At the highest level -- you are secure so long as the majority of your trust list doesn't conspire. If you have a bad trust list, you can be lied to about what transactions have been applied by the system.

Think about it this way though -- if you have a 51% attack against Bitcoin, you have to make fundamental changes in Bitcoin. If you have a consensus breaking attack against Ripple, you have to remove the conspirators from your trust list.

Because servers are tracking the validation processes, it's harder to fool servers than clients. If a client is connected to a non-conspiring server that hasn't itself been fooled, then the client will immediately know it has a problem because it won't accept the proofs the server is sending it and the attack will fail.