Source-linked AI summary
Truth Lies Deep: Countering Semantic Camouflage via Latent Intent Verification
Md. Hasib Ur Rahman
TL;DR
The paper addresses the vulnerability of perimeter safety defenses to Semantic Camouflage, which hides harmful intent in benign narrative contexts. It analyzes layer-wise activations across three SLM families and proposes LIV, an early-layer probing defense. LIV improves zero-day attack detection by 20–50%, while adaptive attacks and inference overhead remain limitations.
Problem
Semantic Camouflage can bypass input/output guardrails by obscuring malicious intent in benign narratives, while safety fine-tuning leaves early harmful-concept representations intact.
Method
The study analyzes internal activation trajectories across three SLM architectures and shifts safety verification to early layers using Latent Intent Verification.
Results
20–50% improvement in detecting zero-day attacks was achieved by LIV compared with output-focused defenses.
Takeaways & Limitations
The findings support checking latent internal states before action rather than relying only on model outputs for safety verification.
Takeaways & Limitations
LIV adds non-trivial inference overhead, and adversaries could theoretically optimize against its selected probing layer.
Abstract
from arXiv · showhide
Safety alignment in Large Language Models (LLMs) is often superficial, relying on refusal mechanisms that trigger only at the final stages of generation without erasing the foundational knowledge of harmful concepts acquired during pretraining. This study demonstrates that this architectural disconnect leaves models vulnerable to Semantic Camouflage -- adversarial attacks that wrap harmful intent in benign narrative contexts (e.g., creative writing), effectively bypassing standard input and output guardrails. By analyzing the latent activation trajectories of three distinct Small Language Model (SLM) families (Phi-3, Qwen2.5, and Gemma-2b) under adversarial stress, this research identifies a universal ``Intent Horizon'' -- a critical depth (typically 15--20\% of total layers) where the model's distinct, pre-trained representation of harmful intent collapses as it contextualizes the query into a ``safe'' narrative. Results indicate that while late-layer representations of camouflaged attacks are mathematically indistinguishable from safe queries (Detection Rate $< 20\%$), early-layer representations retain a distinct, detectable ``harm signature.'' Leveraging this insight, this paper proposes Latent Intent Verification (LIV), a lightweight probing defense. Experiments on the PKU-SafeRLHF dataset demonstrate that LIV outperforms standard guardrails by a margin of 20--50\% across all tested architectures, effectively neutralizing zero-day semantic attacks without requiring model retraining.
I. INTRODUCTION
Semantic Camouflage hides malicious intent inside benign narratives, exposing the limits of perimeter guardrails. The paper identifies an early-layer harm signature and proposes LIV to verify intent before contextual suppression.
- Semantic Camouflage embeds malicious intent in creative writing, role-playing, or code-optimization contexts, bypassing defenses that rely on explicit harmful language.
- The paper frames safety alignment as a decaying signal whose harmful-intent representation changes during internal processing.
- Across Phi-3, Qwen2.5, and Gemma-2b, late-layer camouflaged representations resemble safe queries, while early layers retain a detectable harm signature.
- LIV shifts safety verification from the output layer to early internal layers as a lightweight, model-agnostic defense without retraining.
- Safety information is maximally retrievable within the first 15–20% of network depth.
- Standard late-layer defenses fail to detect > 60% of semantic camouflage attacks that early-layer probes can detect.
II. LITERATURE REVIEW
The literature describes layered input/output guardrails, increasingly automated jailbreak generation, and semantic attacks that exploit benign framing. These limitations motivate defenses operating inside model representations.
- Modern deployments combine input guardrails, output guardrails, classifiers, and rule-based systems to mitigate harmful content.
- Perimeter defenses face a security–utility trade-off: stricter systems can reduce utility, while flexible systems remain manipulable.
- Jailbreaking has progressed from manual prompt engineering to optimization methods such as GCG that generate transferable adversarial suffixes.
- Semantic Camouflage masks malicious intent through benign linguistic features, paraphrases, personification, and virtual scenarios.
C. Reinforcement Learning in Adversarial Contexts
Reinforcement learning enables adversarial systems to discover and adapt novel jailbreak trajectories. This automated adaptability creates a zero-day threat that motivates dynamic, depth-aware defenses.
- RL agents can dynamically discover novel bypass trajectories rather than relying on static attack optimization.
- REINFORCE-based optimization of semantic triggers has doubled attack success rates on aligned models.
- RL-JACK treats prompt generation as black-box search, while AdvPrompter uses a secondary LLM to generate adaptive adversarial suffixes.
- The literature’s emphasis on self-adapting jailbreak strategies motivates the study’s dynamic, depth-aware defense approach.
A. Theoretical Framework: The Intent Horizon
The Intent Horizon challenges the assumption that harm detection remains stable or improves toward final layers. The framework studies layer-wise hidden states across three quantized SLM architectures to locate where contextualization suppresses harmful-intent signals.
- A. Theoretical Framework: The Intent Horizon: The framework models a harmful query x as hidden-state activations h_l(x) evolving across layers l from 1 through L.
- A. Theoretical Framework: The Intent Horizon: Standard alignment assumes P(Harm|h_l) increases or remains stable as processing approaches the final layer.
- A. Theoretical Framework: The Intent Horizon: The Intent Horizon is the critical depth l_crit where semantic contextualization suppresses the raw harmful-intent signal in a camouflaged prompt.
- A. Theoretical Framework: The Intent Horizon: The hypothesis implies that early cognitive recognition of harm can coexist with a final-layer refusal mechanism bypassed by a benign narrative wrapper.
- A. Theoretical Framework: The Intent Horizon: Experiments use three 4-bit NF4-quantized SLM architectures: Phi-3-mini-4k-instruct, Qwen2.5-1.5B-Instruct, and Gemma-2b-it.
- A. Theoretical Framework: The Intent Horizon: The methodology pipeline prepares quantized models, probes early and late activations, then measures the Safety Gap under zero-day Semantic Camouflage attacks.
C. Data Collection and Curation
The evaluation uses standard harmful prompts to train probes and a separate zero-day camouflaged set to test latent-intent generalization across early and late activation depths.
- Dataset construction: A dual-stage evaluation dataset separates probe training from camouflaged-prompt evaluation.The training set contains explicit harmful prompts, while the evaluation set wraps harmful intent in benign contexts without training-set trigger words.
- Training set: 2,000 balanced safe–harmful prompt pairs from PKU-SafeRLHF train the linear probes.The training examples include explicit harmful requests and are used solely for probe training.
- Evaluation set: 100 custom zero-day prompts evaluate detection of semantically camouflaged harmful intent.The prompts use movie scripts, educational roleplay, and code-debugging contexts while excluding explicit trigger words from training.
- Probe locations: Linear probes extract harm signatures from activations at selected network depths.The study compares an early probe at 15% of model depth with a late probe at the final hidden layer.
E. Evaluation Metrics
The evaluation measures the Safety Gap between early and late probes on held-out camouflaged attacks, comparing LIV with standard late-layer defenses across three SLM architectures.
- Metric definition: The Safety Gap (∆S) is the performance differential between early and late probes.A positive ∆S supports the hypothesis that safety information is lost during adversarial-context processing.
- Evaluation metric: Detection Rate (DR) is reported on the camouflaged dataset.The primary experiment evaluates LIV on a held-out adversarial dataset spanning three distinct SLM architectures.
- Late-layer baseline: Standard late-layer defenses achieved detection rates as low as 18% for Phi-3 and 22% for Gemma-2b.These results indicate that perimeter-based guardrails missed the majority of camouflaged attacks.
- LIV performance: 58% to 65%: early-layer LIV probes maintained robust detection rates across the tested models.For Qwen2.5-1.5B, moving the defense from the final layer to Layer 4 produced a 50% relative performance improvement.
- Cross-architecture comparison: Figure 2 compares detection rates for LIV and standard defenses across three model families.Green bars represent LIV and red bars represent standard defenses.
B. Mapping the Intent Horizon
A layer-wise sweep identifies an Intent Horizon where harmful-intent detection collapses as the model incorporates benign narrative context.
- Collapse point: The Phi-3 trajectory identifies a collapse point between Layers 10 and 12.The sweep plots the probability of harm detection against network depth.
- Truth Zone: > 60%: Layers 0–10 retain high confidence in harmful-intent detection despite benign narrative wrapping.These layers constitute the Truth Zone.
- Camouflage Zone: Near 0%: harm probability flatlines at the final output in the Camouflage Zone beginning at Layer 12.The decline occurs as the model integrates the movie-script context.
- Intent Horizon: The Intent Horizon is the depth beyond which instruction-following overrides the model’s safety alignment.The trajectory defines safety information as a decaying signal across processing depth.
C. Geometric Analysis of Latent Space
Geometric analysis shows camouflaged attacks merge with safe queries at the output layer but remain separable outliers at the early Intent Horizon.
- Probe rationale: Geometric Isolation explains why LIV’s simple linear probes can detect camouflaged attacks before contextual processing masks the harm signature.The comparison concerns hidden-state geometry for safe, harmful, and camouflaged queries.
- Output-layer geometry: At Layer N −1, camouflaged attacks are embedded within the Safe cluster and become indistinguishable to linear classifiers.This geometry limits the usefulness of output-layer probing for semantically camouflaged inputs.
- Early-layer geometry: At Layer 4, the same camouflaged attacks appear as distinct outliers separated from the safe cluster.This early-layer separation is described as Geometric Isolation.
A. The Illusion of Safety: Permission Structures
RLHF primarily suppresses harmful surface realizations while leaving internal harmful concepts intact, allowing semantic camouflage to create a permission structure that overrides refusal training. LIV probes this latent understanding early, but introduces inference overhead, may face adaptive attacks, and requires model-specific calibration.
- The Illusion of Safety: Permission Structures: RLHF teaches models what not to say without removing their internal understanding of harmful concepts.
- The Illusion of Safety: Permission Structures: Semantic camouflage constructs a permission structure that can override surface-level refusal training.
- The Illusion of Safety: Permission Structures: LIV interrogates the model’s fundamental understanding before the permission structure is fully processed.
- Limitations: Intermediate-layer probing introduces non-trivial inference overhead that may affect real-time applications.
- Limitations: Adversaries could optimize against LIV’s fixed probing layer, motivating dynamic probing depth.
- Limitations: The Intent Horizon varies with model size and training data, so deployment requires calibration for each model.
C. Future Work
The paper proposes adaptive depth selection and activation steering as future directions, while concluding that transparent verification of internal states is needed for stronger alignment. Its broader roadmap centers on measuring and enforcing white-box safety before autonomous systems act.
- Future Work: Dynamic Depth Probing would adaptively select which layer to interrogate based on prompt perplexity or complexity.
- Future Work: Future work would investigate Steering Vectors that intervene on harmful activation vectors in real time.
- Conclusion: Safety fine-tuning suppresses explicit threats at the output layer but leaves early-layer understanding of harmful concepts intact.
- Conclusion: LIV shifts defense from output behavior to latent internal states, achieving a 20–50% improvement in zero-day attack detection.
- Conclusion: The paper concludes that autonomous-agent safety requires White-Box Safety with internally verifiable states before action.