Topology-Conditioned Language Models for Security Systems

Security monitoring systems increasingly use language models to reason over temporal event streams, but they discard the interaction topology that determines what counts as normal behavior. Graph representations of that topology exist in most production environments, yet they are systematically incomplete: graph builds run on a slower cadence than the event stream, so at any moment only a minority of the entities appearing in logs have an embedding. We present SECBFF, which conditions a language model on a frozen graph foundation model through Topology-Injected Masked Fine-Tuning (TIM-FT). TIM-FT replaces the textual tokens of covered entities with their projected graph embeddings in place, at the input-embedding level, leaving uncovered entities as text. The method adds a single 530K-parameter projector, requires no vocabulary expansion, no joint graph– LLM training, and no change to the serving path, and remains compatible with KV-caching. On two public security benchmarks, Elliptic Bitcoin and LANL 2015, SECBFF is the best method in all ten dataset/task combinations against nine baselines.