TopoGuard: Graph Theory Based Defenses Against Split-Knowledge Attacks on RAG

# TopoGuard: Graph Theory Based Defenses Against Split-Knowledge Attacks on RAG
Source: [https://arxiv.org/html/2607.20437](https://arxiv.org/html/2607.20437)
Chahana Dahal1Zuobin Xiong1

1Department of Computer Science, University of Nevada, Las Vegas \{chahana\.dahal,zuobin\.xiong\}@unlv\.edu

###### Abstract

Production Retrieval Augmented Generation \(RAG\) systems rely on aggregating multiple external documents to answer complex queries\. However, the retrieved documents introduce a new threat surface that can be exploited to launchsplit\-knowledge attacks\. In this attack, the adversary injects documents that are individually benign but create false associations when combined and fed to language models\. This paper shows that the new attack is structurally invisible to existing per\-document filters, like LlamaGuard\. To address this issue in RAG, this work introducesTopoGuard, a family of graph theory\-based methods specifically targeting the split\-knowledge attacks by building a semantic similarity graph from retrieved documents and detecting contexts with malicious topology\. Grounded on the theoretical analysis, the TopoGuard family has been proven to be effective and robust even with noisy inputs\. Extensive experiments are conducted on two retrieval datasets and compared with multiple baseline methods\. Specifically, the TopoGuard\-λ2\\lambda\_\{2\}\+Entity catches 21×\\timesmore attacks than LlamaGuard\-2\-8B at 1% FPR \(32\.6% vs 1\.5% recall\) on the HotpotQA dataset\. Compared with production RAG detection systems using large language models, the proposed TopoGuard variants run efficiently at sub\-millisecond latency and stay robust under adaptive adversaries and benign cross\-domain queries\.

## 1Introduction

Retrieval Augmented Generation \(RAG\) has been widely used for grounding external knowledge on Large Language Models \(LLMs\) as RAG reduces hallucination by integrating the knowledge \(e\.g\., external documents\) into promptsShusteret al\.\([2021](https://arxiv.org/html/2607.20437#bib.bib3)\)\. Recently, RAG\-based systems have been deployed at scale in enterprise search, customer support, coding assistants, and consumer chatbots\. In the pipelines of production\-level RAG system, it retrieves the top\-kkdocuments from a large external corpus at query timeLewiset al\.\([2020](https://arxiv.org/html/2607.20437#bib.bib18)\)as external knowledge\. However, such a naive retrieval strategy is vulnerable to adversarial intent, making the RAG system itself an attack surface\. Specifically, an attacker can inject harmful content into the retrieval corpus to manipulate model behavior through open submission, automated ingestion, or web crawls, given low\-level accessZouet al\.\([2025](https://arxiv.org/html/2607.20437#bib.bib1)\)\. In response to such attacks, existing RAG safety defenses are deployed mainly at the document level\. For instance, systems like LlamaGuardLlama Team \([2024b](https://arxiv.org/html/2607.20437#bib.bib5),[a](https://arxiv.org/html/2607.20437#bib.bib6)\), Perspective APILeeset al\.\([2022](https://arxiv.org/html/2607.20437#bib.bib2)\), and LLM\-as\-a\-JudgeZhenget al\.\([2023](https://arxiv.org/html/2607.20437#bib.bib9)\)score each retrieved document independently to identify malicious content\. Yet, this design is not robust in practice as it assumes threats are visible and only present in individual document content\. In this work, we highlight that existing defenses are penetrated by a new attack form, the split\-knowledge attack, where the malicious payload is distributed across multiple documents that appear benign when inspected individually but become harmful when retrieved together and combined\.

The Example of Split\-Knowledge Attack\.Consider a RAG system answering the query:*“What major manufacturer is based in Seattle?”*Ideally, the system retrieves a logical reasoning chain:

> Doc 1:“Boeing is a leading aerospace manufacturer…” Doc 2:“Boeing’s primary facilities are located in Seattle…”

However, by inserting factually true but contextually deceptive documents, an adversary can take advantage of this compositional logic\. For instance:

> Doc A:“Boeing’s primary facilities are located in Seattle…” Doc B:“Seattle is a major hub for international drug trafficking…”

![Refer to caption](https://arxiv.org/html/2607.20437v1/x1.png)Figure 1:The split\-knowledge attack: benign documents combine into a harmful association\.Each document above would go through standard content filters, as they are both correct individually\. However, their combined retrieval generates an artificial correlation, which might lead the LLM to hallucinate a link between Boeing and illegal activities\. The split\-knowledge attack doesn’t require model weight manipulation or hostile prompts, unlike traditional jailbreaks or adversarial examples\. Instead, it uses the compositional structure of RAG to turn the retrieval corpus into an adversarial vector\.

Why Existing Defenses Fail?Current RAG safety guardrails score each retrieved document independently\. A scalar filterf​\(di\)f\(d\_\{i\}\)that scores each documentdid\_\{i\}on its own cannot detect a signal that only appears when documents are combined\. Since the adversarial signal lives in the semantic gap between retrieved documents, the per\-document defense mechanism can not catch split\-knowledge attacks by its structural design\. To assess the split\-knowledge attacks on existing defenses, we evaluate three state\-of\-the\-art content filters \(LlamaGuard\-2\-8B, LlamaGuard\-3\-8B, and LLM\-as\-a\-Judge\) on 10,000 split\-knowledge attacks built over HotpotQAYanget al\.\([2018](https://arxiv.org/html/2607.20437#bib.bib4)\)\. All three defenses get a nearly random guess \(e\.g\., AUROC between0\.500\.50and0\.580\.58\), and the full results are presented in Section[4\.2](https://arxiv.org/html/2607.20437#S4.SS2)\.

To address the failure of existing defenses, this paper proposes a topological detection\-based filtering method:TopoGuard\. In summary, we represent the retrieved context as a semantic similarity graphGG, where nodes are retrieved passages and edges are cosine similarity\. Legitimate reasoning chains will form densely connected subgraphs with bridging entities\. Split\-knowledge attacks, however, combine semantically unrelated domains \(e\.g\., Boeing∪\\cupDrugs\), producing loosely connected clusters with low graph conductance\. The difference leads to a spectral cut in the graph topology, and based on which we can detect the split\-knowledge attacks with theoretical guarantees\.

Our contributions are:

- •To the best of our knowledge, this is the first work that formally define split\-knowledge attacks in the RAG system and provide a theoretical bound on spectral detection performance \(Theorem[3\.2](https://arxiv.org/html/2607.20437#S3.Thmtheorem2)\): the spectral gapλ2\\lambda\_\{2\}separates attacks from legitimate queries with a failure probability bounded byexp⁡\(−Ω​\(n​Δ2/σ2\)\)\\exp\(\-\\Omega\(n\\Delta^\{2\}/\\sigma^\{2\}\)\)\.
- •We design four split\-knowledge attack detectors based on Spectral Gap \(λ2\\lambda\_\{2\}\), Fiedler Conductance, Modularity, and an entity\-augmented hybrid \(TopoGuard\-λ2\\lambda\_\{2\}\+Entity\), which score retrieved documents and can achieve higher accuracy against existing baselines\.
- •We evaluate the robustness of the proposed TopoGuard on two multi\-hop QA benchmarks, against adaptive adversaries and benign cross\-domain queries\. TopoGuard maintains a low false positive rate on both settings compared with LLM\-based detection and runs at sub\-millisecond latency\.

## 2Problem Formulation

We formalize the split\-knowledge attack and provide a validation for the practical attack and defense\.

Semantic Similarity Graph\.Given retrieved documents setD=\{d1,…,dn\}D=\\\{d\_\{1\},\\ldots,d\_\{n\}\\\}with embeddings\{𝐱1,…,𝐱n\}⊂ℝd\\\{\\mathbf\{x\}\_\{1\},\\ldots,\\mathbf\{x\}\_\{n\}\\\}\\subset\\mathbb\{R\}^\{d\}, wheredid\_\{i\}is a retrieved context \(e\.g\., a paragraph\)\. The semantic similarity graphG=\(V,E,w\)G=\(V,E,w\)is defined as the*symmetrizedkk\-NN graph*, whereVVis node set of each retrieved context,\(i,j\)∈E\(i,j\)\\in Eifjjis among thekknearest neighbors ofii*or*iiis among thekknearest neighbors ofjj, and the weightswi​j=max⁡\(0,⟨𝐱i,𝐱j⟩\)w\_\{ij\}=\\max\(0,\\langle\\mathbf\{x\}\_\{i\},\\mathbf\{x\}\_\{j\}\\rangle\)\(i\.e\., the cosine similarity between𝐱i,𝐱j\\mathbf\{x\}\_\{i\},\\mathbf\{x\}\_\{j\}clipped to non\-negative values to satisfy the requirement of the normalized Laplacian and Cheeger’s inequality\)\.

The retrieved documents setDDis categorized into two scenarios:

\(1\)Legitimate Multi\-Hop Query, if \(i\) Documents form a reasoning chaindi↝di\+1d\_\{i\}\\leadsto d\_\{i\+1\}, \(ii\) The answer requires synthesizing information acrossDD, and \(iii\) the semantic similarity graphGGhas high conductanceϕ​\(G\)≥ϵ\\phi\(G\)\\geq\\epsilon\.

\(2\)Split\-Knowledge Attack, if \(i\)D=D1∪D2∪…∪DkD=D\_\{1\}\\cup D\_\{2\}\\cup\\ldots\\cup D\_\{k\}and each disjoint subsetDi∈DD\_\{i\}\\in Dis benign, \(ii\) Their union appears to answer the query, and \(iii\) the semantic similarity graphGGhas low conductanceϕ​\(G\)≤δ\\phi\(G\)\\leq\\delta\.

The minimal case \(k=2k=2, with subsetsD1D\_\{1\}andD2D\_\{2\}\) is the most adversarially natural as it requires the fewest disconnected components for an attacker to construct\.k\>2k\>2produces additional graph fragmentation that strengthens the spectral signal\.

Threat Model\.We consider three parties: theoperatorOOwho deploys the RAG pipeline using encoder𝔼\\mathbb\{E\}, retrieverℝ\\mathbb\{R\}, and per\-document filters and theadversaryAAwho poisons the retrieval corpus\. We assume adversaryAAknows the public RAG architecture and encoder family\. So, they can inject individually benign documents into the corpus through any entry point exposed by the operatorZhonget al\.\([2023](https://arxiv.org/html/2607.20437#bib.bib14)\); Zouet al\.\([2025](https://arxiv.org/html/2607.20437#bib.bib1)\)\. The adversary cannot modify documents post\-injection, alter model weights, tamper with𝔼\\mathbb\{E\},ℝ\\mathbb\{R\}, or queries at run time\. The adversary’sgoalis to make the LLM output a target false association in response to a benign query\.

At query time,OOobserves the retrieved contextD=\{d1,…,dn\}D=\\\{d\_\{1\},\\ldots,d\_\{n\}\\\}and embeddings, and can launch existing defense mechanisms\. In addition,OOhas a small set of benign dev queries for threshold calibration but no labeled attacks \(Appendix[J](https://arxiv.org/html/2607.20437#A10)\)\.

Threat Validation\.We show, via experiments, that existing defense filters remain ineffective against split\-knowledge attacks, even when provided with the full concatenated retrieval context\. E\.g\., we evaluate 50 adversarial examples on Llama\-3\-8B\-Instruct to confirm that split\-knowledge attacks manipulate LLM outputs in practice\. Legitimate contexts achieve 96% accuracy, while attacks succeed 34% of the time \(17/50,p<0\.001p<0\.001\)\. Full details are in Appendix[A](https://arxiv.org/html/2607.20437#A1)\.

## 3Theoretical Analysis

We provide a theoretical framework characterizing when topological detection succeeds\.

### 3\.1Stability Under Embedding Noise

###### Theorem 3\.1\(Spectral Stability\)\.

LetGGbe thekk\-NN similarity graph constructed from observed embeddings\{𝐱i\}\\\{\\mathbf\{x\}\_\{i\}\\\}, andG∗G^\{\*\}a reference graph from a noisy embeddings\{𝐱i∗\}\\\{\\mathbf\{x\}\_\{i\}^\{\*\}\\\}with‖𝐱i−𝐱i∗‖2≤σ\\\|\\mathbf\{x\}\_\{i\}\-\\mathbf\{x\}\_\{i\}^\{\*\}\\\|\_\{2\}\\leq\\sigmafor allii\. LetLLandL∗L^\{\*\}denote the normalized Laplacians ofGGandG∗G^\{\*\}, with second\-smallest eigenvalues \(the spectral gaps\)λ2​\(G\)\\lambda\_\{2\}\(G\)andλ2​\(G∗\)\\lambda\_\{2\}\(G^\{\*\}\)\. Then the following equation holds\.

\|λ2​\(G\)−λ2​\(G∗\)\|=O​\(k​σδmin2\),\|\\lambda\_\{2\}\(G\)\-\\lambda\_\{2\}\(G^\{\*\}\)\|=O\\\!\\left\(\\frac\{k\\sigma\}\{\\delta\_\{\\min\}^\{2\}\}\\right\),whereδmin\\delta\_\{\\min\}is the minimum weighted node degree ofG∗G^\{\*\}\.

Proof Sketch\.We bound the operator\-norm perturbation‖L−L∗‖2\\\|L\-L^\{\*\}\\\|\_\{2\}of the normalized Laplacian and apply Weyl’s inequalityHorn and Johnson \([2012](https://arxiv.org/html/2607.20437#bib.bib22)\)\. The cosine\-similarity perturbation propagates from edge weights to weighted degrees to the diagonal inverse\-square\-rootD−1/2D^\{\-1/2\}\(whereDDis the diagonal degree matrix\), and the resulting Laplacian perturbation scales asO​\(k​σ/δmin2\)O\(k\\sigma/\\delta\_\{\\min\}^\{2\}\)\. We refer readers to the full proof in Appendix[D](https://arxiv.org/html/2607.20437#A4)\. Theorem[3\.1](https://arxiv.org/html/2607.20437#S3.Thmtheorem1)guarantees that the spectral gap onλ2\\lambda\_\{2\}is stable under encoder noise or updates as small perturbations in the embedding space produce small perturbations inλ2\\lambda\_\{2\}\. This is the foundation for usingλ2\\lambda\_\{2\}as a robust detection signal under realistic encoder imperfections\.

### 3\.2Detection Guarantees and Sample Complexity

###### Theorem 3\.2\(Detection Certificate\)\.

Letϕ​\(G\)\\phi\(G\)denote the conductance of observed graphGG\(a measure of graph connectivity, ranging from0for fully disconnected to11for fully connected\)\. Suppose reference attack graphs have conductanceϕ​\(G∗\)≤δ\\phi\(G^\{\*\}\)\\leq\\deltaand legitimate graphs haveϕ​\(G∗\)≥ϵ\\phi\(G^\{\*\}\)\\geq\\epsilon, with separation conditionϵ≥2​δ\\epsilon\\geq 2\\sqrt\{\\delta\}\. Assume sub\-Gaussian embedding noise with parameterσ\\sigmaandkk\-NN margin condition in Theorem[3\.1](https://arxiv.org/html/2607.20437#S3.Thmtheorem1)proof\. Letnndenote the number of retrieved passages in the document setDD\(the node size of the similarity graphGG\)\. Letτλ=δ\+ϵ2/4\\tau\_\{\\lambda\}=\\delta\+\\epsilon^\{2\}/4denote the threshold inλ2\\lambda\_\{2\}\-space, with corresponding score\-space thresholdτ=1−min⁡\(τλ,1\)\\tau=1\-\\min\(\\tau\_\{\\lambda\},1\)and marginΔ=\(ϵ2−4​δ\)/4\\Delta=\(\\epsilon^\{2\}\-4\\delta\)/4\. Then the attack detection scores​\(D\):=1−min⁡\(λ2​\(G\),1\)s\(D\):=1\-\\min\(\\lambda\_\{2\}\(G\),1\)satisfies:

PrD∼Attack⁡\[s​\(D\)\>τ\]\\displaystyle\\Pr\_\{D\\sim\\text\{Attack\}\}\[s\(D\)\>\\tau\]≥1−exp⁡\(−Ω​\(n​Δ2σ2\)\),\\displaystyle\\geq 1\-\\exp\\\!\\left\(\-\\Omega\\\!\\left\(\\tfrac\{n\\Delta^\{2\}\}\{\\sigma^\{2\}\}\\right\)\\right\),a​n​d​PrD∼Legit⁡\[s​\(D\)\>τ\]\\displaystyle and\\Pr\_\{D\\sim\\text\{Legit\}\}\[s\(D\)\>\\tau\]≤exp⁡\(−Ω​\(n​Δ2σ2\)\)\.\\displaystyle\\leq\\exp\\\!\\left\(\-\\Omega\\\!\\left\(\\tfrac\{n\\Delta^\{2\}\}\{\\sigma^\{2\}\}\\right\)\\right\)\.

Proof Sketch\.The conditionϵ≥2​δ\\epsilon\\geq 2\\sqrt\{\\delta\}ensures strict separation between the attack ceiling2​δ2\\deltaand the legitimate floorϵ2/2\\epsilon^\{2\}/2\. We setτλ\\tau\_\{\\lambda\}to the midpoint of this gap with marginΔ=\(ϵ2−4​δ\)/4\\Delta=\(\\epsilon^\{2\}\-4\\delta\)/4on each side\. Theorem[3\.1](https://arxiv.org/html/2607.20437#S3.Thmtheorem1)bounds deviations of the noisyλ2​\(G\)\\lambda\_\{2\}\(G\)from the referenceλ2​\(G∗\)\\lambda\_\{2\}\(G^\{\*\}\)\. Standard concentration arguments on the operator\-norm perturbation of the Laplacian then yield high\-probability separation between the attack and legitimate regimes\. We treat this as a heuristic bound\. We refer readers to the full proof in Appendix[D](https://arxiv.org/html/2607.20437#A4)\.

From conductance to spectral gap\.The conductanceϕ​\(G\)\\phi\(G\)is an NP hard problem, so we use the spectral gapλ2\\lambda\_\{2\}and Cheeger’s inequalityCheeger \([1970](https://arxiv.org/html/2607.20437#bib.bib24)\)\(λ2​\(G∗\)≤2​δ\\lambda\_\{2\}\(G^\{\*\}\)\\leq 2\\deltaandλ2​\(G∗\)≥ϵ2/2\\lambda\_\{2\}\(G^\{\*\}\)\\geq\\epsilon^\{2\}/2\) to transfer conductance to spectral gap for calculation, which results in the transition fromϕ​\(G\)<δ\\phi\(G\)<\\deltatos​\(D\)\>τs\(D\)\>\\tauas the threshold\.

The first bound is the true positive rate \(TPR\) at thresholdτ\\tauwhen the retrieved documents setDDis an attack sample\. Attacks are detected with probability approaching 1 exponentially fast as the number of retrieved contextsnnincreases\. The second bound is the false positive rate \(FPR\) when the retrieved documents setDDis a legitimate sample, which decreases to0at the same exponential rate withnn\. Together, the two bounds certify that the spectral gap detector separates attacks from legitimate queries with vanishing error innn\.

###### Corollary 3\.1\(Sample Complexity\)\.

To achieve true positive rate≥1−α\\geq 1\-\\alphaand false positive rate≤β\\leq\\beta, it suffices to retrieven=O​\(σ2\(ϵ2−4​δ\)2​log⁡1min⁡\(α,β\)\)n=O\\\!\\left\(\\frac\{\\sigma^\{2\}\}\{\(\\epsilon^\{2\}\-4\\delta\)^\{2\}\}\\log\\frac\{1\}\{\\min\(\\alpha,\\beta\)\}\\right\)retrieved units\.

The corollary provides instructions on parameter selection in RAG systems\. We refer readers to the full proof in Appendix[D](https://arxiv.org/html/2607.20437#A4)\.

## 4Experiments

### 4\.1Methods and Baselines

Proposed methods\.We designed four graph theory\-based attack detectors\.TopoGuard\-λ2\\lambda\_\{2\}uses the normalized spectral gap of the semantic similarity graph’s Laplacian directly from Theorem[3\.2](https://arxiv.org/html/2607.20437#S3.Thmtheorem2)\.

TopoGuard\-Conductancecomputes the Fiedler\-vector cut conductance, a tighter empirical measure of spectral separation\. Rather than usingλ2\\lambda\_\{2\}as a proxy for conductance, we directly evaluate the cut conductance by the Fiedler vector𝐯2\\mathbf\{v\}\_\{2\}\. We split the nodes into two groups by the sign ofS=\{i:𝐯2​\[i\]≥0\}S=\\\{i:\\mathbf\{v\}\_\{2\}\[i\]\\geq 0\\\}and set the detection scorescond​\(G\)=1−ϕ​\(S\)s\_\{\\text\{cond\}\}\(G\)=1\-\\phi\(S\), which gives us a signal stronger thanλ2\\lambda\_\{2\}, but at a higher cost \(O​\(n3\)O\(n^\{3\}\)vs\.O​\(k​n\)O\(kn\)forλ2\\lambda\_\{2\}\)\.

TopoGuard\-Modularityevaluates the modularity\(Newman,[2006](https://arxiv.org/html/2607.20437#bib.bib20)\)via Louvain community detection\(Blondelet al\.,[2008](https://arxiv.org/html/2607.20437#bib.bib21)\), a greedy heuristics\. Although modularity achieves the highest recall in standard evaluations \(35\.09% on HotpotQA\), it relies on non\-spectral greedy procedures, so it has no concentration bounds and formal sample complexity guarantees withinλ2\\lambda\_\{2\}method\. We include it as a strong heuristic for recall\-critical applications, whileλ2\{\\lambda\_\{2\}\}and Conductance remain the standard for deployments when a provable detection guarantee is required\.

TopoGuard\-λ2\+\\lambda\_\{2\}\+Entitycombines the spectral gap with named\-entity overlap between retrieved documents, computed as the Jaccard similarity of named entities extracted using NLTK’sne\_chunkBirdet al\.\([2009](https://arxiv.org/html/2607.20437#bib.bib27)\)\(with theaveraged\_perceptron\_taggerPOS\-tagger andmaxent\_ne\_chunker\)\. The combination weightα\\alphais set to0\.40\.4which places 60% of the weight on entity overlap \(Appendix[B\.1](https://arxiv.org/html/2607.20437#A2.SS1)\)\.

Baselines\.We compare the proposed methods against three classes of defenses\. \(1\) Graph statistics methods, including GraphAvgWeight \(mean edge similarity\) and NaiveDensity \(mean pairwise cosine similarity\)\. \(2\) Production\-level content\-moderation systems, like TextFilter \(a RoBERTa\-based hate speech classifierLiuet al\.\([2019](https://arxiv.org/html/2607.20437#bib.bib25)\); Vidgenet al\.\([2021](https://arxiv.org/html/2607.20437#bib.bib16)\)\), LlamaGuard\-2\-8BLlama Team \([2024b](https://arxiv.org/html/2607.20437#bib.bib5)\), and LlamaGuard\-3\-8BLlama Team \([2024a](https://arxiv.org/html/2607.20437#bib.bib6)\)\. And \(3\) Llama\-3\-8B\-InstructGrattafioriet al\.\([2024](https://arxiv.org/html/2607.20437#bib.bib7)\), prompted as LLM\-as\-a\-JudgeZhenget al\.\([2023](https://arxiv.org/html/2607.20437#bib.bib9)\)to classify split\-knowledge attacks111All text\-based baselines \(TextFilter, LlamaGuard\-2/3, LLM\-as\-a\-Judge\) score the full retrieval context as a single concatenated input rather than per\-document, so their AUROC reflects the structural nature of split\-knowledge attacks rather than an artifact of independent document scoring\.\. For LlamaGuard\-2/3, we extract the next\-token logits at the final input position and apply a two\-way softmax over thesafe/unsafetoken logits, using the resultingunsafeprobability to calculate the AUROC\. For LLM\-as\-a\-Judge, we generate up to 5 tokens with greedy decoding and map the response to \{1\.0, 0\.5, 0\.0\} foryes/other/noanswers\.

Table 1:Attack detection performance on HotpotQA and MuSiQue\. The detection thresholdτ\\tauwas calibrated on the development set for a 1% FPR\. Metrics are reported on the test set as the bootstrap mean±\\pmstandard deviation over 1,000 resamples\. Bold highlights best performance per column\.
### 4\.2Split\-knowledge Attack Detection

Experiment Setup\.We evaluate our detection methods on two multi\-hop QA datasets: HotpotQAYanget al\.\([2018](https://arxiv.org/html/2607.20437#bib.bib4)\)\(2 hops\), with 1k development and 10k test, and MuSiQueTrivediet al\.\([2022](https://arxiv.org/html/2607.20437#bib.bib19)\)\(2\-4 hops\), with 500 development and 3k test examples\. Both datasets are designed for compositional retrieval that matches our threat model\.

To construct a balanced adversarial set, we replace one document per query with a topically relevant but semantically disconnected document\. Each retrieved document is decomposed into sentences, and a semantic similarity graph is built on it\. To set a universal comparison across different settings, each query’s retrieval context containsR=R=6 sentences \(3 sentences from each supporting document\)\.

Table[1](https://arxiv.org/html/2607.20437#S4.T1)shows the results of attack detection\. Across both datasets, safeguard models LlamaGuard 2, LlamaGuard 3, and LLM\-as\-a\-Judge \(Llama\-3\-8B\-Instruct\) have an AUROC of approximately 50%, which indicates nearly random detection\. This confirms our hypothesis that text\-based content filters cannot extract compositional adversarial signal even from the full concatenated retrieval context, because the signal lives in the topological structure of inter\-document relationships rather than in lexical content\. In contrast, our graph\-theoretic methods reliably expose the structural signature of split\-knowledge attacks\. On HotpotQA, TopoGuard\-λ2\\lambda\_\{2\}\+Entity achieves the highest AUROC \(95\.2%95\.2\\%\) and TopoGuard\-Modularity achieves the highest recall \(35\.1%35\.1\\%\) at a strict1%1\\%FPR, a𝟐𝟏×\\mathbf\{21\\times\}improvement over LlamaGuard\-2\-8B \(1\.53%1\.53\\%recall, AUROC54\.0%54\.0\\%\)\. TopoGuard\-λ2\\lambda\_\{2\}and TopoGuard\-Conductance show stable performance \(AUROC93\.2%93\.2\\%and93\.6%93\.6\\%\), confirming that the spectral gap and Fiedler conductance are robust indicators of topological fragmentation\. The four TopoGuard detectors are complementary:λ2\\lambda\_\{2\}\+Entity is our recommended default \(best AUROC with balanced recall and robustness, see Section[4\.4](https://arxiv.org/html/2607.20437#S4.SS4)\)\. Modularity achieves the highest raw recall without relying on named\-entity information, making it a strong option when the entity signal is unreliable\. TopoGuard\-λ2\\lambda\_\{2\}and Conductance come with concentration bounds \(Theorem[3\.2](https://arxiv.org/html/2607.20437#S3.Thmtheorem2)\) and are preferred when provable safety guarantees matter\.

Remarks\.MuSiQue is a dataset specifically designed for highly complex multi\-hop \(2\-4 hops\) reasoning\. The legitimate queries in MuSiQue naturally require jumping between very different topics, so telling them apart from an adversarial attack is significantly harder\. The overall detection rates drop for every method but the performance gap between topological and naive graph baselines widens\. A quantitative analysis showing that MuSiQue Q4 safe queries are structurally indistinguishable from attacks is provided in Appendix[G](https://arxiv.org/html/2607.20437#A7)\.

### 4\.3False Positive Rate on Benign Queries and Multi\-Hop Inference

Experiment Setup\.We evaluate false positive rates on legitimate multi\-hop queries to ensure production viability\. We extract 2,474 benign bridge questions from HotpotQA validation and 1,180 benign multi\-hop questions from MuSiQue validation\. For each query, we construct the semantic similarity graph from retrieved documents and compute detection scores using thresholds frozen from Section[4\.2](https://arxiv.org/html/2607.20437#S4.SS2)\. To isolate cross\-domain sensitivity, we partition queries into quartiles based on the “document gap”, which is the cosine distance between supporting document embeddings\. Q4 represents the hardest and most semantically distant cross\-domain but legitimate queries\.

Table 2:False Positive Rate \(%\) on benign multi\-hop queries\. Q4 contains the 25% of queries with the highest document gap \(most semantically distant legitimate retrievals\)\.Table[2](https://arxiv.org/html/2607.20437#S4.T2)presents the False Positive Rate \(FPR\) of our methods evaluated on benign multi\-hop queries\. Across both datasets, the overall FPR remains low enough \(at most1\.41%1\.41\\%\)\. TopoGuard\-Conductance achieves the lowest topological FPR on HotpotQA \(0\.32%0\.32\\%\), while the hybrid TopoGuard\-λ2\\lambda\_\{2\}\+Entity achieves the lowest on MuSiQue \(0\.85%0\.85\\%\) among the TopoGuard variants\. However, text\-based filters over\-flag these safe queries with0\.90\.9–1\.4%1\.4\\%FPR on HotpotQA and3\.6%3\.6\\%on MuSiQue\. In addition, breaking down the false positives by semantic distance \(document gap\) reveals the geometric reality behind these false positives\. For standard queries \(Q1–Q3\), our topological methods achieve 0% FPR on HotpotQA and under0\.4%0\.4\\%on MuSiQue \(see Appendix[H](https://arxiv.org/html/2607.20437#A8)for full results\), safely recognizing natural reasoning chains\. Furthermore, the Q4 edge case highlights the practical necessity of our formal certificates\. On HotpotQA’s most challenging cross\-domain queries, TopoGuard\-Conductance \(1\.29%1\.29\\%FPR\) strongly outperforms Modularity \(3\.23%3\.23\\%FPR\)\. The hybrid TopoGuard\-λ2\\lambda\_\{2\}\+Entity lands between the two \(1\.94%1\.94\\%FPR\), trading a small FPR increase for substantially higher recall \(Table[1](https://arxiv.org/html/2607.20437#S4.T1)\)\. While Modularity offers the highest raw recall, the recommended production configuration is the hybrid TopoGuard\-λ2\\lambda\_\{2\}\+Entity \(best AUROC, strongest adaptive\-adversary robustness in Section[4\.4](https://arxiv.org/html/2607.20437#S4.SS4)\);

On MuSiQue Q4, all methods except LlamaGuard\-2 achieve higher FPRs\. However, due to the low recall \(1\.29%1\.29\\%\) of LlamaGuard\-2 in Section[4\.2](https://arxiv.org/html/2607.20437#S4.SS2), the model is not actually distinguishing between safe and malicious contexts\. Overall, even the sensitivity on cross\-domain \(Q4\) queries is slightly higher, TopoGuard methods remain the best defense for complex RAG systems\.

### 4\.4Transferability, Efficiency, and Robustness

![Refer to caption](https://arxiv.org/html/2607.20437v1/x2.png)Figure 2:The heatmap shows FPR \(%\) when a detector calibrated on source systemSS\(1% FPR target\) is deployed on target systemTTwithout recalibration\. Top row:RR\. Bottom row:kk\.Transferability across Configurations\.In practice, RAG systems vary in their retrieval configurations as different models retrieve different numbers of documents with varying quality\. Here, we evaluate whether our TopoGuard detectors transfer across retrieval depthRR\(the total number of sentences in the retrieval context\) and graph densitykk\(kk\-NN value in semantic similarity graph\), or whether they require per\-configuration tuning\. We useR=6R=6\(3 sentences from 2 documents each\) andk=4k=4as the base case for transfer testing\. By varyingR∈\{6,10\}R\\in\\\{6,10\\\}andk∈\{4,8\}k\\in\\\{4,8\\\}, the system can simulate pipelines with different configuration\. Figure[2](https://arxiv.org/html/2607.20437#S4.F2)presents the zero\-shot transferability matrices for TopoGuard\-λ2\\lambda\_\{2\}, TopoGuard\-Conductance, and the Modularity variants\.

Based on the result, we notice a logical asymmetry when changing the context depth \(RR\)\. If a detector is calibrated onR=6R=6but encounters richer contexts in deployment \(R=10R=10\), the FPR inflates to around5\.2%5\.2\\%–6\.5%6\.5\\%\. This is not a flaw in any single metric but reflects a structural fact, i\.e\., increasingRRshifts the graph’s degree distribution, which invalidates any threshold calibrated at a lower depth\. TopoGuard\-Cond is the most stable in the worst case \(5\.2%5\.2\\%FPR\)\. This is consistent with its localized cut formulation being less sensitive to retrieval depth shifts than the global spectral gap\. Transferring from long to short contexts makes the filter highly conservative, dropping the FPR to just0\.1%0\.1\\%\. On the other hand, the system shows high stability across graph densities \(kk\)\. Adjusting the size ofkkhas hardly any effect on the transferred FPR\. For instance, a model calibrated onk=4k=4but deployed onk=8k=8\(at a fixed context length\) maintains a tightly excellent FPR of under 1\.0% across all cases, which means thatkkcan be tuned without pausing to recalibrate the safety filter\.

![Refer to caption](https://arxiv.org/html/2607.20437v1/x3.png)Figure 3:The latency of each defense variant against its recall\.Computational Efficiency\.Figure[3](https://arxiv.org/html/2607.20437#S4.F3)plots the latency of each defense variant against its recall\. LlamaGuard\-3\-8B is too heavy for real\-time use as it takes∼\\sim40 ms per query while catching almost no attacks\. TopoGuard variants replace LLMs with lightweight graph math but secure much higher recall\. As shown in the figure, all of the TopoGuard spectral variants reside in the top\-left corner, representing the high performance and low latency\. E\.g\., the TopoGuard\-λ2\\lambda\_\{2\}variant runs in under0\.50\.5ms, over100×100\\timesfaster than LlamaGuard\-3\.

Table 3:Robustness to adaptive evasion attacks\. Recall \(%\) at fixed thresholdτ\\tau\.Boldandunderlinedenote the best and second\-best results per column, respectively\.Robustness to Adaptive Adversaries\.To evaluate the robustness of TopoGuard in an adversarial setting, we further consider a white\-box adversary with full knowledge of the TopoGuard defense and its calibrated thresholds\. The attacker’s goal is to minimize detection recall by selectively poisoning the retrieval corpus with disconnected document subsets \(DAD\_\{A\}andDBD\_\{B\}\)\. We evaluate four adaptive evasion strategies against the non\-adaptive baseline\. Each strategy below modifies this attack to evade detection\. \(i\) Random padding appends 3 sentences from a random benign context to inflate edge counts\. \(ii\) Best\-of\-NNpaddingN=32N\{=\}32samples candidate connector documents and selects the one that maximizes similarity to bothDAD\_\{A\}andDBD\_\{B\}\. \(iii\) Chain mimicry inserts documents whose embeddings lie betweenDAD\_\{A\}andDBD\_\{B\}\. It imitates multi\-hop reasoning at the embedding level\. \(iv\) Same\-community mimicry replacesDBD\_\{B\}with a document drawn from the top\-256 most similar toDAD\_\{A\}\. It hides the attack within a single semantic cluster instead of across two disconnected clusters\.

Table[3](https://arxiv.org/html/2607.20437#S4.T3)shows detection recall under each adversarial strategy\. TopoGuard\-Modularity achieves the highest base recall \(35\.1%\) and even outperforms in random padding \(54\.8%\) as extra nodes amplify community structure\. But it collapses under Best\-of\-NNto 7\.2%\. The reason is that community detection is more sensitive to structural manipulation than spectral methods because optimized padding directly suppresses inter\-community edges\.

Among spectral detectors \(i\.e\.,λ2\\lambda\_\{2\}, Cond\. andλ2\+\\lambda\_\{2\}\+Entity\),λ2\\lambda\_\{2\}is the most robust under adversarial attacks since connectivity measures global graph properties rather than a local cut, making it harder to fool\. Under Best\-of\-NN,λ2\\lambda\_\{2\}holds 22\.2% recall versus 12\.2% \(Conductance\), 7\.2% \(Modularity\), whereas under Chain mimicry, it improves recall to 36\.8% as the fake bridge nodes become part of the detectable anomaly rather than hiding it\. The hybrid TopoGuard\-λ2\\lambda\_\{2\}\+Entity \(α=0\.4\\alpha\{=\}0\.4\) is the only method that stays competitive across every adaptive attack, winning the two hardest columns in Best\-of\-NNand Chain\. Specifically, Chain mimicry backfires against the hybrid because embedding\-level bridges fail to share named entities with the attack endpoints, which is exactly the asymmetry the entity signal flags\. Therefore, we recommend the hybrid as the default for adaptive settings\.

Remarks\.All methods fail under the same\-community mimicry\. When the attack is drawn from the same semantic cluster as the legitimate document, the structural anomaly vanishes and recall drops to roughly 1% across all topological defenses \(0% for Modularity\)\. This is a fundamental limit on topological defenses that is worth future investigation\. However, NaiveDensity catches a slightly higher fraction \(2\.8%\) than the hybrid \(1\.4%\)\. This suggests that density and spectral signals are partially complementary in this attack scenario, and TopoGuard should be a layer in a defense\-in\-depth stack: necessary against compositional attacks invisible to per\-document filters, but insufficient against adversaries who can semantically align malicious content with the legitimate cluster\.Therefore, combining TopoGuard with existing retrieval\-score consistency checks is a direction for future work\.

## 5Inspiration on Deployment Considerations

We synthesize the findings of this work into deployment guidance for production RAG systems\.

Operating point and false\-positive handling\.At 1% FPR, a system serving 1M queries per day flags 10K legitimate queries\. Blocking all flagged queries is too aggressive for most deployments, so a softer response policy is needed\. We suggest three options\.*Soft warning*: prompt the LLM to hedge cross\-document claims\.*Retrieval diversification*: re\-retrieve flagged contexts with tighter similarity constraints\.*Escalation*: route flagged queries to a heavier\-weight checker such as an LLM\-as\-a\-Judge\. Although escalation adds much more cost for LLMs, these expensive check runs on∼\\sim1% of traffic instead of 100%, while TopoGuard handles the rest at sub\-millisecond cost\.

Defense\-in\-depth composition\.TopoGuard complements per\-document filters but does not replace them\. Per\-document filters catch single\-passage attacks like PoisonedRAG, where the adversarial content sits in a single document \(Appendix[F](https://arxiv.org/html/2607.20437#A6)\-Related Works\)\. TopoGuard catches compositional attacks, where the payload sits in the structure across documents and is invisible to per\-document scoring\. The two attack classes occupy orthogonal regions of the threat space\. PoisonedRAG places adversarial passages inside the legitimate cluster \(high conductance\), where per\-document checks have signal but TopoGuard does not\. Split\-knowledge attacks place them outside the cluster \(low conductance\), where TopoGuard has a signal but per\-document checks do not\.

Recalibration triggers\.Section[4\.4](https://arxiv.org/html/2607.20437#S4.SS4)shows thatkkcan be tuned freely, butRRcannot\. The sentence embedding model used to construct the similarity graph, i\.e\., the encoder, is also a sensitive component\. Substituting across three encoder families on HotpotQA preserves AUROC in a tight range \(91\.5–95\.2%; Appendix[I](https://arxiv.org/html/2607.20437#A9)\), but the thresholdτ\\taumust be recalibrated per encoder because absolute score distributions shift\. Operationally, any change to system configurations \(RR, the embedding model, or the retriever\) should trigger re\-calibration on a fresh sample of benign queries\.

Calibration without attack labels\.A practical concern for deployment is that operators rarely have labeled split\-knowledge attacks for their corpus\. We demonstrate that operators can deploy TopoGuard without labeled attack data\. In extra experiments, we setτ\\tauat the 99th percentile of benign query scores, a standard threshold\-calibration procedure for FPR\-constrained binary classification that does not require attack labels\. Across all four detectors and both datasets, this label\-free calibration matches supervised recall within±0\.07%\\pm 0\.07\\%\(Appendix[J](https://arxiv.org/html/2607.20437#A10)\), well below the bootstrap standard deviation \(±0\.4\\pm 0\.4\-0\.50\.5%\)\. Thus, threshold calibration for a target FPR depends only on the negative class distribution, and attack labels are not strictly required\. Our contribution is empirical as we verify that detection recall is preserved under this label\-free procedure on real attack distributions\.

## 6Conclusion

In this work, we introduced split\-knowledge attacks, a practical attack in RAG systems, where the retrieved individual benign documents combine to induce harmful associations\. We empirically verified that the split\-knowledge attacks are effective against existing defense mechanisms because they are structurally invisible to per\-document filters\. To fill the gap, TopoGuard is designed to detect the retrieved contexts by topological fragmentation, with provable detection guarantees based on the graph’s spectral gap and conductance\. Extensive experiments are conducted on multiple baselines and two retrieval datasets\. Specifically, on HotpotQA, our TopoGuard catches approximately 21×\\timesmore attacks than LlamaGuard at 1% FPR, and the hybrid TopoGuard remains the most robust defense under different adaptive adversaries\. As RAG systems are widely deployed, TopoGuard pushes toward more reliable RAG by catching attacks that per\-document filters miss at sub\-millisecond cost and without labeled attacks\.

## 7Limitations

As a frontier defense in this line of research, TopoGuard still exhibits several limitations that constrain its deployment in real\-world settings\. First, it targets compositional attacks only\. On single\-passage attacks like PoisonedRAG, where the payload sits in one document, our methods will not be a good fit \(Appendix[F](https://arxiv.org/html/2607.20437#A6)\)\. Thus, we recommend deploying TopoGuard as a complement to per\-document filters, not a replacement\. Second, an adversary who places malicious content within the same semantic cluster as the legitimate retrieval \(same\-community mimicry, Section[4](https://arxiv.org/html/2607.20437#S4)\) eliminates the structural anomaly TopoGuard relies on, dropping recall to roughly 1%\. This is a universal limitation on topological defenses generally\. Future work should pair TopoGuard with retrieval\-score consistency checks or query\-conditioned detection to close these gaps\.

## References

- \[1\]\(2015\)Graph\-based anomaly detection and description: a survey\.Data Mining and Knowledge Discovery29\(3\),pp\. 626–688\.External Links:[Document](https://dx.doi.org/10.1007/s10618-014-0365-y),[Link](https://doi.org/10.1007/s10618-014-0365-y)Cited by:[Appendix C](https://arxiv.org/html/2607.20437#A3.p3.1)\.
- \[2\]S\. Bird, E\. Klein, and E\. Loper\(2009\)Natural language processing with python\.O’Reilly Media\.Cited by:[§4\.1](https://arxiv.org/html/2607.20437#S4.SS1.p4.3)\.
- \[3\]V\. D\. Blondel, J\. Guillaume, R\. Lambiotte, and E\. Lefebvre\(2008\-10\)Fast unfolding of communities in large networks\.Journal of Statistical Mechanics: Theory and Experiment2008\(10\),pp\. P10008\.External Links:[Document](https://dx.doi.org/10.1088/1742-5468/2008/10/P10008),[Link](https://doi.org/10.1088/1742-5468/2008/10/P10008)Cited by:[Appendix C](https://arxiv.org/html/2607.20437#A3.p5.1),[§4\.1](https://arxiv.org/html/2607.20437#S4.SS1.p3.2)\.
- \[4\]Z\. Chang, M\. Li, X\. Jia, J\. Wang, Y\. Huang, Z\. Jiang, Y\. Liu, and Q\. Wang\(2025\-11\)One shot dominance: knowledge poisoning attack on retrieval\-augmented generation systems\.InFindings of the Association for Computational Linguistics: EMNLP 2025,C\. Christodoulopoulos, T\. Chakraborty, C\. Rose, and V\. Peng \(Eds\.\),Suzhou, China,pp\. 18811–18825\.External Links:[Link](https://aclanthology.org/2025.findings-emnlp.1023/),[Document](https://dx.doi.org/10.18653/v1/2025.findings-emnlp.1023),ISBN 979\-8\-89176\-335\-7Cited by:[Table 6](https://arxiv.org/html/2607.20437#A3.T6.1.4.3.1),[Appendix C](https://arxiv.org/html/2607.20437#A3.p1.1)\.
- \[5\]J\. Cheeger\(1970\)A lower bound for the smallest eigenvalue of the Laplacian\.InProblems in Analysis: A Symposium in Honor of Salomon Bochner,R\. C\. Gunning \(Ed\.\),pp\. 195–199\.Cited by:[Appendix C](https://arxiv.org/html/2607.20437#A3.p5.1),[§3\.2](https://arxiv.org/html/2607.20437#S3.SS2.p2.6)\.
- \[6\]F\. R\. K\. Chung\(1997\)Spectral graph theory\.CBMS Regional Conference Series in Mathematics, Vol\.92,American Mathematical Society\.Cited by:[Appendix C](https://arxiv.org/html/2607.20437#A3.p5.1),[§D\.2](https://arxiv.org/html/2607.20437#A4.SS2.2.p2.2)\.
- \[7\]A\. Grattafiori, A\. Dubey, A\. Jauhri, A\. Pandey, A\. Kadian, A\. Al\-Dahle, A\. Letman, A\. Mathur, A\. Schelten, A\. Vaughan,et al\.\(2024\)The llama 3 herd of models\.arXiv preprint arXiv:2407\.21783\.Cited by:[§A\.1](https://arxiv.org/html/2607.20437#A1.SS1.p1.1),[§4\.1](https://arxiv.org/html/2607.20437#S4.SS1.p5.1)\.
- \[8\]K\. Greshake, S\. Abdelnabi, S\. Mishra, C\. Endres, T\. Holz, and M\. Fritz\(2023\)Not what you’ve signed up for: compromising real\-world llm\-integrated applications with indirect prompt injection\.InProceedings of the 16th ACM Workshop on Artificial Intelligence and Security,AISec ’23,New York, NY, USA,pp\. 79–90\.External Links:ISBN 9798400702600,[Link](https://doi.org/10.1145/3605764.3623985),[Document](https://dx.doi.org/10.1145/3605764.3623985)Cited by:[Table 6](https://arxiv.org/html/2607.20437#A3.T6.1.6.5.1),[Appendix C](https://arxiv.org/html/2607.20437#A3.p1.1)\.
- \[9\]R\. A\. Horn and C\. R\. Johnson\(2012\)Matrix analysis\.Cambridge University Press\.Cited by:[Appendix C](https://arxiv.org/html/2607.20437#A3.p5.1),[§D\.1](https://arxiv.org/html/2607.20437#A4.SS1.1.p1.6),[§D\.1](https://arxiv.org/html/2607.20437#A4.SS1.10.p10.3),[§3\.1](https://arxiv.org/html/2607.20437#S3.SS1.p1.7)\.
- \[10\]A\. Lees, V\. Q\. Tran, Y\. Tay, J\. Sorensen, J\. Gupta, D\. Metzler, and L\. Vasserman\(2022\)A new generation of perspective api: efficient multilingual character\-level transformers\.InProceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining,pp\. 3197–3207\.External Links:[Document](https://dx.doi.org/10.1145/3534678.3539147),[Link](https://doi.org/10.1145/3534678.3539147)Cited by:[§1](https://arxiv.org/html/2607.20437#S1.p1.1)\.
- \[11\]P\. Lewis, E\. Perez, A\. Piktus, F\. Petroni, V\. Karpukhin, N\. Goyal, H\. Küttler, M\. Lewis, W\. Yih, T\. Rocktäschel, S\. Riedel, and D\. Kiela\(2020\)Retrieval\-augmented generation for knowledge\-intensive nlp tasks\.InProceedings of the 34th International Conference on Neural Information Processing Systems,NIPS ’20\.External Links:ISBN 9781713829546Cited by:[Appendix C](https://arxiv.org/html/2607.20437#A3.p4.1),[§1](https://arxiv.org/html/2607.20437#S1.p1.1)\.
- \[12\]J\. Liang, Y\. Wang, C\. Li, R\. Zhu, T\. Jiang, N\. Gong, and T\. Wang\(2025\)GraphRAG under fire\.arXiv preprint arXiv:2501\.14050\.External Links:[Link](https://arxiv.org/abs/2501.14050)Cited by:[Table 6](https://arxiv.org/html/2607.20437#A3.T6.1.5.4.1),[Appendix C](https://arxiv.org/html/2607.20437#A3.p1.1)\.
- \[13\]Y\. Liu, M\. Ott, N\. Goyal, J\. Du, M\. Joshi, D\. Chen, O\. Levy, M\. Lewis, L\. Zettlemoyer, and V\. Stoyanov\(2019\)RoBERTa: A robustly optimized BERT pretraining approach\.CoRRabs/1907\.11692\.External Links:[Link](http://arxiv.org/abs/1907.11692),1907\.11692Cited by:[§4\.1](https://arxiv.org/html/2607.20437#S4.SS1.p5.1)\.
- \[14\]A\. @\. M\. Llama Team\(2024\)The llama 3 family of models\.Note:[https://github\.com/meta\-llama/PurpleLlama/blob/main/Llama\-Guard3/8B/MODEL\_CARD\.md](https://github.com/meta-llama/PurpleLlama/blob/main/Llama-Guard3/8B/MODEL_CARD.md)Cited by:[§1](https://arxiv.org/html/2607.20437#S1.p1.1),[§4\.1](https://arxiv.org/html/2607.20437#S4.SS1.p5.1)\.
- \[15\]Llama Team\(2024\)Meta Llama guard 2\.Note:[https://github\.com/meta\-llama/PurpleLlama/blob/main/Llama\-Guard2/MODEL\_CARD\.md](https://github.com/meta-llama/PurpleLlama/blob/main/Llama-Guard2/MODEL_CARD.md)Cited by:[Appendix C](https://arxiv.org/html/2607.20437#A3.p2.1),[§1](https://arxiv.org/html/2607.20437#S1.p1.1),[§4\.1](https://arxiv.org/html/2607.20437#S4.SS1.p5.1)\.
- \[16\]M\. E\. J\. Newman\(2006\)Modularity and community structure in networks\.Proceedings of the National Academy of Sciences103\(23\),pp\. 8577–8582\.External Links:[Document](https://dx.doi.org/10.1073/pnas.0601602103),[Link](https://www.pnas.org/doi/abs/10.1073/pnas.0601602103),https://www\.pnas\.org/doi/pdf/10\.1073/pnas\.0601602103Cited by:[Appendix C](https://arxiv.org/html/2607.20437#A3.p3.1),[§4\.1](https://arxiv.org/html/2607.20437#S4.SS1.p3.2)\.
- \[17\]OpenAI\(2024\)GPT\-4o mini: advancing cost\-efficient intelligence\.Note:[https://openai\.com/index/gpt\-4o\-mini\-advancing\-cost\-efficient\-intelligence/](https://openai.com/index/gpt-4o-mini-advancing-cost-efficient-intelligence/)Accessed: 2026\-04\-27Cited by:[§A\.1](https://arxiv.org/html/2607.20437#A1.SS1.p1.1)\.
- \[18\]F\. Perez and I\. Ribeiro\(2022\)Ignore previous prompt: attack techniques for language models\.External Links:2211\.09527,[Link](https://arxiv.org/abs/2211.09527)Cited by:[Appendix C](https://arxiv.org/html/2607.20437#A3.p1.1)\.
- \[19\]A\. Shafran, R\. Schuster, and V\. Shmatikov\(2025\)Machine against the RAG: jamming retrieval\-augmented generation with blocker documents\.In34th USENIX Security Symposium \(USENIX Security 25\),External Links:[Link](https://arxiv.org/abs/2406.05870)Cited by:[Appendix C](https://arxiv.org/html/2607.20437#A3.p1.1)\.
- \[20\]K\. Shuster, S\. Poff, M\. Chen, D\. Kiela, and J\. Weston\(2021\-11\)Retrieval augmentation reduces hallucination in conversation\.InFindings of the Association for Computational Linguistics: EMNLP 2021,M\. Moens, X\. Huang, L\. Specia, and S\. W\. Yih \(Eds\.\),pp\. 3784–3803\.External Links:[Link](https://aclanthology.org/2021.findings-emnlp.320/),[Document](https://dx.doi.org/10.18653/v1/2021.findings-emnlp.320)Cited by:[Appendix C](https://arxiv.org/html/2607.20437#A3.p4.1),[§1](https://arxiv.org/html/2607.20437#S1.p1.1)\.
- \[21\]H\. Trivedi, N\. Balasubramanian, T\. Khot, and A\. Sabharwal\(2022\)MuSiQue: multihop questions via single\-hop question composition\.Transactions of the Association for Computational Linguistics10,pp\. 539–554\.External Links:[Link](https://aclanthology.org/2022.tacl-1.31/),[Document](https://dx.doi.org/10.1162/tacl%5Fa%5F00475)Cited by:[Appendix C](https://arxiv.org/html/2607.20437#A3.p4.1),[§4\.2](https://arxiv.org/html/2607.20437#S4.SS2.p1.1)\.
- \[22\]J\. A\. Tropp\(2012\)User\-friendly tail bounds for sums of random matrices\.Foundations of Computational Mathematics12\(4\),pp\. 389–434\.External Links:[Link](https://doi.org/10.1007/s10208-011-9099-z)Cited by:[Appendix C](https://arxiv.org/html/2607.20437#A3.p5.1)\.
- \[23\]B\. Vidgen, T\. Thrush, Z\. Waseem, and D\. Kiela\(2021\-08\)Learning from the worst: dynamically generated datasets to improve online hate detection\.InProceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing \(Volume 1: Long Papers\),C\. Zong, F\. Xia, W\. Li, and R\. Navigli \(Eds\.\),Online,pp\. 1667–1682\.External Links:[Link](https://aclanthology.org/2021.acl-long.132/),[Document](https://dx.doi.org/10.18653/v1/2021.acl-long.132)Cited by:[Appendix C](https://arxiv.org/html/2607.20437#A3.p2.1),[§4\.1](https://arxiv.org/html/2607.20437#S4.SS1.p5.1)\.
- \[24\]Z\. Yang, P\. Qi, S\. Zhang, Y\. Bengio, W\. Cohen, R\. Salakhutdinov, and C\. D\. Manning\(2018\-October\-November\)HotpotQA: a dataset for diverse, explainable multi\-hop question answering\.InProceedings of the 2018 Conference on Empirical Methods in Natural Language Processing,E\. Riloff, D\. Chiang, J\. Hockenmaier, and J\. Tsujii \(Eds\.\),Brussels, Belgium,pp\. 2369–2380\.External Links:[Link](https://aclanthology.org/D18-1259/),[Document](https://dx.doi.org/10.18653/v1/D18-1259)Cited by:[Appendix C](https://arxiv.org/html/2607.20437#A3.p4.1),[§1](https://arxiv.org/html/2607.20437#S1.p4.4),[§4\.2](https://arxiv.org/html/2607.20437#S4.SS2.p1.1)\.
- \[25\]L\. Zheng, W\. Chiang, Y\. Sheng, S\. Zhuang, Z\. Wu, Y\. Zhuang, Z\. Lin, Z\. Li, D\. Li, E\. Xing, H\. Zhang, J\. Gonzalez, and I\. Stoica\(2023\)Judging llm\-as\-a\-judge with mt\-bench and chatbot arena\.InAdvances in Neural Information Processing Systems,A\. Oh, T\. Naumann, A\. Globerson, K\. Saenko, M\. Hardt, and S\. Levine \(Eds\.\),Vol\.36,pp\. 46595–46623\.External Links:[Link](https://proceedings.neurips.cc/paper_files/paper/2023/file/91f18a1287b398d378ef22505bf41832-Paper-Datasets_and_Benchmarks.pdf)Cited by:[§1](https://arxiv.org/html/2607.20437#S1.p1.1),[§4\.1](https://arxiv.org/html/2607.20437#S4.SS1.p5.1)\.
- \[26\]Z\. Zhong, Z\. Huang, A\. Wettig, and D\. Chen\(2023\-12\)Poisoning retrieval corpora by injecting adversarial passages\.InProceedings of the 2023 Conference on Empirical Methods in Natural Language Processing,H\. Bouamor, J\. Pino, and K\. Bali \(Eds\.\),Singapore,pp\. 13764–13775\.External Links:[Link](https://aclanthology.org/2023.emnlp-main.849/),[Document](https://dx.doi.org/10.18653/v1/2023.emnlp-main.849)Cited by:[Table 6](https://arxiv.org/html/2607.20437#A3.T6.1.3.2.1),[Appendix C](https://arxiv.org/html/2607.20437#A3.p1.1),[§2](https://arxiv.org/html/2607.20437#S2.p7.7)\.
- \[27\]W\. Zou, R\. Geng, B\. Wang, and J\. Jia\(2025\-08\)PoisonedRAG: knowledge corruption attacks to Retrieval\-Augmented generation of large language models\.In34th USENIX Security Symposium \(USENIX Security 25\),Seattle, WA,pp\. 3827–3844\.External Links:ISBN 978\-1\-939133\-52\-6,[Link](https://www.usenix.org/conference/usenixsecurity25/presentation/zou-poisonedrag)Cited by:[Table 6](https://arxiv.org/html/2607.20437#A3.T6.1.2.1.1),[Appendix C](https://arxiv.org/html/2607.20437#A3.p1.1),[Appendix F](https://arxiv.org/html/2607.20437#A6.p1.1),[§1](https://arxiv.org/html/2607.20437#S1.p1.1),[§2](https://arxiv.org/html/2607.20437#S2.p7.7)\.

## Appendix AThreat Model Validation

### A\.1Experimental Setup

We generate 50 adversarial examples using GPT\-4o\-mini across five domains: science, geography, history, technology, and business\. Each example contains a multi\-hop question, a correct answer, a target false answer, and two document sets \(3 documents each, 2\-3 sentences per document\) generated by GPT\-4o mini\[[17](https://arxiv.org/html/2607.20437#bib.bib8)\]\. Legitimate documents form a coherent reasoning chain supporting the correct answer\. Adversarial documents follow a three\-part structure: \(1\) entity introduction without revealing the correct answer, \(2\) false answer description in isolation, and \(3\) a semantic bridge creating domain overlap between the two\. All documents are factually accurate; the adversarial signal exists solely in their composition\. We evaluate usingLlama\-3\-8B\-Instruct\[[7](https://arxiv.org/html/2607.20437#bib.bib7)\]with deterministic decoding \(temperature0\.00\.0,max\_new\_tokens=150\) and a system prompt instructing the model to answer only from the provided documents\. A response is counted as an attack success if the false answer string appears in the model output\.

Key Findings\.Llama\-3\-8B\-Instruct achieves 96% accuracy on legitimate contexts \(48/50\)\. Under attack, ASR reaches 34% \(17/50, 95% CI: \[21%, 47%\],p<0\.001p<0\.001\), while the model declines to answer in 36% of cases\. Out of the 17 successful attacks, 13 \(76\.5%\) involve false entity association and 4 \(23\.5%\) involve spurious reasoning, classified by whether the model output contained causal connectives or exceeded 50 tokens\. These results confirm that split\-knowledge attacks pose a genuine threat to safety\-tuned RAG systems, and that text\-based moderation alone is insufficient\. We note that this experiment validates compositional manipulation in isolation and end\-to\-end validation with a live retrieval corpus is left for future work\.

## Appendix BHyperparameter Validation

### B\.1Hybrid Weight Selection \(α\\alphaSensitivity\)

The hybrid combines spectral and entity signals ass=α⋅sλ2\+\(1−α\)⋅sentitys=\\alpha\\cdot s\_\{\\lambda\_\{2\}\}\+\(1\-\\alpha\)\\cdot s\_\{\\text\{entity\}\}\. We sweepα\\alphaon HotpotQA using the same calibration protocol as Table[1](https://arxiv.org/html/2607.20437#S4.T1):τ\\tauis calibrated on full DEV at the1%1\\%FPR target, and metrics are computed on the held\-out 10k test set with bootstrap CIs over 1000 resamples\. Results are in Table[4](https://arxiv.org/html/2607.20437#A2.T4)\.

On standard attacks, recall peaks nearα=0\.25\\alpha=0\.25\(AUROC0\.9550\.955,Recall@1%1\\%FPR39\.60%39\.60\\%\)\. We nonetheless selectα=0\.40\\alpha=0\.40because it dominatesα=0\.25\\alpha=0\.25on every adaptive adversary \(Table[5](https://arxiv.org/html/2607.20437#A2.T5)\)\. It also has lower benign FPR on multi\-hop queries \(0\.49%0\.49\\%vs0\.85%0\.85\\%overall;1\.94%1\.94\\%vs3\.39%3\.39\\%on the high\-doc\-gap Q4 slice; Table[2](https://arxiv.org/html/2607.20437#S4.T2)\)\. The trade\-off is a small loss in raw recall on standard attacks for substantially better adaptive robustness and benign FPR\. This matches the production deployment goals stated in Section[5](https://arxiv.org/html/2607.20437#S5)\.

The optimum atα=0\.40\\alpha=0\.40places60%60\\%of the weight on entity overlap, indicating entity disjointness is the stronger individual signal for split\-knowledge attacks\. Pure entity \(α=0\\alpha=0\) cannot land precisely at1%1\\%FPR because Jaccard scores take only a few discrete values; the spectral term contributes a continuous score that lets the combined detector hit the operating point exactly\. Performance is stable across a wide range as AUROC stays above0\.940\.94for everyα∈\[0\.10,0\.75\]\\alpha\\in\[0\.10,0\.75\]\.

Table 4:α\\alphasensitivity on HotpotQA\.τ\\tauis calibrated on full DEV atthe 1% FPR target\. Attack metrics are reported on the held\-out 10k test set with bootstrap mean±\\pmstd over 1000 resamples\. Benign FPR is from the 2474 benign multi\-hop queries in Experiment[4\.3](https://arxiv.org/html/2607.20437#S4.SS3)\. Recall and FPR valuesare in percent\. Bold marks the selectedα=0\.40\\alpha=0\.40\.α=1\\alpha=1is pureλ2\\lambda\_\{2\};α=0\\alpha=0is pure entity overlap\.Table 5:Adaptive adversary recall \(%\\%\) at fixed thresholdτ\\tauforα=0\.40\\alpha=0\.40vsα=0\.25\\alpha=0\.25\. Base coloum is non\-adaptive attack from Experiment 4
### B\.2K\-NN Graph Construction \(kSensitivity\)

We validate the choice ofkkforkk\-nearest\-neighbor graph construction by sweepingk∈\{2,4,6,8,10\}k\\in\\\{2,4,6,8,10\\\}and measuring development\-set AUC and score separation \(attack mean minus safe mean\) for both TopoGuard\-λ2\\lambda\_\{2\}and TopoGuard\-Conductance\. Selection is performed on the dev set only; the test set is held out for final evaluation\. Results are shown in Figure[4](https://arxiv.org/html/2607.20437#A2.F4)\.

Both AUC metrics improve sharply fromk=2k=2tok=4k=4\(TopoGuard\-λ2\\lambda\_\{2\}: 0\.891 → 0\.932; TopoGuard\-Conductance: 0\.889 → 0\.935\), then plateau\. Atk=2k=2, the graph is too sparse: many nodes are weakly connected, which obscures the structural signal\. Byk=4k=4, the graph captures enough local connectivity for both detectors to reliably separate attacks from safe contexts\. Beyondk=4k=4, AUC changes by less than0\.0050\.005for both detectors, indicating saturation\. We therefore selectk=4k=4as it achieves the highest dev AUC at minimal computational cost\. All main experiments use this value\.

![Refer to caption](https://arxiv.org/html/2607.20437v1/x4.png)Figure 4:Sensitivity of TopoGuard\-λ2\\lambda\_\{2\}and TopoGuard\-Conductance to the number of nearest neighborskk, evaluated on HotpotQA dev\.Left:dev AUC\.Right:score separation between attack and safe contexts\. Both metrics stabilize atk=4k=4\(dashed red line\), which is used in all experiments\. Selection performed on dev only; test set held out\.

## Appendix CRelated Work

RAG Security and Corpus Poisoning\.PoisonedRAG\[[27](https://arxiv.org/html/2607.20437#bib.bib1)\]demonstrates that injecting a small number of adversarial passages into a retrieval corpus can reliably manipulate LLM outputs\. Subsequent work has explored gradient\-based optimization of poisoned documents\[[26](https://arxiv.org/html/2607.20437#bib.bib14)\], black\-box corpus attacks\[[19](https://arxiv.org/html/2607.20437#bib.bib15)\], and single\-document attacks via LLM\-generated chain\-of\-evidence reasoning\[[4](https://arxiv.org/html/2607.20437#bib.bib28)\]\. Beyond text\-only RAG, GragPoison\[[12](https://arxiv.org/html/2607.20437#bib.bib29)\]demonstrates that graph\-augmented RAG systems are vulnerable to attacks that inject competing relational claims into the underlying knowledge graph\. Prompt injection attacks\[[18](https://arxiv.org/html/2607.20437#bib.bib12),[8](https://arxiv.org/html/2607.20437#bib.bib13)\]manipulate the model through the retrieved context itself rather than the corpus\. Our split\-knowledge attack differs from all of these: each injected document is individually benign and passes standard content filters\. The adversarial signal exists only in the composition of retrieved documents, making it invisible to any per\-document defense\. Table[6](https://arxiv.org/html/2607.20437#A3.T6)summarizes this distinction\.

Table 6:Comparison of representative RAG attack threat models\.Content Moderation and Safety Filters\.LlamaGuard\[[15](https://arxiv.org/html/2607.20437#bib.bib5)\]and its successors are instruction\-tuned LLMs that classify individual inputs as safe or unsafe\. RoBERTa\-based hate speech detectors\[[23](https://arxiv.org/html/2607.20437#bib.bib16)\]and Perspective API operate similarly on single text inputs\. We show empirically that LlamaGuard, RoBERTa\-based detectors, and LLM\-as\-a\-Judge approaches all achieve near\-random performance \(AUROC≈0\.5\\approx 0\.5\) on split\-knowledge attacks: the adversarial signal is structural, not lexical\.

Graph\-Based Anomaly Detection\.Spectral methods are standard in graph anomaly detection\[[1](https://arxiv.org/html/2607.20437#bib.bib17)\], typically on static graphs like social networks or citation networks where anomalies are individual nodes or subgraphs\. The Fiedler value and graph conductance have been used to detect community structure\[[16](https://arxiv.org/html/2607.20437#bib.bib20)\]\. Our setting differs: we build a fresh semantic similarity graph per query, and detection uses the entire graph’s topology\. To our knowledge, we are the first to apply Cheeger\-style certificates to retrieval safety\.

Retrieval\-Augmented Generation\.RAG grounds LLM outputs in retrieved documents\[[11](https://arxiv.org/html/2607.20437#bib.bib18),[20](https://arxiv.org/html/2607.20437#bib.bib3)\]\. Multi\-hop benchmarks like HotpotQA\[[24](https://arxiv.org/html/2607.20437#bib.bib4)\]and MuSiQue\[[21](https://arxiv.org/html/2607.20437#bib.bib19)\]require combining multiple documents per query\. Our threat model targets these systems: the need to combine multiple documents is exactly what creates the compositional vulnerability\.

Spectral Graph Theory and Cheeger Inequalities\.Our theory builds on Cheeger’s inequality\[[5](https://arxiv.org/html/2607.20437#bib.bib24),[6](https://arxiv.org/html/2607.20437#bib.bib26)\], which relates the spectral gap to graph conductance\. Our proofs use Weyl’s inequality\[[9](https://arxiv.org/html/2607.20437#bib.bib22)\]for perturbation and Matrix Bernstein concentration\[[22](https://arxiv.org/html/2607.20437#bib.bib23)\]\. Louvain community detection\[[3](https://arxiv.org/html/2607.20437#bib.bib21)\]underlies our modularity baseline\.

## Appendix DExtended Proofs

### D\.1Proof of Theorem[3\.1](https://arxiv.org/html/2607.20437#S3.Thmtheorem1)\(Spectral Stability\)

LetGGbe the symmetrizedkk\-NN similarity graph from observed embeddings\{𝐱i\}\\\{\\mathbf\{x\}\_\{i\}\\\}, andG∗G^\{\*\}a reference graph from embeddings\{𝐱i∗\}\\\{\\mathbf\{x\}\_\{i\}^\{\*\}\\\}\.

Assume:

1. 1\.Bounded noise:‖𝐱i−𝐱i∗‖2≤σ\\\|\\mathbf\{x\}\_\{i\}\-\\mathbf\{x\}\_\{i\}^\{\*\}\\\|\_\{2\}\\leq\\sigmafor allii\.
2. 2\.kk\-NN margin condition:σ\\sigmais small relative to the gap between each point’skk\-th and\(k\+1\)\(k\{\+\}1\)\-th nearest\-neighbor distances, so thatGGandG∗G^\{\*\}share the same edge set\.
3. 3\.Bounded symmetrized degree: each node has at mostc​kckneighbors for some constantcc\.

Then the spectral gap satisfies:

\|λ2​\(G\)−λ2​\(G∗\)\|=O​\(k​σδmin2\),\|\\lambda\_\{2\}\(G\)\-\\lambda\_\{2\}\(G^\{\*\}\)\|=O\\\!\\left\(\\frac\{k\\sigma\}\{\\delta\_\{\\min\}^\{2\}\}\\right\),whereδmin\\delta\_\{\\min\}is the minimum weighted node degree\.

On Assumption 3\.The symmetrizedkk\-NN graph can in principle have hub nodes with degreeO​\(n\)O\(n\)\. Assumption 3 requires the embedding distribution to have bounded doubling dimension\. On real sentence embeddings this is empirically benign, with observed maximum degrees within a small constant ofkk\.

###### Proof\.

We bound the operator\-norm perturbation‖L−L∗‖2\\\|L\-L^\{\*\}\\\|\_\{2\}of the normalized Laplacian, then apply Weyl’s inequality\[[9](https://arxiv.org/html/2607.20437#bib.bib22)\]to bound the eigenvalue perturbation\|λ2​\(G\)−λ2​\(G∗\)\|\|\\lambda\_\{2\}\(G\)\-\\lambda\_\{2\}\(G^\{\*\}\)\|\. The proof proceeds in four steps: \(i\) bound the edge\-weight perturbation‖W−W∗‖\\\|W\-W^\{\*\}\\\|; \(ii\) bound the degree perturbation‖D−D∗‖\\\|D\-D^\{\*\}\\\|; \(iii\) bound the inverse\-square\-root perturbation‖D−1/2−\(D∗\)−1/2‖\\\|D^\{\-1/2\}\-\(D^\{\*\}\)^\{\-1/2\}\\\|; \(iv\) combine these into the Laplacian bound‖L−L∗‖\\\|L\-L^\{\*\}\\\|\.

Edge\-weight perturbation\.For unit\-norm embeddings, by Cauchy\-Schwarz and Assumption 1:

\|⟨𝐱i,𝐱j⟩−⟨𝐱i∗,𝐱j∗⟩\|≤2​σ\.\|\\langle\\mathbf\{x\}\_\{i\},\\mathbf\{x\}\_\{j\}\\rangle\-\\langle\\mathbf\{x\}\_\{i\}^\{\*\},\\mathbf\{x\}\_\{j\}^\{\*\}\\rangle\|\\leq 2\\sigma\.\(1\)By Assumption 2 \(margin condition\),GGandG∗G^\{\*\}share the same edge set, soW−W∗W\-W^\{\*\}is nonzero only on edges\. The clippingwi​j=max⁡\(0,⟨𝐱i,𝐱j⟩\)w\_\{ij\}=\\max\(0,\\langle\\mathbf\{x\}\_\{i\},\\mathbf\{x\}\_\{j\}\\rangle\)is 1\-Lipschitz, so the bound in \([1](https://arxiv.org/html/2607.20437#A4.E1)\) applies entrywise toW−W∗W\-W^\{\*\}\.

By Assumption 3, each row ofW−W∗W\-W^\{\*\}has at mostc​kcknonzero entries, each bounded by2​σ2\\sigma\. Using the standard row\-sum bound on the operator norm of symmetric matrices,‖M‖2≤‖M‖∞:=maxi​∑j\|Mi​j\|\\\|M\\\|\_\{2\}\\leq\\\|M\\\|\_\{\\infty\}:=\\max\_\{i\}\\sum\_\{j\}\|M\_\{ij\}\|:

‖W−W∗‖2≤‖W−W∗‖∞≤c​k⋅2​σ=2​c​k​σ\.\\\|W\-W^\{\*\}\\\|\_\{2\}\\;\\leq\\;\\\|W\-W^\{\*\}\\\|\_\{\\infty\}\\;\\leq\\;ck\\cdot 2\\sigma\\;=\\;2ck\\sigma\.\(2\)
Degree perturbation\.The weighted degree of nodeiiisDi​i=∑jWi​jD\_\{ii\}=\\sum\_\{j\}W\_\{ij\}, so by the triangle inequality and \([2](https://arxiv.org/html/2607.20437#A4.E2)\):

\|Di​i−Di​i∗\|=\|∑j\(Wi​j−Wi​j∗\)\|≤∑j\|Wi​j−Wi​j∗\|≤2​c​k​σ\.\|D\_\{ii\}\-D\_\{ii\}^\{\*\}\|=\\left\|\\sum\_\{j\}\(W\_\{ij\}\-W\_\{ij\}^\{\*\}\)\\right\|\\leq\\sum\_\{j\}\|W\_\{ij\}\-W\_\{ij\}^\{\*\}\|\\leq 2ck\\sigma\.\(3\)SinceD−D∗D\-D^\{\*\}is diagonal,‖D−D∗‖2=maxi⁡\|Di​i−Di​i∗\|≤2​c​k​σ\\\|D\-D^\{\*\}\\\|\_\{2\}=\\max\_\{i\}\|D\_\{ii\}\-D\_\{ii\}^\{\*\}\|\\leq 2ck\\sigma\.

Inverse\-square\-root perturbation\.Considerf​\(x\)=1/xf\(x\)=1/\\sqrt\{x\}on\[δmin,∞\)\[\\delta\_\{\\min\},\\infty\)\. Its derivative isf′​\(x\)=−12​x−3/2f^\{\\prime\}\(x\)=\-\\tfrac\{1\}\{2\}x^\{\-3/2\}, so the Lipschitz constant on this interval is:

supx≥δmin\|f′​\(x\)\|=12​δmin−3/2\.\\sup\_\{x\\geq\\delta\_\{\\min\}\}\|f^\{\\prime\}\(x\)\|=\\tfrac\{1\}\{2\}\\delta\_\{\\min\}^\{\-3/2\}\.\(4\)SinceDDandD∗D^\{\*\}are diagonal, applyingffentrywise and taking the operator norm:

‖D−1/2−\(D∗\)−1/2‖2≤12​δmin−3/2⋅‖D−D∗‖2=O​\(k​σδmin3/2\),\\\|D^\{\-1/2\}\-\(D^\{\*\}\)^\{\-1/2\}\\\|\_\{2\}\\leq\\tfrac\{1\}\{2\}\\delta\_\{\\min\}^\{\-3/2\}\\cdot\\\|D\-D^\{\*\}\\\|\_\{2\}=O\\\!\\left\(\\frac\{k\\sigma\}\{\\delta\_\{\\min\}^\{3/2\}\}\\right\),\(5\)combining \([4](https://arxiv.org/html/2607.20437#A4.E4)\) and \([3](https://arxiv.org/html/2607.20437#A4.E3)\)\.

Laplacian perturbation\.The normalized Laplacian isL=I−D−1/2​W​D−1/2L=I\-D^\{\-1/2\}WD^\{\-1/2\}\. LetA=D−1/2A=D^\{\-1/2\}andA∗=\(D∗\)−1/2A^\{\*\}=\(D^\{\*\}\)^\{\-1/2\}\. We expandL−L∗L\-L^\{\*\}via the algebraic identity:

A​W​A−A∗​W∗​A∗=\(A−A∗\)​W​A\+A∗​\(W−W∗\)​A\+A∗​W∗​\(A−A∗\)\.AWA\-A^\{\*\}W^\{\*\}A^\{\*\}=\(A\-A^\{\*\}\)WA\+A^\{\*\}\(W\-W^\{\*\}\)A\+A^\{\*\}W^\{\*\}\(A\-A^\{\*\}\)\.\(6\)
From a standard three\-term telescoping,A​W​A−A∗​W∗​A∗AWA\-A^\{\*\}W^\{\*\}A^\{\*\}as\(A​W​A−A∗​W​A\)\+\(A∗​W​A−A∗​W∗​A\)\+\(A∗​W∗​A−A∗​W∗​A∗\)\(AWA\-A^\{\*\}WA\)\+\(A^\{\*\}WA\-A^\{\*\}W^\{\*\}A\)\+\(A^\{\*\}W^\{\*\}A\-A^\{\*\}W^\{\*\}A^\{\*\}\),

We bound each of the three terms\. We use:

- •‖W‖2=O​\(1\)\\\|W\\\|\_\{2\}=O\(1\)\(bounded weightswi​j∈\[0,1\]w\_\{ij\}\\in\[0,1\]withO​\(k\)O\(k\)nonzero entries per row, treatingkkas a constant\)\.
- •‖A‖2=‖D−1/2‖2≤δmin−1/2\\\|A\\\|\_\{2\}=\\\|D^\{\-1/2\}\\\|\_\{2\}\\leq\\delta\_\{\\min\}^\{\-1/2\}\(operator norm of a diagonal matrix is the max diagonal entry\)\.
- •‖A−A∗‖2=O​\(k​σ/δmin3/2\)\\\|A\-A^\{\*\}\\\|\_\{2\}=O\(k\\sigma/\\delta\_\{\\min\}^\{3/2\}\)from \([5](https://arxiv.org/html/2607.20437#A4.E5)\)\.
- •‖W−W∗‖2=O​\(k​σ\)\\\|W\-W^\{\*\}\\\|\_\{2\}=O\(k\\sigma\)from \([2](https://arxiv.org/html/2607.20437#A4.E2)\)\.

Applying these bounds to the three terms of \([6](https://arxiv.org/html/2607.20437#A4.E6)\) using \(‖X​Y‖2≤‖X‖2​‖Y‖2\\\|XY\\\|\_\{2\}\\leq\\\|X\\\|\_\{2\}\\\|Y\\\|\_\{2\}\):

‖\(A−A∗\)​W​A‖2\\displaystyle\\\|\(A\-A^\{\*\}\)WA\\\|\_\{2\}≤‖A−A∗‖2​‖W‖2​‖A‖2=O​\(k​σδmin3/2\)⋅O​\(1\)⋅O​\(1δmin1/2\)=O​\(k​σδmin2\),\\displaystyle\\leq\\\|A\-A^\{\*\}\\\|\_\{2\}\\\|W\\\|\_\{2\}\\\|A\\\|\_\{2\}=O\\\!\\left\(\\tfrac\{k\\sigma\}\{\\delta\_\{\\min\}^\{3/2\}\}\\right\)\\cdot O\(1\)\\cdot O\\\!\\left\(\\tfrac\{1\}\{\\delta\_\{\\min\}^\{1/2\}\}\\right\)=O\\\!\\left\(\\tfrac\{k\\sigma\}\{\\delta\_\{\\min\}^\{2\}\}\\right\),‖A∗​\(W−W∗\)​A‖2\\displaystyle\\\|A^\{\*\}\(W\-W^\{\*\}\)A\\\|\_\{2\}≤‖A∗‖2​‖W−W∗‖2​‖A‖2=O​\(1δmin1/2\)⋅O​\(k​σ\)⋅O​\(1δmin1/2\)=O​\(k​σδmin\),\\displaystyle\\leq\\\|A^\{\*\}\\\|\_\{2\}\\\|W\-W^\{\*\}\\\|\_\{2\}\\\|A\\\|\_\{2\}=O\\\!\\left\(\\tfrac\{1\}\{\\delta\_\{\\min\}^\{1/2\}\}\\right\)\\cdot O\(k\\sigma\)\\cdot O\\\!\\left\(\\tfrac\{1\}\{\\delta\_\{\\min\}^\{1/2\}\}\\right\)=O\\\!\\left\(\\tfrac\{k\\sigma\}\{\\delta\_\{\\min\}\}\\right\),‖A∗​W∗​\(A−A∗\)‖2\\displaystyle\\\|A^\{\*\}W^\{\*\}\(A\-A^\{\*\}\)\\\|\_\{2\}≤‖A∗‖2​‖W∗‖2​‖A−A∗‖2=O​\(k​σδmin2\)\.\\displaystyle\\leq\\\|A^\{\*\}\\\|\_\{2\}\\\|W^\{\*\}\\\|\_\{2\}\\\|A\-A^\{\*\}\\\|\_\{2\}=O\\\!\\left\(\\tfrac\{k\\sigma\}\{\\delta\_\{\\min\}^\{2\}\}\\right\)\.For smallδmin\\delta\_\{\\min\}, the first and third terms \(scaling asδmin−2\\delta\_\{\\min\}^\{\-2\}\) dominate the second \(scaling asδmin−1\\delta\_\{\\min\}^\{\-1\}\)\. By the triangle inequality:

‖L−L∗‖2≤O​\(k​σδmin2\)\.\\\|L\-L^\{\*\}\\\|\_\{2\}\\leq O\\\!\\left\(\\frac\{k\\sigma\}\{\\delta\_\{\\min\}^\{2\}\}\\right\)\.\(7\)
Conclusion\.Weyl’s inequality\[[9](https://arxiv.org/html/2607.20437#bib.bib22)\]states that for symmetric matrices,\|λi​\(L\)−λi​\(L∗\)\|≤‖L−L∗‖2\|\\lambda\_\{i\}\(L\)\-\\lambda\_\{i\}\(L^\{\*\}\)\|\\leq\\\|L\-L^\{\*\}\\\|\_\{2\}for every eigenvalue indexii\. Applied toi=2i=2:

\|λ2​\(G\)−λ2​\(G∗\)\|≤‖L−L∗‖2=O​\(k​σδmin2\),\|\\lambda\_\{2\}\(G\)\-\\lambda\_\{2\}\(G^\{\*\}\)\|\\leq\\\|L\-L^\{\*\}\\\|\_\{2\}=O\\\!\\left\(\\frac\{k\\sigma\}\{\\delta\_\{\\min\}^\{2\}\}\\right\),\(8\)combining \([7](https://arxiv.org/html/2607.20437#A4.E7)\) with Weyl’s inequality\. ∎

### D\.2Proof of Theorem[3\.2](https://arxiv.org/html/2607.20437#S3.Thmtheorem2)\(Detection Certificate\)

Suppose reference attack graphs have conductanceϕ​\(G∗\)≤δ\\phi\(G^\{\*\}\)\\leq\\deltaand reference legitimate graphs haveϕ​\(G∗\)≥ϵ\\phi\(G^\{\*\}\)\\geq\\epsilon, withϵ≥2​δ\\epsilon\\geq 2\\sqrt\{\\delta\}\. Assume embedding noise components are sub\-Gaussian with parameterσ\\sigmaand thekk\-NN margin condition of Theorem[3\.1](https://arxiv.org/html/2607.20437#S3.Thmtheorem1)\. Letτλ=δ\+ϵ2/4\\tau\_\{\\lambda\}=\\delta\+\\epsilon^\{2\}/4denote the threshold inλ2\\lambda\_\{2\}\-space, with corresponding score\-space thresholdτ=1−min⁡\(τλ,1\)\\tau=1\-\\min\(\\tau\_\{\\lambda\},1\), and marginΔ=\(ϵ2−4​δ\)/4\>0\\Delta=\(\\epsilon^\{2\}\-4\\delta\)/4\>0\.

Then:

PrD∼Attack⁡\[s​\(D\)\>τ\]\\displaystyle\\Pr\_\{D\\sim\\text\{Attack\}\}\[s\(D\)\>\\tau\]≥1−exp⁡\(−Ω​\(n​Δ2σ2\)\),\\displaystyle\\geq 1\-\\exp\\\!\\left\(\-\\Omega\\\!\\left\(\\tfrac\{n\\Delta^\{2\}\}\{\\sigma^\{2\}\}\\right\)\\right\),PrD∼Legit⁡\[s​\(D\)\>τ\]\\displaystyle\\Pr\_\{D\\sim\\text\{Legit\}\}\[s\(D\)\>\\tau\]≤exp⁡\(−Ω​\(n​Δ2σ2\)\)\.\\displaystyle\\leq\\exp\\\!\\left\(\-\\Omega\\\!\\left\(\\tfrac\{n\\Delta^\{2\}\}\{\\sigma^\{2\}\}\\right\)\\right\)\.The first bound is the true positive rate \(TPR\) at thresholdτ\\tau\. The second is the false positive rate \(FPR\)\. Both improve exponentially with the number of retrieved unitsnn\.

On the concentration bound\.The boundPr⁡\(‖L−L∗‖2≥t\)≤exp⁡\(−Ω​\(n​t2/σ2\)\)\\Pr\(\\\|L\-L^\{\*\}\\\|\_\{2\}\\geq t\)\\leq\\exp\(\-\\Omega\(nt^\{2\}/\\sigma^\{2\}\)\)used in the proof treats the Laplacian perturbation as if it concentrated like a sum of independent random matrices\. In akk\-NN similarity graph, edges are coupled through degree normalization and neighbor selection, so the formal preconditions of Matrix Bernstein\-type bounds do not apply directly\. We treat this as a heuristic concentration that captures the qualitative scaling\. A fully rigorous concentration analysis underkk\-NN graph structure is left to future work\.

###### Proof\.

We first translate the conductance bounds \(ϕ≤δ\\phi\\leq\\deltafor attacks,ϕ≥ϵ\\phi\\geq\\epsilonfor legit\) into bounds onλ2\\lambda\_\{2\}using Cheeger’s inequality\. The conditionϵ≥2​δ\\epsilon\\geq 2\\sqrt\{\\delta\}guarantees a positive margin between attack and legitimateλ2\\lambda\_\{2\}regimes\. Theorem[3\.1](https://arxiv.org/html/2607.20437#S3.Thmtheorem1)plus a heuristic concentration bound then gives exponential tail bounds on the probability that the noisyλ2​\(G\)\\lambda\_\{2\}\(G\)deviates from the ideal value by more than the margin\. Finally, we convert theseλ2\\lambda\_\{2\}\-space bounds to score\-space bounds \(FPR and TPR\) using the monotonicity of the scoring function\.

Cheeger bounds onλ2\\lambda\_\{2\}\.Cheeger’s inequality\[[6](https://arxiv.org/html/2607.20437#bib.bib26)\]relates the spectral gap to graph conductance via the two\-sided boundϕ2/2≤λ2≤2​ϕ\\phi^\{2\}/2\\leq\\lambda\_\{2\}\\leq 2\\phi\. Applying both directions:

Attack regime:λ2​\(G∗\)≤2​ϕ​\(G∗\)≤2​δ,\\displaystyle\\lambda\_\{2\}\(G^\{\*\}\)\\leq 2\\phi\(G^\{\*\}\)\\leq 2\\delta,\(9\)Legitimate regime:λ2​\(G∗\)≥ϕ​\(G∗\)2/2≥ϵ2/2\.\\displaystyle\\lambda\_\{2\}\(G^\{\*\}\)\\geq\\phi\(G^\{\*\}\)^\{2\}/2\\geq\\epsilon^\{2\}/2\.\(10\)
Threshold and margin\.The conditionϵ≥2​δ\\epsilon\\geq 2\\sqrt\{\\delta\}rearranges toϵ2≥4​δ\\epsilon^\{2\}\\geq 4\\delta, which guarantees that the attack ceiling2​δ2\\deltalies strictly below the legitimate floorϵ2/2\\epsilon^\{2\}/2:

2​δ<δ\+ϵ24<ϵ22\.2\\delta<\\delta\+\\frac\{\\epsilon^\{2\}\}\{4\}<\\frac\{\\epsilon^\{2\}\}\{2\}\.\(11\)The thresholdτλ=δ\+ϵ2/4\\tau\_\{\\lambda\}=\\delta\+\\epsilon^\{2\}/4is the midpoint of the gap\[2​δ,ϵ2/2\]\[2\\delta,\\epsilon^\{2\}/2\], with equal margin to either side:

Δ:=τλ−2​δ=ϵ22−τλ=ϵ2−4​δ4\>0\.\\Delta:=\\tau\_\{\\lambda\}\-2\\delta=\\frac\{\\epsilon^\{2\}\}\{2\}\-\\tau\_\{\\lambda\}=\\frac\{\\epsilon^\{2\}\-4\\delta\}\{4\}\>0\.\(12\)
Detection failure events\.By Theorem[3\.1](https://arxiv.org/html/2607.20437#S3.Thmtheorem1), the observedλ2​\(G\)\\lambda\_\{2\}\(G\)deviates from the idealλ2​\(G∗\)\\lambda\_\{2\}\(G^\{\*\}\)by\|λ2​\(G\)−λ2​\(G∗\)\|≤‖L−L∗‖2\|\\lambda\_\{2\}\(G\)\-\\lambda\_\{2\}\(G^\{\*\}\)\|\\leq\\\|L\-L^\{\*\}\\\|\_\{2\}\. Combining with the regime bounds \([9](https://arxiv.org/html/2607.20437#A4.E9)\)–\([10](https://arxiv.org/html/2607.20437#A4.E10)\):

- •For an attack to be missed \(false negative\), we needλ2​\(G\)\>τλ\\lambda\_\{2\}\(G\)\>\\tau\_\{\\lambda\}\. Sinceλ2​\(G∗\)≤2​δ\\lambda\_\{2\}\(G^\{\*\}\)\\leq 2\\deltafor attacks andτλ−2​δ=Δ\\tau\_\{\\lambda\}\-2\\delta=\\Delta, this requires‖L−L∗‖2\>Δ\\\|L\-L^\{\*\}\\\|\_\{2\}\>\\Delta\.
- •For a legitimate query to be flagged \(false positive\), we needλ2​\(G\)<τλ\\lambda\_\{2\}\(G\)<\\tau\_\{\\lambda\}\. Sinceλ2​\(G∗\)≥ϵ2/2\\lambda\_\{2\}\(G^\{\*\}\)\\geq\\epsilon^\{2\}/2for legit andϵ2/2−τλ=Δ\\epsilon^\{2\}/2\-\\tau\_\{\\lambda\}=\\Delta, this also requires‖L−L∗‖2\>Δ\\\|L\-L^\{\*\}\\\|\_\{2\}\>\\Delta\.

Both failure events thus reduce to the same Laplacian\-perturbation event:

\{‖L−L∗‖2\>Δ\}\.\\\{\\\|L\-L^\{\*\}\\\|\_\{2\}\>\\Delta\\\}\.\(13\)
Concentration\.Standard concentration arguments on the operator\-norm perturbation of the normalized Laplacian under sub\-Gaussian embedding noise yield:

Pr⁡\(‖L−L∗‖2≥t\)≤exp⁡\(−Ω​\(n​t2σ2\)\)\.\\Pr\(\\\|L\-L^\{\*\}\\\|\_\{2\}\\geq t\)\\leq\\exp\\\!\\left\(\-\\Omega\\\!\\left\(\\frac\{nt^\{2\}\}\{\\sigma^\{2\}\}\\right\)\\right\)\.\(14\)Settingt=Δt=\\Deltaand using the failure\-event reduction \([13](https://arxiv.org/html/2607.20437#A4.E13)\):

PrD∼Attack⁡\[λ2​\(G\)\>τλ\]\\displaystyle\\Pr\_\{D\\sim\\text\{Attack\}\}\[\\lambda\_\{2\}\(G\)\>\\tau\_\{\\lambda\}\]≤exp⁡\(−Ω​\(n​Δ2σ2\)\),\\displaystyle\\leq\\exp\\\!\\left\(\-\\Omega\\\!\\left\(\\frac\{n\\Delta^\{2\}\}\{\\sigma^\{2\}\}\\right\)\\right\),\(15\)PrD∼Legit⁡\[λ2​\(G\)<τλ\]\\displaystyle\\Pr\_\{D\\sim\\text\{Legit\}\}\[\\lambda\_\{2\}\(G\)<\\tau\_\{\\lambda\}\]≤exp⁡\(−Ω​\(n​Δ2σ2\)\)\.\\displaystyle\\leq\\exp\\\!\\left\(\-\\Omega\\\!\\left\(\\frac\{n\\Delta^\{2\}\}\{\\sigma^\{2\}\}\\right\)\\right\)\.\(16\)
Score\-space conversion \(FPR and TPR\)\.The detector score iss​\(D\)=1−min⁡\(λ2​\(G\),1\)s\(D\)=1\-\\min\(\\lambda\_\{2\}\(G\),1\), which is monotone decreasing inλ2\\lambda\_\{2\}\. Equivalently,λ2​\(G\)\>τλ⇔s​\(D\)<1−τλ=τ\\lambda\_\{2\}\(G\)\>\\tau\_\{\\lambda\}\\iff s\(D\)<1\-\\tau\_\{\\lambda\}=\\tau\(whenτλ≤1\\tau\_\{\\lambda\}\\leq 1\)\. Substituting into \([15](https://arxiv.org/html/2607.20437#A4.E15)\)\-\([16](https://arxiv.org/html/2607.20437#A4.E16)\):

True positive rate\(Pr⁡\[s​\(D\)\>τ∣attack\]\\Pr\[s\(D\)\>\\tau\\mid\\text\{attack\}\]\):

PrD∼Attack⁡\[s​\(D\)\>τ\]=1−PrD∼Attack⁡\[s​\(D\)≤τ\]≥1−exp⁡\(−Ω​\(n​Δ2σ2\)\)\.\\Pr\_\{D\\sim\\text\{Attack\}\}\[s\(D\)\>\\tau\]=1\-\\Pr\_\{D\\sim\\text\{Attack\}\}\[s\(D\)\\leq\\tau\]\\geq 1\-\\exp\\\!\\left\(\-\\Omega\\\!\\left\(\\frac\{n\\Delta^\{2\}\}\{\\sigma^\{2\}\}\\right\)\\right\)\.\(17\)
False positive rate\(Pr⁡\[s​\(D\)\>τ∣legit\]\\Pr\[s\(D\)\>\\tau\\mid\\text\{legit\}\]\):

PrD∼Legit⁡\[s​\(D\)\>τ\]=PrD∼Legit⁡\[λ2​\(G\)<τλ\]≤exp⁡\(−Ω​\(n​Δ2σ2\)\)\.\\Pr\_\{D\\sim\\text\{Legit\}\}\[s\(D\)\>\\tau\]=\\Pr\_\{D\\sim\\text\{Legit\}\}\[\\lambda\_\{2\}\(G\)<\\tau\_\{\\lambda\}\]\\leq\\exp\\\!\\left\(\-\\Omega\\\!\\left\(\\frac\{n\\Delta^\{2\}\}\{\\sigma^\{2\}\}\\right\)\\right\)\.\(18\)These are the stated bounds: TPR approaches 1 and FPR approaches 0 exponentially innn\. ∎

### D\.3Proof of Corollary[3\.1](https://arxiv.org/html/2607.20437#S3.Thmcorollary1)\(Sample Complexity\)

###### Proof\.

By Theorem[3\.2](https://arxiv.org/html/2607.20437#S3.Thmtheorem2), both the false negative and false positive probabilities are bounded byexp⁡\(−Ω​\(n​Δ2/σ2\)\)\\exp\(\-\\Omega\(n\\Delta^\{2\}/\\sigma^\{2\}\)\)whereΔ=\(ϵ2−4​δ\)/4\\Delta=\(\\epsilon^\{2\}\-4\\delta\)/4\. Requiring this bound to be at mostmin⁡\(α,β\)\\min\(\\alpha,\\beta\):

exp⁡\(−Ω​\(n​Δ2σ2\)\)≤min⁡\(α,β\)\.\\exp\\\!\\left\(\-\\Omega\\\!\\left\(\\frac\{n\\Delta^\{2\}\}\{\\sigma^\{2\}\}\\right\)\\right\)\\leq\\min\(\\alpha,\\beta\)\.\(19\)Taking logarithms of both sides and rearranging:

n≥Ω​\(σ2Δ2​log⁡1min⁡\(α,β\)\)\.n\\geq\\Omega\\\!\\left\(\\frac\{\\sigma^\{2\}\}\{\\Delta^\{2\}\}\\log\\frac\{1\}\{\\min\(\\alpha,\\beta\)\}\\right\)\.\(20\)SubstitutingΔ2=\(ϵ2−4​δ\)2/16\\Delta^\{2\}=\(\\epsilon^\{2\}\-4\\delta\)^\{2\}/16and absorbing the constant1616into the big\-OO:

n=O​\(σ2\(ϵ2−4​δ\)2​log⁡1min⁡\(α,β\)\)\.n=O\\\!\\left\(\\frac\{\\sigma^\{2\}\}\{\(\\epsilon^\{2\}\-4\\delta\)^\{2\}\}\\log\\frac\{1\}\{\\min\(\\alpha,\\beta\)\}\\right\)\.\(21\)∎

## Appendix ETheory Validation

We empirically test the two assumptions behind our detection guarantees: the bounded\-noise model \(Theorem[3\.1](https://arxiv.org/html/2607.20437#S3.Thmtheorem1)\) and the sample complexity bound \(Corollary[3\.1](https://arxiv.org/html/2607.20437#S3.Thmcorollary1)\)\.

Noise model\.Theorem[3\.1](https://arxiv.org/html/2607.20437#S3.Thmtheorem1)assumes bounded encoder noise; the concentration argument in Theorem[3\.2](https://arxiv.org/html/2607.20437#S3.Thmtheorem2)additionally treats this noise as sub\-Gaussian\. We do not observe the ideal semantic geometry directly, so we report two proxies\. \(i\) The encoder \(all\-mpnet\-base\-v2\) is deterministic at inference: re\-encoding the same text yields identical outputs, so the encoder contributes no stochastic component\. \(ii\) Across 200 HotpotQA safe contexts, the pairwise cosine\-similarity distribution \(Figure[5](https://arxiv.org/html/2607.20437#A5.F5)a\) is approximately Gaussian \(μ=0\.34\\mu=0\.34,σ=0\.18\\sigma=0\.18\), indicating that embedding geometry is well\-behaved and not dominated by heavy\-tailed outliers\. This supports the sub\-Gaussian assumption at the distributional level\. The effectiveσ\\sigma\(the gap between observed and ideal embeddings\) is not directly measurable, and our bounds hold under this assumption rather than as direct empirical guarantees\.

Sample complexity\.Corollary[3\.1](https://arxiv.org/html/2607.20437#S3.Thmcorollary1)predicts that recall improves with context size\. We vary sentences\-per\-documents∈\{1,…,6\}s\\in\\\{1,\\dots,6\\\}, giving total context sizes2​s2s, and recalibrateτ\\tauon the dev set at eachss\(Figure[5](https://arxiv.org/html/2607.20437#A5.F5)b\)\. Recall rises from21\.1%21\.1\\%ats=1s\{=\}1to26\.6%26\.6\\%ats=3s\{=\}3, then plateaus\. The plateau reflects HotpotQA’s fixed 6\-sentence contexts rather than a fundamental method limit\.

Boundary case ats=2s\{=\}2\.Ats=2s\{=\}2\(4 nodes\),keff=min⁡\(k,n−1\)=3k\_\{\\text\{eff\}\}=\\min\(k,n\{\-\}1\)=3forces a complete graph\. Recall spikes to75\.3%75\.3\\%, but FPR rises to1\.15%1\.15\\%, slightly above the1%1\\%target\. This is consistent with theory that the detection improves as the graph approaches completeness, but threshold calibration becomes geometry\-sensitive at smallnn\. Our main experiments uses=3s\{=\}3where this regime is avoided\.

![Refer to caption](https://arxiv.org/html/2607.20437v1/x5.png)Figure 5:Theory validation on HotpotQA\.\(a\)Pairwise cosine\-similarity distribution across safe contexts is approximately Gaussian, consistent with sub\-Gaussian embedding geometry\.\(b\)Recall vs\. context sizess\(sentences per document\)\.
## Appendix FEvaluation on PoisonedRAG Attacks

We test TopoGuard on single\-passage attacks from PoisonedRAG\[[27](https://arxiv.org/html/2607.20437#bib.bib1)\]to confirm that our scope is compositional attacks, not content\-level injection\. We use the pre\-computed adversarial contexts released with PoisonedRAG \(HotpotQA,Contriever retriever,N=100N\{=\}100attacks\) and reuse Experiment 1’s HotpotQA safe set\.

Setup\.All contexts are fixed at 6 sentences to match our main calibration\. Attack\-1 replaces one clean sentence with one adversarial sentence \(1:5 ratio; PoisonedRAG’s realistic threat model\)\. Attack\-3 replaces three clean sentences with three adversarial sentences \(3:3 ratio; matches our split\-knowledge composition\)\. For the safe set, we use 2499 HotpotQA test contexts \(similar in construction to Section[4\.3](https://arxiv.org/html/2607.20437#S4.SS3)’s 2474 question safe pool, with no material effect on FPR estimates\)\. Thresholds are frozen from Experiment 1 with no re\-tuning\. The frozenτ\\tauyields FPRs of 0\.60% \(λ2\\lambda\_\{2\}\), 0\.68% \(Cond\), 0\.80% \(Mod\), confirming calibration transfers to this pipeline\.

Table 7:TopoGuard on PoisonedRAG\. Under faithful 1:5 injection, all detectors score below chance with negative separation\. Recall values are in percent\.Attack\-1 confirms our scope claim empirically\. PoisonedRAG optimizes each adversarial passage to embed near the query, which also places it inside the cluster of legitimate retrievals, reducing rather than increasing spectral fragmentation\. Hence the negative score separation: TopoGuard’s decision boundary is oriented the wrong way for this threat model\. Attack\-3 uses the same adversarial text as Attack\-1 but at higher injection density\. Performance recovers to AUROC≈0\.95\\approx 0\.95, matching split\-knowledge\. The signal TopoGuard detects is therefore compositional disruption, not PoisonedRAG content itself\. Single\-passage and compositional attacks occupy orthogonal regions of the threat space, and defenses are complementary\. TopoGuard should be paired with a per\-passage check \(e\.g\., retrieval\-score consistency\) for full coverage\.

## Appendix GMuSiQue Detection Analysis

### G\.1Why MuSiQue Detection is Harder

TopoGuard achieves significantly lower recall on MuSiQue \(5–7%\) than on HotpotQA \(26–35%\)\. We show this is a fundamental property of the dataset, not a failure of the method, by analyzing the document gap \(the cosine distance\) between the mean embeddings of the two retrieved documents per query\. Table[8](https://arxiv.org/html/2607.20437#A7.T8)shows the mean document gap for safe and attack contexts on both datasets\. On HotpotQA, safe and attack contexts are clearly separated \(0\.539 vs\. 0\.881, margin of 0\.342\), giving the spectral detector a strong signal\. On MuSiQue, this margin shrinks to 0\.200 \(0\.717 vs\. 0\.917\) because legitimate multi\-hop queries naturally span semantically distant domains\.

Table 8:Mean document gap \(1−\-cosine similarity\) by dataset and split\.Table 9:Full FPR \(%\) stratification on benign multi\-hop queries by semantic distance \(doc\-gap\)\.
### G\.2MuSiQue Q4 Queries Resemble Attacks

Figure[6](https://arxiv.org/html/2607.20437#A7.F6)shows the full document gap distributions\. The key finding is in Panel \(b\): MuSiQue Q4 safe contexts \(the 25% of legitimate queries with the highest document gap\) reach a mean gap of 0\.947\. This is nearly identical to HotpotQA attacks \(0\.881\)\. Specifically, 76\.1% of MuSiQue Q4 safe gaps exceed the median HotpotQA attack gap, and the two distributions are statistically distinct \(KSp<0\.001p<0\.001\) only because MuSiQue Q4 gaps are actually higher than HotpotQA attacks, not lower\. This means the detector correctly flags MuSiQue Q4 queries as anomalous but they are legitimate\. The low MuSiQue recall is therefore a consequence of operating near the theoretical detection limit: when legitimate queries are as semantically disconnected as attacks, no structural detector can reliably distinguish them without additional context such as the query itself or entity overlap\.

These results suggest that query\-conditioned detection i\.e\. using the query to anchor expected document connectivity could resolve the ambiguity for MuSiQue\-style cross\-domain reasoning\. We leave this extension to future work\.

![Refer to caption](https://arxiv.org/html/2607.20437v1/x6.png)Figure 6:Document gap distributions\.\(a\)HotpotQA safe contexts \(blue\) are well\-separated from attacks \(red\) and MuSiQue safe contexts \(green\) overlap substantially with HotpotQA attacks\.\(b\)MuSiQue Q4 safe contexts have gaps nearly identical to HotpotQA attacks\.

## Appendix HFull FPR Stratification by Document Gap

Table[9](https://arxiv.org/html/2607.20437#A7.T9)presents the full FPR breakdown by document\-gap quartile for both datasets\. Q1 contains the queries with the lowest semantic distance between supporting documents; Q4 contains the highest\. On HotpotQA, all topological methods achieve exactly 0% FPR on Q1–Q3, confirming that natural multi\-hop reasoning chains are not flagged\. Errors concentrate entirely in Q4, where legitimate queries span the most distant semantic domains\. MuSiQue shows a similar but noisier pattern due to its deliberate cross\-domain design \(Appendix[G](https://arxiv.org/html/2607.20437#A7)\)\.

Table 10:TopoGuard across three encoder families on HotpotQA \(k=4k\{=\}4, 1% FPR target\)\.τ\\taurecalibrated per encoder\. Bootstrap mean±\\pmstd over 1,000 resamples\.Table 11:Self\-supervised vs supervised calibration\. Self\-supervised uses only the 99th percentile of benign dev scores; no attack labels are used\. Recall is reported as bootstrap mean±\\pmstd at the calibratedτ\\tau\.
## Appendix IEncoder Generalization

We test whether TopoGuard generalizes beyond the MPNet encoder used in our main experiments\. We re\-run TopoGuard\-λ2\\lambda\_\{2\}and TopoGuard\-λ2\\lambda\_\{2\}\+Entity on HotpotQA with two additional sentence encoders: BGE\-small\-en\-v1\.5 \(384\-dim, retrieval\-tuned\) and all\-MiniLM\-L12\-v2 \(384\-dim, distilled\)\.τ\\tauis recalibrated on the dev set for each encoder using the self\-supervised procedure \(Section[5](https://arxiv.org/html/2607.20437#S5)\)\.

Table[10](https://arxiv.org/html/2607.20437#A8.T10)reports the results\. AUROC stays in a tight range across all three encoders \(91\.5–95\.2%\), confirming the topological signal is not specific to MPNet\. The hybrid detector is consistently strong across encoders \(94\.2–95\.2% AUROC, 32\.6–34\.8% Recall@1%FPR\) and is the most encoder\-robust configuration\. TopoGuard\-λ2\\lambda\_\{2\}alone is more sensitive: BGE\-small matches MPNet, while MiniLM drops to 21\.3% recall\. This reflects the known sensitivity of strict\-FPR operating points to score\-distribution shifts\. For production, we recommend the hybrid detector with MPNet or BGE\-small as the encoder\.

## Appendix JLabel\-Free Calibration: Empirical Validation

Threshold calibration for a target false positive rate depends only on the negative\-class score distribution; attack labels are not mathematically required\. We verify empirically that recall is preserved under this standard label\-free procedure compared to supervised calibration that uses dev attack labels to confirm the FPR target\.

Table[11](https://arxiv.org/html/2607.20437#A8.T11)reports the comparison across all four detectors and both datasets\. Self\-supervised calibration setsτ\\tauat the 99th percentile of benign dev scores\. TheΔ\\DeltaRecall column shows the gap to supervised calibration; in all 8 settings the gap is below 0\.07pp, well within bootstrap noise\.

## Appendix KCompute Resources

All experiments use a single NVIDIA L40S GPU\. TopoGuard’s spectral computations themselves are CPU\-runnable in sub\-millisecond time per query \(Figure[3](https://arxiv.org/html/2607.20437#S4.F3)\); the GPU is used only for sentence\-embedding \(all\-mpnet\-base\-v2 in main experiments, BGE\-small/MiniLM in the encoder ablation\) and for LLM\-based baselines\.

## Appendix LBroader Impact Statement

TopoGuard is a defensive contribution that makes production RAG systems more resistant to compositional attacks\. It provides a sub\-millisecond detection layer that runs alongside existing content moderation, calibrates without labeled attacks, and re\-tunes predictably when retrieval configurations change\. By releasing the defense alongside the threat model, we aim to harden RAG safety before split\-knowledge attacks are observed in deployed systems\. TopoGuard is not a standalone safety mechanism\. It should be deployed in cascade with per\-document content moderation systems\.