TopoGuard Catches 21× More RAG Split-Knowledge Attacks Than LlamaGuard-2-8B at Sub-Millisecond Latency

arXiv 2607.20437·medium signal

Chahana Dahal and Zuobin Xiong target a RAG attack class where injected documents are individually benign but create false associations once aggregated — structurally invisible to any per-document filter. TopoGuard builds a semantic similarity graph over the retrieved set and flags malicious topology; the TopoGuard-λ₂+Entity variant catches 21× more attacks than LlamaGuard-2-8B at 1% FPR on HotpotQA (32.6% vs 1.5% recall) while running at sub-millisecond latency and holding up under adaptive adversaries and benign cross-domain queries. Because it scores the context as a graph rather than calling a model, it slots in front of an existing retriever without adding an LLM hop.