PaperlayerView exact revision on arXiv

Source-linked AI summary

Topological Attribution Distance (TAD): Revealing Segment-Level RAG Influence on LLM Output Geometry for Incident Log Analysis

Reza Fayyazi, Michael Zuzak, Shanchieh Jay Yang

arXiv:2608.16775v1cs.CRcs.AI

TL;DR

Existing attribution methods struggle to identify influential segments in highly overlapping incident logs, limiting holistic evidence verification. TAD addresses this by measuring hidden-state response-geometry changes under segment ablation, outperforming baselines with 97% average accuracy across four LLMs and a 39%+ precision gap across difficulty levels.

  • Problem

    Existing token-level attribution methods struggle with highly overlapping retrieved logs and do not capture the holistic geometry of LLM representations.

  • Method

    TAD compares hidden-state response geometry after segment-level ablation using layer-wise persistence diagrams and aggregated Wasserstein distances to rank attributed logs.

  • Results

    97% average accuracy across four LLMs and a 39%+ precision gap across three difficulty levels show TAD outperforming other baselines.

  • Takeaways & Limitations

    TAD provides adaptive, explainable tracing of how retrieved incident-log segments geometrically influence LLM generations for cybersecurity evidence verification.

Abstract

from arXiv · show

Large Language Models (LLMs) are increasingly being deployed in cybersecurity operations to assist cybersecurity analysts with rapid decision-making against emerging threats. However, there is a main criteria that must be met when using LLMs in cybersecurity, that is, trust in the generated outputs. As Agentic AI is integrated into operational systems, a robust evidence attribution and provenance tracking technique is essential to trace the origins of model generations. When autonomous agents make a decision (right or wrong), the ability to trace back through the decision chain is critical, as without it, teams cannot identify which segment of the data caused the model generation. Existing methods often struggle to distinguish among complex and highly similar evidence sources, such as cyber incident logs. This reveals a key gap: current approaches do not adequately capture the holistic geometric relationship between the retrieved evidence and the generated response for reliable evidence verification. To bridge this gap, we propose Topological Attribution Distance (TAD), inspired by Topology, to characterize and capture the global geometric shape of an output and its changes against its retrieved logs. In other words, if the embeddings of a specific source log drastically changes the geometry of the model's response in the embedding space, this suggests that such log is a critical source for the model's generated response. Therefore, TAD is powered by segment-level ablation attribution to investigate incident logs of an actual cyberattack. We demonstrate how TAD finds the most attributed logs on LLM outputs in an adaptive manner. This can provide an explainable and trustworthy tracing based on each LLM's hidden state to understand how geometrically different retrieved logs influence the model generation, and provide evidence verification in cybersecurity and Agentic-AI workflows.

I. INTRODUCTION · II. RELATED WORKS · A. Challenges of Existing Attribution Metrics for LLMs

RAG supports cybersecurity analysis but requires reliable evidence attribution because existing methods can fail to trace generated decisions to specific sources. TAD addresses this gap by comparing response geometry with and without retrieved segments and identifying influential incident logs through Wasserstein distance.

  • I. INTRODUCTION: RAG gives cybersecurity LLMs access to current vulnerability reports and incident logs, but retrieval alone does not ensure correct interpretation.Ungrounded outputs can arise from ambiguous queries, excessive context, or poor source quality.
  • I. INTRODUCTION: Robust attribution and provenance tracking are essential for tracing agent decisions back to their originating sources.Without traceability, teams cannot identify the evidence underlying correct or incorrect AI-agent decisions.
  • A. Challenges of Existing Attribution Metrics for LLMs: LLM-judge attribution methods are constrained by evaluator bias, hallucination tendencies, and dependence on model self-interpretation.Self-RAG, RAGAS, and ARES do not fully decouple attribution assessment from parametric model knowledge or hidden states.
  • A. Challenges of Existing Attribution Metrics for LLMs: Token-level attribution can dilute a small critical feature across shared, nondiscriminative tokens, leaving segment-level influence unresolved.The identified gap is a mechanism that aggregates token signals into coherent segment-level attribution.
  • I. INTRODUCTION: TDA motivates attribution through the topology and geometry of embedding spaces, whose representations can transform across network layers.Prior work also indicates that deeper layers do not necessarily provide better representations, motivating consideration of all layers.
  • I. INTRODUCTION: TAD measures segment influence by comparing persistence diagrams of response embeddings across transformer layers with and without each retrieved segment.It uses Wasserstein distance to quantify geometric changes and produce a segment-level attribution score.
  • I. INTRODUCTION: TAD is designed for incident-log analysis, where highly overlapping logs make influential evidence difficult to distinguish.The evaluation uses Direct, Regular, and Indirect scenarios representing decreasing overlap between attack logs and responses.
  • I. INTRODUCTION: 97% average accuracy across four LLMs and a 39%+ Precision gap across three difficulty levels are reported for TAD over other baselines.The case study further reports that TAD uniquely localizes Log-5 by measuring its effect on response geometry, whereas existing methods may retrieve benign logs, return multiple candidates, or cite nearly the full context.

B. Topological Data Analysis (TDA) in LLMs · III. BACKGROUND ON TOPOLOGICAL DATA ANALYSIS · A. Point Clouds and Metric Spaces

The paper situates TDA for LLM analysis through prior topological studies of embedding spaces and hidden states, while highlighting limitations that motivate attention to H0 homology. It then introduces TDA foundations based on point clouds, simplicial complexes, persistent homology, and Wasserstein distance.

  • B. Topological Data Analysis (TDA) in LLMs: Persistent homology applied to word-embedding clouds encodes meaningful linguistic structure.
  • B. Topological Data Analysis (TDA) in LLMs: Unified Topological Signatures aggregates topological and geometric descriptors to characterize embedding spaces.
  • B. Topological Data Analysis (TDA) in LLMs: Persistent homology and perforation have been used to compare the layer-wise topological complexity of Transformer and LSTM hidden states.
  • B. Topological Data Analysis (TDA) in LLMs: Zigzag persistence tracks how topological features evolve across layers and supports a Persistence Similarity metric.
  • B. Topological Data Analysis (TDA) in LLMs: Existing approaches have limitations because perforation excludes H0 homology, although H0 is presented as important for detecting embedding-space shape differences.
  • III. BACKGROUND ON TOPOLOGICAL DATA ANALYSIS: The mathematical foundations section covers simplicial-complex construction, persistent homology across scales, and Wasserstein distance for comparing persistence diagrams.
  • A. Point Clouds and Metric Spaces: TDA typically takes a point cloud as input, with points embedded in a feature space equipped with a metric that quantifies pairwise dissimilarity.
  • A. Point Clouds and Metric Spaces: Pairwise distances in a discrete point set reveal latent geometric and topological information, which is lifted into a simplicial complex for systematic extraction.

B. Simplicial Complexes · C. Filtrations and Multi-Scale Analysis · D. Persistent Homology: Birth, Death, and Persistence

The paper constructs simplicial complexes from point clouds, studies their topology across nested scales, and tracks feature lifecycles with persistent homology. Persistence diagrams and barcodes distinguish significant structure from noise through feature persistence.

  • B. Simplicial Complexes: A simplicial complex represents a point cloud combinatorially using simplices, where k-simplices are convex hulls of k+1 affinely independent points.Vertices, edges, and filled triangles correspond to dimensions 0, 1, and 2, respectively.
  • B. Simplicial Complexes: The Vietoris–Rips complex includes a k-simplex when all pairwise distances among its k+1 vertices are at most ε.Small ε captures only trivial local structure, whereas large ε can collapse points into one fully connected component.
  • C. Filtrations and Multi-Scale Analysis: Because no single ε is globally optimal, a filtration analyzes a nested sequence of simplicial complexes across increasing scales.This resolves the ambiguity of selecting one scale by considering all scales simultaneously.
  • C. Filtrations and Multi-Scale Analysis: As ε increases, isolated vertices connect through edges and eventually form higher-dimensional simplices representing clustered regions.The filtration is indexed by ε0 < ε1 < · · · < εm, with simplices progressively added.
  • C. Filtrations and Multi-Scale Analysis: A sublevel-set filtration admits points according to increasing f-values and builds complexes on the included subsets to track evolving topology.For f : V → R, points enter as the threshold t grows, and a complex such as Vietoris–Rips is built on each Vt.
  • C. Filtrations and Multi-Scale Analysis: Homology quantifies the complex’s shape, with H0 counting connected components, H1 detecting loops, and H2 identifying enclosed voids.Higher Hk groups encode higher-dimensional analogues, typically computed over the field F2 = {0, 1}.
  • D. Persistent Homology: Birth, Death, and Persistence: Persistent homology tracks when homological features are born and die as ε increases, measuring their lifetimes across the filtration.Features may die by merging with older components or being filled by higher-dimensional simplices.
  • D. Persistent Homology: Birth, Death, and Persistence: High-persistence features are treated as topologically significant, while low-persistence features typically reflect noise or sampling variability in persistence barcodes and diagrams.At least one H0 component persists throughout the entire filtration; diagram points far from the diagonal indicate significant features, while nearby points indicate noise.

E. Wasserstein Distance · IV. METHODOLOGY · A. Mapping TDA concepts to LLMs

The methodology maps token embeddings to topological structures and uses Wasserstein distance to quantify geometric changes between persistence diagrams. TAD applies this comparison across ablated log batches and transformer layers to trace generation attribution.

  • E. Wasserstein Distance: Wasserstein distance compares persistence diagrams with potentially different cardinalities through a minimum-cost partial matching.Diagrams are augmented with the diagonal so unmatched features can be represented as trivial features.
  • E. Wasserstein Distance: A bijection between diagrams augmented with the diagonal treats points matched to diagonal points as unmatched.The augmented diagrams are bP = P ∪ ∆ and bQ = Q ∪ ∆, with ∆ = {(x, x) : x ∈ R}.
  • E. Wasserstein Distance: The distance penalizes geometric discrepancies between matched features and persistence-proportional costs for unmatched features.For u = (b, d), the diagonal distance is d(u, ∆) = (d − b)/2 under the ℓ∞ metric.
  • IV. METHODOLOGY: The methodology instantiates the TDA pipeline for LLMs by tracking generation attribution with Wasserstein distance across transformer layers.This layer-wise comparison connects topological changes in representations to attribution analysis.
  • A. Mapping TDA concepts to LLMs: Token embeddings form a metric space M = R^n, where the L∞ metric captures geometric dissimilarity and Vietoris–Rips complexes encode semantic relationships.Each point v_i represents a token embedding, and the filtration records how simplicial complexes evolve across scales.
  • A. Mapping TDA concepts to LLMs: TAD computes the output shape, compares original and ablated batch outputs with Wasserstein distance across transformer layers, and aggregates the distances to identify influential logs.Batches with the largest gaps and those above the analysis threshold proceed to finer attribution analysis.
  • A. Mapping TDA concepts to LLMs: Layer-wise hidden states drive a sublevel-set filtration that identifies attended tokens and makes topology sensitive to saliency and anomalous representation patterns.This construction links model-internal signals directly to topological analysis.
  • A. Mapping TDA concepts to LLMs: Homology summarizes embedding-space structure through clusters and cycles, while persistence diagrams retain the birth and death scales of topological features.High-persistence features represent robust patterns, whereas low-persistence features may reflect noise or incidental proximity.

B. Topological Attribution Distance (TAD)

TAD attributes individual incident-log segments by measuring how their ablation changes the topological structure of an LLM’s generated response. It uses H0 persistent homology and layer-aggregated Wasserstein distances, with batch screening followed by finer-grained single-log analysis.

  • Attribution Framework: TAD uses persistent homology to quantify each retrieved incident-log segment’s influence on the topological structure of the model response.The approach targets segment-level attribution of autoregressive model generations.
  • Attribution Framework: Full context concatenation appends all retrieved segments and the generated response sequentially, enabling controlled attribution by ablating individual segments.This design supports unambiguous tracing of segment contributions to the final response.
  • Topological Distance: TAD computes the (∞, 1)-Wasserstein distance between H0 persistence diagrams for ablated and full contexts at each LLM layer, then aggregates values across layers.H0 is selected for computational efficiency and prior effectiveness in geometric reorganization tasks.
  • Interpretation: The method provides segment-level explainability beyond token-level impact by identifying influential logs whose ablation most strongly changes the output representation.The proposed attribution links strongly influential log segments with representational similarity to the output in feature space.
  • Screen-Then-Confirm Attribution: To reduce scale-related cost, TAD screens approximately N log batches using layer-aggregated Wasserstein perturbations, then confirms attribution through single-log ablation in the highest-distance batch.The screen-then-confirm strategy selects the batch with the largest aggregate distance for finer-grained analysis.

V. DISCUSSION ON COMPLEXITY

TAD’s complexity combines transformer forward passes with persistent-homology computation. Its adaptive screen-then-confirm strategy reduces attribution cost relative to individual log ablation, while topological processing remains quadratic in response-token count and linear in model depth for H0.

  • Complexity decomposition: TAD’s cost decomposes into transformer inference and persistent-homology computation over candidate logs, response tokens, hidden dimension, and transformer layers.The variables are N candidate log entries, T response tokens, d hidden dimension, and L transformer layers.
  • Inference cost: M = N +1 forward passes are required when each log is ablated individually, making cost linear in context length.This includes one baseline pass and one pass per log, becoming prohibitive for long Agentic traces.
  • Inference cost: M = O(N) passes are expected under adaptive screen-then-confirm attribution, which recursively analyzes only groups flagged as spikes.The procedure partitions the log pool and confirms flagged groups or individual logs.
  • Topological cost: For H0, each pass costs O(L T 2(d + log T)), quadratic in response-token count and linear in network depth.The cost comes from pairwise distances and sorting the O(T 2) edges of the Vietoris–Rips 1-skeleton.
  • Topological cost: H1 is substantially more expensive because its 2-skeleton may contain O(T 3) triangles and can have cubic complexity in the number of simplices.The H0 restriction requires only the 1-skeleton.
  • Overall cost: The end-to-end cost is O(M · L · T 2(d + log T)), with M = O(N) under adaptive screening.This is the configuration adopted throughout the experiments.

VI. RESULTS

The results section introduces the dataset, experimental design, and Topological Attribution Distance (TAD) results for incident log analysis.

  • The section presents the dataset, experimental design, and TAD results for incident log analysis.

A. Dataset Curation & Attack Scenario · B. Experimental Design

The study uses compressed Windows event logs from a real GOAD cyberattack monitored by Wazuh, with 20 ground-truth attack-evidence entries. Its experiments bound investigations to analyst-defined time windows, standardize model comparisons with a fixed canonical response, and test TAD across attribution difficulty levels against established baselines.

  • A. Dataset Curation & Attack Scenario: 20 ground-truth attack-evidence entries were identified from a real cyberattack conducted in the GOAD environment and monitored using Wazuh.The attack occurred in October 2025.
  • A. Dataset Curation & Attack Scenario: Consecutive logs with ≥90% sequence similarity were compressed into one representative entry while retaining event frequency through a how-many-consecutive metadata field.Gestalt Pattern Matching reduced redundancy among nearly identical cybersecurity events.
  • A. Dataset Curation & Attack Scenario: The attack sequence began with failed and elevated logons, followed by pass-the-hash authentication across multiple hosts, indicating systematic lateral movement.The described events include access to winterfell, kingslanding, and meereen.
  • B. Experimental Design: Directly supplying all logs is impractical because large volumes exceed context limits, increase inference cost, and may degrade response quality through irrelevant information.Targeted investigation instead focuses the model on evidence relevant to an analyst’s hypothesis.
  • B. Experimental Design: The investigation asks whether logs within a specified date and time window provide evidence of an attack, reflecting a bounded post-alert workflow.This avoids unrestricted threat hunting and evaluates logs against the analyst’s hypothesis.
  • B. Experimental Design: A canonical response derived from ground-truth attack logs is held constant across models to reduce confounding from differences in wording, structure, confidence, and interpretation.Claude-Opus-4.5 was used to curate these canonical responses.
  • B. Experimental Design: TAD is evaluated in Direct, Regular, and Indirect scenarios, including cases where responses lack critical keywords linking them to specific logs.The design tests whether attribution relies on overall segment interpretation rather than keyword matching.
  • B. Experimental Design: TAD is compared with LLM-as-a-judge, in-line citation, Cosine Similarity, ROUGE-L, and LEA baselines using four long-context LLMs.The models are Qwen3-4B, Gemma3-4B, Qwen2.5-7B, and Granite4.1-8B.

C. TAD for Incident Log Analysis · VII. CONCLUSION · AI DISCLOSURE

TAD uses adaptive segment-level ablation and geometric changes in LLM outputs to trace influential incident logs, outperforming baselines across response settings. The paper concludes that TAD supports evidence verification in cybersecurity and Agentic-AI workflows, while disclosing limited editorial and figure-refinement assistance from ChatGPT.

  • C. TAD for Incident Log Analysis: TAD compares attribution methods across Direct, Regular, and Indirect settings using the largest score gap to select candidates without a fixed top-k cutoff.The settings differ in how openly responses refer to logs, and the rule returns all candidates above the largest consecutive-score gap.
  • C. TAD for Incident Log Analysis: TAD achieves the highest accuracy and F1-score in almost all three settings, with accuracy margins of 1.60%, 3.11%, and 6.63%.The corresponding F1-score margins are 7.35%, 15.77%, and 17.63% for Direct, Regular, and Indirect cases, respectively.
  • C. TAD for Incident Log Analysis: 94.23%, 86.90%, and 57.70% are TAD’s Precision scores for the Direct, Regular, and Indirect cases, respectively.TAD exceeds the closest baseline by 39.47%, 47.46%, and 40.88% in Precision across those settings.
  • C. TAD for Incident Log Analysis: Baselines generally achieve high recall but low precision by returning influential logs alongside many false positives.This can preserve substantial manual work for analysts examining thousands of logs.
  • C. TAD for Incident Log Analysis: TAD avoids prompt-sensitive self-assessment and similarity failures by measuring the model’s response to context rather than context-response similarity.Highly overlapping incident-log tokens can make influential logs resemble near-duplicates under cosine similarity, whereas removing an influential log produces a large change in the response geometry.
  • VII. CONCLUSION: The conclusion presents TAD as a method that captures global output geometry and traces evidence whose retrieved-context embeddings drastically alter the model response.TAD uses segment-level ablation attribution and LLM hidden states to analyze how RAG segments geometrically influence generation.
  • AI DISCLOSURE: ChatGPT assisted with sentence-level editing, grammar checking, and aesthetic refinement of selected figures and prompt boxes.The authors independently reviewed and verified the content’s accuracy, originality, and integrity, including cited references.

APPENDIX · A. TAD results based on H1 homology

The appendix evaluates TAD using H1 homology and finds generally competitive results across both settings. H1 improves the Indirect-case F1-score across all four models but is computationally more expensive than H0, motivating H0 as the default.

  • A. TAD results based on H1 homology: H1-based TAD results are generally competitive in both evaluation settings.
  • A. TAD results based on H1 homology: H1 achieves a higher F1-score than alternatives in the “Indirect” case for all four models.
  • A. TAD results based on H1 homology: H1 results are slightly higher for larger models, potentially reflecting more abstract or higher-order representations with increased model capacity.
  • A. TAD results based on H1 homology: H1 computation is cubic, whereas H0 computation is quadratic, so H0 was used as the default.

B. TAD Specific Examples

TAD qualitatively identifies the incident logs that most influence an LLM response, including cases where keyword similarity is absent. Across direct, regular, and indirect examples, it correctly attributes the response to the relevant log.

  • Qualitative attribution: 1951.13 total Wasserstein identifies log-35 as the highest-contribution source, with the largest gap of 1162.72 from the other logs.The example uses Wasserstein distance to measure each log’s effect on response geometry.
  • Case analysis: TAD correctly attributes the direct, regular, and indirect cases to the relevant logs.The cases are presented as specific examples of TAD’s log-to-response attribution.
  • Indirect case: In the indirect case, TAD identifies the correct log despite the absence of keyword similarity.The indirect example concerns PsExec64.exe executed from a staff profile’s Downloads folder, suggesting preparation for access to other boxes.
  • Regular case: The regular case describes an NTLM-authenticated remote logon as replayed-credential lateral movement rather than legitimate remote administration.The log records a successful remote logon for robb.stark from NPC-PETYERBAELI to WINTERFELL.

C. LLM Self-Eval Baseline Prompts

The section defines prompts for LLM-as-Judge and in-line Citation baselines to attribute generated responses to supporting retrieved log segments. Greedy decoding ensures deterministic self-assessment outputs, while prompt-engineering sensitivity remains a limitation.

  • Baseline purpose: The baselines evaluate whether an LLM can map generated responses to source logs and attribute outputs to specific retrieved segments.The prompts cover LLM-as-Judge and in-line Citation self-assessment.
  • Evaluation conditions: Greedy decoding was used for both baselines to obtain deterministic responses, but LLM-based judges are sensitive to prompt engineering.The passage identifies prompt variation as a key limitation of LLM-based judges.
  • In-line Citation: The in-line Citation prompt requires citations for every response sentence, including all supporting logs, with no factual claims left uncited.Citations use the format <<logN>> at each sentence’s end.
  • LLM-as-Judge: The LLM-as-Judge prompt asks the model to identify only logs that directly contributed to the response’s conclusions and exclude present but unused logs.The requested output consists only of relevant log tags, listed one per line.
Loading 2608.16775v1…