that (i) constructs a domain-grounded knowledge graph over 47 regulations (15,463 nodes; 38,927 edges) using a five-step pipeline with pattern-based relation extraction validated at 92.4% precision; (ii) combines IndoSBERT dense embeddings with Personalised PageRank, community-membership, and path-length signals; (iii) performs multi-hop reasoning over the resulting subgraph; and (iv) integrates SHA-256 Merkle-chain integrity verification, role-based access control enforced as a Cypher query rewrite, and HMAC-SHA256 audit logging with tamper-evident chaining. Unlike prior legal GraphRAG systems, which integrate retrieval and reasoning components without addressing the integrity, access-control, and accountability guarantees that production legal-AI deployment requires, SecureGraphRAG treats these guarantees as first-class design constraints rather than deployment afterthoughts. On 200 expert-annotated QA pairs, SecureGraphRAG achieves Recall@10 of 0.756 ± 0.024 (+14.4% over standard RAG; p < 0.001, Bonferroni-corrected), 79.1% citation accuracy, and a 57.1% hallucination reduction. Error analysis identifies five failure modes with corresponding mitigation strategies. The security layer adds only 5.1 ms overhead (0.5%) at 100% enforcement coverage.