mlsanityData to 14 Oct 2026

Topological Attribution Distance (TAD): Revealing Segment-Level RAG Influence on LLM Output Geometry for Incident Log Analysis

arXiv 2608.16775 ↗First posted 17 Aug 2026cs.CR cs.AIcited by 0

Not on the map. Why?

Abstract (arXiv)

Large Language Models (LLMs) are increasingly being deployed in cybersecurity operations to assist cybersecurity analysts with rapid decision-making against emerging threats. However, there is a main criteria that must be met when using LLMs in cybersecurity, that is, trust in the generated outputs. As Agentic AI is integrated into operational systems, a robust evidence attribution and provenance tracking technique is essential to trace the origins of model generations. When autonomous agents make a decision (right or wrong), the ability to trace back through the decision chain is critical, as without it, teams cannot identify which segment of the data caused the model generation. Existing methods often struggle to distinguish among complex and highly similar evidence sources, such as cyber incident logs. This reveals a key gap: current approaches do not adequately capture the holistic geometric relationship between the retrieved evidence and the generated response for reliable evidence verification. To bridge this gap, we propose Topological Attribution Distance (TAD), inspired by Topology, to characterize and capture the global geometric shape of an output and its changes against its retrieved logs. In other words, if the embeddings of a specific source log drastically changes the geometry of the model's response in the embedding space, this suggests that such log is a critical source for the model's generated response. Therefore, TAD is powered by segment-level ablation attribution to investigate incident logs of an actual cyberattack. We demonstrate how TAD finds the most attributed logs on LLM outputs in an adaptive manner. This can provide an explainable and trustworthy tracing based on each LLM's hidden state to understand how geometrically different retrieved logs influence the model generation, and provide evidence verification in cybersecurity and Agentic-AI workflows.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 18 of its 39 references that are in the map. First posted on arXiv 17 Aug 2026.

Builds on

18 of 39 references.

References · 18

  1. 2017A Unified Approach to Interpreting Model Predictionscited by 6,555
  2. 2016"Why Should I Trust You?": Explaining the Predictions of Any Classifiercited by 5,070
  3. 2023Self-RAG: Learning to Retrieve, Generate, and Critique through Self-Reflectioncited by 1,839
  4. 2023Ragas: Automated Evaluation of Retrieval Augmented Generationcited by 418
  5. 2023ARES: An Automated Evaluation Framework for Retrieval-Augmented Generation Systemscited by 265
  6. 2017An introduction to Topological Data Analysis: fundamental and practical aspects for data scientistscited by 172
  7. 2024AttnLRP: Attention-Aware Layer-Wise Relevance Propagation for Transformerscited by 120
  8. 2023A Survey of Large Language Models Attributioncited by 71
  9. 2024LRP4RAG: Detecting Hallucinations in Retrieval-Augmented Generation via Layer-wise Relevance Propagationcited by 17
  10. 2024What Variables Affect Out-of-Distribution Generalization in Pretrained Models?cited by 13
  11. 2024Persistent Topological Features in Large Language Modelscited by 12
  12. 2024Multi-Level Explanations for Generative Language Modelscited by 11
6 more
  1. 2024Hidden Holes: topological aspects of language modelscited by 6
  2. 2025The Shape of Adversarial Influence: Characterizing LLM Latent Spaces with Persistent Homologycited by 5
  3. 2025From Topology to Retrieval: Decoding Embedding Spaces with Unified Signaturescited by 5
  4. 2024The Shape of Word Embeddings: Quantifying Non-Isometry With Topological Data Analysiscited by 4
  5. 2025LLM Embedding-based Attribution (LEA): Quantifying Source Contributions to Generative Model's Response for Vulnerability Analysiscited by 2
  6. 2025Latent Space Topology Evolution in Multilayer Perceptronscited by 1

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026Reasoning Topology Matters: A Controlled Study of LLM-Based Cybersecurity Analysis
  2. 2026CyberClear: A Benchmark for LLM Agent Systems on APT Attack Chain Provenance
  3. 2026Detect Before You Attribute: Cascade Failure Attribution for Multi-Agent Systems
  4. 2026Structurally Close, Temporally Distant: Measuring Security Exposure in Long-Horizon LLM Agents
  5. 2026From Agent Traces to Trust: A Survey of Evidence Tracing and Execution Provenance in LLM Agents
  6. 2025ExCyTIn-Bench: Evaluating LLM agents on Cyber Threat Investigation
  7. 2026Automated Post-Incident Policy Gap Analysis via Threat-Informed Evidence Mapping using Large Language Models
  8. 2026Cyber Defense Benchmark: Agentic Threat Hunting Evaluation for LLMs in SecOps