The Illusion of Topological Compression: Why Persistent Homology Fails as a Real-Time Prompt-Injection Defense

Can the topology of a language model’s activations tell us when it is being attacked? A recent and appealing idea says yes: adversarial prompt injection is supposed to “compress” the activation point cloud into a simpler, lower-dimensional shape, a change that persistent homology can see as a drop in the first Betti number (H1 persistence). If that were reliable, a monitor could watch for the collapse and a steering vector could undo it. We tested the premise before building the defense. We ran matched benign and indirectly-injected prompts, with hijacks confirmed behaviorally, through Qwen2.5 (1.5B and 7B) and Mistral-7B. At 1.5B we found no H1 compression at all: not in the prompt encoding, and not during generation once we controlled for the obvious confound that shorter outputs yield fewer points. At 7B a deep-layer H1 drop does appear, and it replicates across both model families, so the phenomenon is not imaginary. But it is not the mechanism that was claimed. Intrinsic dimensionality does not collapse; if anything it rises. A one-line logistic probe on the raw activations separates the same prompts perfectly, and the topological features never beat it. And the effect lives only at the deepest layers during generation, tracking the divergent output rather than any early “decision” a monitor could catch. Even setting all of that aside, the monitor is not real-time: a per-token Vietoris–Rips computation runs 1.6 to 55×over a 2 ms/token budget with standard tooling. We are careful about what this does and does not show. A weak topological correlate is present, most visibly an H0 entropy ordering that is consistent with what earlier work reports; the shape of the latent space really does change. What fails is the leap from that change to a usable, real-time prompt-injection defense. We release our measurement harness and all data, and draw one practical lesson for anyone applying TDA to language-model activations: fix the point count, report intrinsic dimensionality, and compare against a raw probe, or you will end up measuring sequence length and calling it topology.