TopoGuard catches 21x more RAG split-knowledge attacks than LlamaGuard-2-8B at sub-millisecond latency.

Dahal and Xiong target injected documents that are individually benign but create false associations once aggregated, which is structurally invisible to any per-document filter (arXiv 2607.20437). TopoGuard builds a semantic similarity graph over the retrieved set and flags malicious topology. The λ₂+Entity variant hits 32.6% recall versus LlamaGuard's 1.5% at 1% FPR on HotpotQA. Because it scores the context as a graph instead of calling a model, it drops in front of an existing retriever with no LLM hop added.