Order-Resolved Hidden-State Monitoring for Coordinated Exemplar Poisoning

Retrieval-selected exemplars give an attacker a set-valued control surface: every item can look plausible while their joint arrangement redirects an in-context learner. We study a matched-control protocol for attributing detector gains while holding the scored bag, penultimate reader representations, training data, and benign calibration fixed. Coordination-Order Risk Decomposition (CORD) organizes pairwise, length-$3+$ coordination, and instability information through a common fusion interface; CORD-D replaces probe-time instability estimates with a learned surrogate. On the R1 controlled-optimizer setting, CORD-D obtains 84.8% AUROC, 2.5 points above QC-SetTrans, and exceeds the two stronger non-graph controls reported in Table 1. The paper isolates the question that this comparison is designed to answer: whether explicit summaries of relations among plausible exemplars carry useful information beyond per-item and pairwise summaries under a shared evaluation interface. This formulation provides a concrete evaluation target for hidden-state poisoning monitors and a basis for future evidence-complete tests of information order.