Author(s): Akash Dogra

Originally published on Towards AI.

How GNNs, LLMs, and ontology-grounded retrieval fuse into the architecture powering modern military intelligence — with the math, the code, and the failure modes.

The 90-Second Decision That Broke Standard AI

A highly dispersed sensor network detects anomalous activity across a 200-kilometer front. Synthetic aperture radar identifies irregular vehicle tracks near a tree line. Signals intelligence intercepts encrypted, short-burst radio transmissions. A week-old HUMINT report places a high-value commander within 50 kilometers. Open-source intelligence shows sudden civilian supply chain delays. Drone feeds capture thermal signatures obscured by deliberate multispectral camouflage.

A human commander has roughly ninety seconds to synthesize this. The decision must comply with International Humanitarian Law — decisively differentiating combatants from protected civilians while mitigating an imminent threat to friendly forces.

Standard supervised classifiers fail catastrophically here. The core IID assumption — that training and test data share identical distributions — is actively violated by an adversary whose explicit goal is to operate outside historical patterns. Vanilla LLMs fare no better: they hallucinate confident claims when navigating sparse data and cannot track entities across evolving operational contexts without catastrophic forgetting. Traditional databases are too rigid to handle contradictory, probabilistic evidence in real time.

The defense ecosystem recognized this structural gap. DARPA’s Knowledge-directed AI Reasoning Over Schemas (KAIROS) program (2019–2023) initiated the development of systems that identify, link, and temporally sequence complex events from noisy multimedia inputs [1]. Its successor programs now fuel production-grade GNN-LLM hybrids [2]. As of late 2025, the DoD’s GenAI.mil initiative mandates AI-first decision workflows across operational commands [3].

No single algorithm solves this. The real architectural insight is a fusion stack: LLMs provide language-grounded reasoning. GNNs provide relational inference and uncertainty propagation. Knowledge graphs provide the governed semantic substrate that tethers both to operational reality.

Knowledge Graphs: The Semantic Backbone

Information in warfare is inherently relational. An intercepted signal is meaningless in isolation — its tactical value only emerges when linked to its transmission origin, the adversary’s command hierarchy, and geographic proximity to logistics routes.

A knowledge graph models the battlefield through three axes: entities (people, units, locations, weapons), relationships (command hierarchies, supply chains, communications), and temporal dynamics (timestamps, confidence scores, version histories).

Formally, the environment is a heterogeneous knowledge graph:

G = (V, E, φ, ψ)

where V is the node set, E is the edge set, φ: V → T_V maps each node to an entity type, and ψ: E → T_E maps each edge to a relationship type.

Even in this reduced five-node configuration, the graph encodes deep tactical structure. If a strike destroys the Communications Relay, the graph explicitly maps cascading consequences: the Commander loses transmission to the Unit contesting the Disputed Territory. No flat database computes this cascading impact with the latency required for combat.

Intelligence graphs must be dynamic. Edges appear, disappear, and change confidence as new intelligence arrives, transforming G into a temporal sequence G = {G₁, G₂, …, G_T} where G_t represents battlespace state at time t. Platforms like Palantir Gotham and AIP operationalize exactly this kind of entity-relationship modeling at enterprise scale [4].

Graph Neural Networks: Inferring the Unknown

Standard graph databases (Cypher, SPARQL) are exact-match retrieval engines. They return what is explicitly encoded. They cannot infer what is implicitly implied by structure, nor propagate uncertainty through multi-hop reasoning chains. If an adversary uses sophisticated OPSEC to obscure a command link, a standard query returns null.

GNNs transform discrete graph topology into continuous vector spaces, enabling probabilistic reasoning over the network itself:

1. Link Prediction: Inferring missing edges — “Who is this unknown actor connected to?”.
2. Node Classification: Inferring entity type from relational context alone
3. Entity Resolution: Determining whether a burner phone MAC address and a physically observed combatant represent the same real-world entity.

Consider: a new entity appears with only three known edges — proximal to a Logistics Node, detected by an RF Sensor, and observed on a Supply Route. A standard database sees three isolated facts. A GNN propagates neighborhood information, aggregates feature vectors from all three neighbors, and compares the resulting embedding against historical deployments. The output: 87% probability of a mobile air defense system protecting the logistics chain. The model inferred a classified asset by analyzing the negative space of its neighbors.

In heterogeneous intelligence environments, standard GNNs are insufficient a SIGINT intercept carries profoundly different epistemic weight than a social media post. Heterogeneous Graph Attention Networks (HAN) address this through hierarchical attention. The semantic-level attention computes meta-path importance:

The algorithm learns to prioritize reliable transmission chains (dedicated military comms) over noisy ones (civilian cell networks). This directly mimics how an expert analyst weights source reliability.

import torch
from torch_geometric.nn import HANConv
from torch_geometric.data import HeteroData
# Define a heterogeneous military intelligence graph
data = HeteroData()
# Node features: entity embeddings from sensor fusion
data['commander'].x = torch.randn(5, 64) # 5 known commanders
data['unit'].x = torch.randn(20, 64) # 20 tracked units 
data['location'].x = torch.randn(50, 64) # 50 geolocations
data['unknown'].x = torch.randn(3, 64) # 3 unclassified entities
# Typed edges encoding relationships
data['commander', 'commands', 'unit'].edge_index = torch.randint(0, 5, (2, 15))
data['unit', 'operates_at', 'location'].edge_index = torch.randint(0, 20, (2, 40))
data['unknown', 'proximal_to', 'location'].edge_index = torch.tensor([[0,1,2],[5,12,30]])
# HAN with meta-path-based attention
metadata = data.metadata()
han = HANConv(in_channels=64, out_channels=32, metadata=metadata, heads=4)
# Forward pass: message passing across typed edges
out = han(data.x_dict, data.edge_index_dict)
# out['unknown'] now contains relational embeddings for classification

LLMs as the Reasoning Layer — and Why They Can’t Work Alone

GNNs output high-dimensional vectors and probabilistic logits. A battlefield commander cannot make a targeting decision based on a cosine similarity metric. LLMs bridge this gap as the reasoning and human-machine interface layer.

But deploying LLMs directly into a command post is catastrophically dangerous. They hallucinate confident factual claims. Most critically: if an artillery strike destroys a bridge at 0800, an LLM’s frozen parametric memory doesn’t register it. Asked for routing at 0805, it will confidently route friendly forces over the destroyed bridge.

The solution: LLM-over-graph architecture. The LLM doesn’t answer from pre-trained weights it acts as an orchestration engine that translates natural language into graph queries, retrieves structured subgraphs, and reasons exclusively over retrieved data.

# Standard RAG: Semantic similarity, prone to hallucination
context = vector_db.similarity_search("Supply chain vulnerability for Unit Alpha", k=5)
response = llm.generate(prompt=query, context=context)
# Ontology-Augmented Generation: Structured, deterministic, auditable
ontology_query = llm.generate_ontology_query(
 intent="Supply chain vulnerability for Unit Alpha",
 schema=military_ontology)
subgraph = hypergraph_retriever.execute(ontology_query)
vulnerability = logic_tools.run_logistics_optimizer(subgraph)
response = llm.reason_over_graph(
 prompt=query, graph_data=subgraph, logic_results=vulnerability)

By forcing the LLM to route its entire reasoning process through ontological constraints, the architecture neutralizes hallucination by grounding every claim in data objects with auditable provenance.

The Fusion Stack: Five Layers of Military Intelligence

These technologies synthesize into a unified five-layer architecture:

The critical engineering challenges occur at the boundaries between layers.

Layer 1 → Layer 2: Sensor Fusion via Dempster-Shafer Theory

When multiple sensors provide conflicting evidence, standard Bayesian methods struggle to represent pure ignorance. Dempster-Shafer theory assigns belief to subsets of possible classifications, explicitly modeling “I don’t know.” The combination rule fuses independent sensor evidence:

The normalization factor K measures conflict between sensors. If K is dangerously high a drone identifies a school bus while corrupted SIGINT identifies a missile launcher the system halts automated updates and flags for human review.

Layer 3 → Layer 4: GNN-to-LLM Serialization

The architecture serializes graph context into JSON-LD with GNN confidence scores attached. The LLM’s system prompt is strictly weighted: “Do not treat inferred links as empirical truth — present them as probabilistic assessments.”

Neuro-Symbolic Safety: When Rules Override Learning

Learned models cannot fail gracefully in targeting decisions. The IHL prohibition against targeting hospitals cannot be reduced to a 95% confidence metric. It must be an absolute systemic barrier.

In a neuro-symbolic targeting architecture:

• Neural layer: Computer vision identifies a structure. GNNs infer 92% probability of an enemy command post. LLMs synthesize an intelligence briefing.
• Symbolic layer: Queries ontology for hard constraints. Does the blast radius intersect a hospital? Are friendly forces in the fragmentation zone? Has positive ID been met by two non-corrupted sensors?

If the symbolic logic evaluates to FALSE on any parameter, the action is blocked at the interface level. Compliance is not an afterthought — it is wired into the execution layer. Systems like Palantir's AIP deploy these guardrails alongside LLM reasoning to prevent hallucinated legal justifications [5].

Failure Modes: Poisoning, Bias, and Overconfidence

Adversarial Graph Poisoning

An adversary who understands the GNN can deliberately broadcast fake encrypted signatures near civilian infrastructure, injecting malicious nodes. The GNN aggregates poisoned data during message passing, corrupting embeddings of innocent nodes. Research into certified defenses (AGNNCert, PGNNCert) is a top priority in 2026 [6].

Confirmation Bias Amplification

If the knowledge graph reflects prior operational biases, the GNN enshrines them mathematically. It predicts links aligned with historical patterns; the LLM generates eloquent reports justifying those predictions. This creates an automated feedback loop of self-fulfilling intelligence.

Lethal Overconfidence

Standard softmax outputs are notoriously poorly calibrated — they produce overwhelming confidence while being empirically wrong. Conformal Prediction provides distribution-free coverage guarantees:

If the 95% conformal set includes both “Enemy Mobile Launcher” and “Civilian Fuel Truck,” the system doesn’t force a choice it forces human intervention by exposing the mathematical bounds of its own uncertainty.

What Comes Next

The field is accelerating into production:

• Temporal GNNs: Continuously model dynamic graph states, enabling forecasting of adversary movements before physical actions occur
• Multimodal graph nodes: Embedding raw vision, acoustic, and RF signals directly as feature vectors within graph nodes, bypassing separate extraction models
• Federated graph learning: Allied nations training unified GNN-LLM models without sharing sovereign data, preserving operational security
• Edge-deployed reasoning: Lightweight LLMs and GNNs on autonomous forward platforms, reasoning over localized knowledge graphs with zero connectivity

Inevitably, adversarial neural networks will be purpose-built to manipulate GNN message-passing aggregations, poisoning knowledge graphs to paralyze LLM reasoning engines. The integration of LLMs, GNNs, and knowledge graphs represents a paradigm shift — but the true test is whether it makes the right decision in the fog of war, when sensors are blinded, data is missing, and the cost of an architectural error is measured in human lives.

References

[1] DARPA, “Knowledge-directed Artificial Intelligence Reasoning Over Schemas (KAIROS),” 2019–2023. Program concluded; methodologies now integrated into production GNN-LLM hybrid systems.

[2] Department of Defense, “GenAI.mil — AI-First Warfighting Workflows,” launched late 2025. Mandates AI-assisted decision-making across operational commands.

[3] Microsoft Research, “From KAIROS to GraphRAG: The Evolution of Schema-Based Intelligence,” Proceedings of the ACM Conference on Knowledge Discovery, 2025.

[4] Palantir Technologies, “AIP: Ontology-Augmented Generation for Defense Intelligence,” 2024. Production deployment across U.S. DoD and allied networks.

[5] Palantir Technologies, “Neuro-Symbolic Guardrails in AIP Gotham,” Technical Documentation, 2025. Rules-based constraint engines operating alongside LLM reasoning.

[6] Zhang et al., “AGNNCert: Certified Robustness Against Adversarial Graph Attacks,” NeurIPS, 2026. First provably robust defense framework for production GNNs.

[7] Vovk, V., Gammerman, A., & Shafer, G., Algorithmic Learning in a Random World, Springer, 2005. Foundation of conformal prediction theory.

[8] Shafer, G., A Mathematical Theory of Evidence, Princeton University Press, 1976. Dempster-Shafer theory of evidence for sensor fusion.

Published via Towards AI