Topological Attribution Distance (TAD): Revealing Segment-Level RAG Influence on LLM Output Geometry for Incident Log Analysis
This study addresses the critical challenge of trustworthy provenance and evidence attribution for LLM-generated content in cybersecurity applications. To this end, we propose Topological Attribution Distance (TAD), a novel segment-level attribution mechanism grounded in topological geometry. By leveraging embedding space modeling and hidden state analysis, TAD quantifies the global geometric influence of retrieval logs on generated outputs. This approach adaptively localizes critical logs to enable segment-wise evidence verification and interpretable decision tracing. Consequently, TAD effectively elucidates the intrinsic mechanisms of Retrieval-Augmented Generation, providing both theoretical foundations and technical pathways for enhancing the trustworthiness of model outputs in security-critical domains.