TopoGuard: Graph Theory Based Defenses Against Split-Knowledge Attacks on RAG

A new family of graph theory-based defenses called TopoGuard, introduced by researchers in a preprint on arXiv, catches 21 times more split-knowledge attacks on Retrieval Augmented Generation (RAG) systems than LlamaGuard-2-8B at 1% false positive rate (32.6% vs 1.5% recall) on the HotpotQA dataset. The attacks exploit retrieved documents that are individually benign but create false associations when combined, and TopoGuard detects malicious topology in semantic similarity graphs at sub-millisecond latency.

arXiv:2607.20437v1 Announce Type: new Abstract: Production Retrieval Augmented Generation RAG systems rely on aggregating multiple external documents to answer complex queries. However, the retrieved documents introduce a new threat surface that can be exploited to launch split-knowledge attacks. In this attack, the adversary injects documents that are individually benign but create false associations when combined and fed to language models. This paper shows that the new attack is structurally invisible to existing per-document filters, like LlamaGuard. To address this issue in RAG, this work introduces TopoGuard, a family of graph theory-based methods specifically targeting the split-knowledge attacks by building a semantic similarity graph from retrieved documents and detecting contexts with malicious topology. Grounded on the theoretical analysis, the TopoGuard family has been proven to be effective and robust even with noisy inputs. Extensive experiments are conducted on two retrieval datasets and compared with multiple baseline methods. Specifically, the TopoGuard-$\lambda 2$+Entity catches 21$\times$ more attacks than LlamaGuard-2-8B at 1\% FPR 32.6\% vs 1.5\% recall on the HotpotQA dataset. Compared with production RAG detection systems using large language models, the proposed TopoGuard variants run efficiently at sub-millisecond latency and stay robust under adaptive adversaries and benign cross-domain queries.