SEVA

For a document d, let N_K(d) be its K nearest corpus neighbours under cosine similarity. Cluster coherence is the mean pairwise similarity among those neighbours — a k-NN cohesion statistic in the lineage of local-outlier detection, inverted: templated poison is anomalous because it is more locally cohesive than organic text.

Because K = 5 is tiny against a 100,000-document corpus, the nearest neighbours of a templated passage are almost exclusively its own injected siblings — whatever fraction of the corpus is poisoned.

A pairwise deduplicator's behaviour changes as the poison fraction grows; a K = 5 neighbourhood does not. Across 1–10% contamination the gap holds at +0.235 to +0.247 with SNR ≈6.0 — against ≈4.7 for the same signal on a general-domain corpus. The gap reads template homogeneity, not domain contrast.

SEVA began as a ten-signal detector fusing coherence with linguistic and structural statistics. The highest-SNR signal in that inventory is also the one an adversary can normalise away — and the one the domain confound inflated, from 38.4 against general-domain prose to 8.1 in-domain. That is the argument for deploying the geometric signal alone.

SEVA flags a document when its coherence exceeds a calibrated τ, and flags a query when at least k = 2 of its retrieved documents are flagged. Operating the signal as a hard gate — rather than one term in a weighted score — is what gives SEVA its adaptive robustness: an adversary who normalises soft linguistic statistics changes nothing about the embedding geometry the gate reads.

R     ← rerank top-K of Retrieve_K_FETCH(q, D)
flags ← |{ d ∈ R : C[d] > τ }|
if flags ≥ k:  return Flag   # query poisoned
else:          return Pass

τ is the (1 − FPR_target) quantile of the benign coherence distribution, found by 50-iteration binary search — no labelled poison, no poison scores, no density estimate. The operator sets a false-positive target, not a guess at how poisoned the corpus is. Evaluation then scores held-out benign and all adversarial queries against the frozen τ, with calibration documents excluded from false-positive accounting.

The estimator holds as the corpus grows: 0.7653% at 10k, 0.6741% at 100k and 0.7008% at 1M against the 0.69% pre-registered target — a deviation that does not grow with N.

Density invariance, however, is a large-corpus property. At 10k the gap curve is not flat — it collapses to 0.141 at 1% density, and result_scale10k.json records gap_density_invariant: false and templated_asr_zero: false accordingly. The chart marks where the property fails rather than cropping it out.

Zero evasions in 25,000 high-encounter trials puts the 95% Wilson upper bound at 0.0154%. The margin is wide, not marginal: the least-cohesive poison document scores 0.8905 against a clean mean of 0.7510, with τ frozen at 0.8423. Re-deriving τ on the poisoned corpus would inflate it to 0.9767 — a threshold the gate deliberately does not use.

Three embedding models of independent lineages, each in its correct symmetric convention, all at the non-oracle operating point: zero evasion across all 27 cells. What generalises is that the gate works — not the size of the margin. Absolute separation is encoder-dependent, and the honest reading is that a deployment should calibrate on its own encoder rather than inherit a published gap.

A hash-verified, byte-identical corpus was re-embedded independently on CUDA and on Apple Silicon. The coherence gap agrees to within 5×10⁻⁷ and the detection decision is identical; only latency differs. The decision is a property of the geometry, not of the accelerator.