PaperlayerView exact revision on arXiv

Source-linked AI summary

Truth Lies Deep: Countering Semantic Camouflage via Latent Intent Verification

Md. Hasib Ur Rahman

arXiv:2608.20378v1cs.AI

TL;DR

The paper addresses the vulnerability of perimeter safety defenses to Semantic Camouflage, which hides harmful intent in benign narrative contexts. It analyzes layer-wise activations across three SLM families and proposes LIV, an early-layer probing defense. LIV improves zero-day attack detection by 20–50%, while adaptive attacks and inference overhead remain limitations.

  • Problem

    Semantic Camouflage can bypass input/output guardrails by obscuring malicious intent in benign narratives, while safety fine-tuning leaves early harmful-concept representations intact.

    Source: §I · p. 1, A. The Illusion of Safety: Permission… · p. 5, §VI · p. 5

  • Method

    The study analyzes internal activation trajectories across three SLM architectures and shifts safety verification to early layers using Latent Intent Verification.

    Source: §I · p. 1, A. Theoretical Framework: The Intent… · p. 2

  • Results

    20–50% improvement in detecting zero-day attacks was achieved by LIV compared with output-focused defenses.

    Source: §VI · p. 5

  • Takeaways & Limitations

    The findings support checking latent internal states before action rather than relying only on model outputs for safety verification.

    Source: §VI · p. 5

    LIV adds non-trivial inference overhead, and adversaries could theoretically optimize against its selected probing layer.

    Source: B. Limitations · p. 5

Abstract

from arXiv · show

Safety alignment in Large Language Models (LLMs) is often superficial, relying on refusal mechanisms that trigger only at the final stages of generation without erasing the foundational knowledge of harmful concepts acquired during pretraining. This study demonstrates that this architectural disconnect leaves models vulnerable to Semantic Camouflage -- adversarial attacks that wrap harmful intent in benign narrative contexts (e.g., creative writing), effectively bypassing standard input and output guardrails. By analyzing the latent activation trajectories of three distinct Small Language Model (SLM) families (Phi-3, Qwen2.5, and Gemma-2b) under adversarial stress, this research identifies a universal ``Intent Horizon'' -- a critical depth (typically 15--20\% of total layers) where the model's distinct, pre-trained representation of harmful intent collapses as it contextualizes the query into a ``safe'' narrative. Results indicate that while late-layer representations of camouflaged attacks are mathematically indistinguishable from safe queries (Detection Rate $< 20\%$), early-layer representations retain a distinct, detectable ``harm signature.'' Leveraging this insight, this paper proposes Latent Intent Verification (LIV), a lightweight probing defense. Experiments on the PKU-SafeRLHF dataset demonstrate that LIV outperforms standard guardrails by a margin of 20--50\% across all tested architectures, effectively neutralizing zero-day semantic attacks without requiring model retraining.

I. INTRODUCTION

Semantic Camouflage hides malicious intent inside benign narratives, exposing the limits of perimeter guardrails. The paper identifies an early-layer harm signature and proposes LIV to verify intent before contextual suppression.

  • Semantic Camouflage embeds malicious intent in creative writing, role-playing, or code-optimization contexts, bypassing defenses that rely on explicit harmful language.Source: §I · p. 1
  • The paper frames safety alignment as a decaying signal whose harmful-intent representation changes during internal processing.Source: §I · p. 1
  • Across Phi-3, Qwen2.5, and Gemma-2b, late-layer camouflaged representations resemble safe queries, while early layers retain a detectable harm signature.Source: §I · p. 1
  • LIV shifts safety verification from the output layer to early internal layers as a lightweight, model-agnostic defense without retraining.Source: §I · p. 1
  • Safety information is maximally retrievable within the first 15–20% of network depth.Source: §I · p. 1
  • Standard late-layer defenses fail to detect > 60% of semantic camouflage attacks that early-layer probes can detect.Source: §I · p. 1

II. LITERATURE REVIEW

The literature describes layered input/output guardrails, increasingly automated jailbreak generation, and semantic attacks that exploit benign framing. These limitations motivate defenses operating inside model representations.

C. Reinforcement Learning in Adversarial Contexts

Reinforcement learning enables adversarial systems to discover and adapt novel jailbreak trajectories. This automated adaptability creates a zero-day threat that motivates dynamic, depth-aware defenses.

A. Theoretical Framework: The Intent Horizon

The Intent Horizon challenges the assumption that harm detection remains stable or improves toward final layers. The framework studies layer-wise hidden states across three quantized SLM architectures to locate where contextualization suppresses harmful-intent signals.

A. Theoretical Framework: The Intent Horizon

C. Data Collection and Curation

The evaluation uses standard harmful prompts to train probes and a separate zero-day camouflaged set to test latent-intent generalization across early and late activation depths.

Dataset construction

  • A dual-stage evaluation dataset separates probe training from camouflaged-prompt evaluation.The training set contains explicit harmful prompts, while the evaluation set wraps harmful intent in benign contexts without training-set trigger words.Source: C. Data Collection and Curation · p. 3

Training set

  • 2,000 balanced safe–harmful prompt pairs from PKU-SafeRLHF train the linear probes.The training examples include explicit harmful requests and are used solely for probe training.Source: C. Data Collection and Curation · p. 3

Evaluation set

  • 100 custom zero-day prompts evaluate detection of semantically camouflaged harmful intent.The prompts use movie scripts, educational roleplay, and code-debugging contexts while excluding explicit trigger words from training.Source: C. Data Collection and Curation · p. 3

Probe locations

  • Linear probes extract harm signatures from activations at selected network depths.The study compares an early probe at 15% of model depth with a late probe at the final hidden layer.Source: D. Probing Architecture · p. 3

E. Evaluation Metrics

The evaluation measures the Safety Gap between early and late probes on held-out camouflaged attacks, comparing LIV with standard late-layer defenses across three SLM architectures.

Metric definition

  • The Safety Gap (∆S) is the performance differential between early and late probes.A positive ∆S supports the hypothesis that safety information is lost during adversarial-context processing.Source: E. Evaluation Metrics · p. 3

Evaluation metric

  • Detection Rate (DR) is reported on the camouflaged dataset.The primary experiment evaluates LIV on a held-out adversarial dataset spanning three distinct SLM architectures.Source: A. The Safety Gap: Early vs. Late… · p. 4

Late-layer baseline

  • Standard late-layer defenses achieved detection rates as low as 18% for Phi-3 and 22% for Gemma-2b.These results indicate that perimeter-based guardrails missed the majority of camouflaged attacks.Source: A. The Safety Gap: Early vs. Late… · p. 4

LIV performance

  • 58% to 65%: early-layer LIV probes maintained robust detection rates across the tested models.For Qwen2.5-1.5B, moving the defense from the final layer to Layer 4 produced a 50% relative performance improvement.Source: A. The Safety Gap: Early vs. Late… · p. 4

Cross-architecture comparison

  • Figure 2 compares detection rates for LIV and standard defenses across three model families.Green bars represent LIV and red bars represent standard defenses.Source: Figure 2 · p. 4

B. Mapping the Intent Horizon

A layer-wise sweep identifies an Intent Horizon where harmful-intent detection collapses as the model incorporates benign narrative context.

Collapse point

  • The Phi-3 trajectory identifies a collapse point between Layers 10 and 12.The sweep plots the probability of harm detection against network depth.Source: B. Mapping the Intent Horizon · p. 4

Truth Zone

  • > 60%: Layers 0–10 retain high confidence in harmful-intent detection despite benign narrative wrapping.These layers constitute the Truth Zone.Source: B. Mapping the Intent Horizon · p. 4

Camouflage Zone

  • Near 0%: harm probability flatlines at the final output in the Camouflage Zone beginning at Layer 12.The decline occurs as the model integrates the movie-script context.Source: B. Mapping the Intent Horizon · p. 4

Intent Horizon

C. Geometric Analysis of Latent Space

Geometric analysis shows camouflaged attacks merge with safe queries at the output layer but remain separable outliers at the early Intent Horizon.

Probe rationale

  • Geometric Isolation explains why LIV’s simple linear probes can detect camouflaged attacks before contextual processing masks the harm signature.The comparison concerns hidden-state geometry for safe, harmful, and camouflaged queries.Source: C. Geometric Analysis of Latent Space · p. 4

Output-layer geometry

  • At Layer N −1, camouflaged attacks are embedded within the Safe cluster and become indistinguishable to linear classifiers.This geometry limits the usefulness of output-layer probing for semantically camouflaged inputs.Source: C. Geometric Analysis of Latent Space · p. 4

Early-layer geometry

A. The Illusion of Safety: Permission Structures

RLHF primarily suppresses harmful surface realizations while leaving internal harmful concepts intact, allowing semantic camouflage to create a permission structure that overrides refusal training. LIV probes this latent understanding early, but introduces inference overhead, may face adaptive attacks, and requires model-specific calibration.

The Illusion of Safety: Permission Structures

Limitations

  • Intermediate-layer probing introduces non-trivial inference overhead that may affect real-time applications.Source: B. Limitations · p. 5
  • Adversaries could optimize against LIV’s fixed probing layer, motivating dynamic probing depth.Source: B. Limitations · p. 5
  • The Intent Horizon varies with model size and training data, so deployment requires calibration for each model.Source: B. Limitations · p. 5

C. Future Work

The paper proposes adaptive depth selection and activation steering as future directions, while concluding that transparent verification of internal states is needed for stronger alignment. Its broader roadmap centers on measuring and enforcing white-box safety before autonomous systems act.

Future Work

  • Dynamic Depth Probing would adaptively select which layer to interrogate based on prompt perplexity or complexity.Source: C. Future Work · p. 5
  • Future work would investigate Steering Vectors that intervene on harmful activation vectors in real time.Source: C. Future Work · p. 5

Conclusion

  • Safety fine-tuning suppresses explicit threats at the output layer but leaves early-layer understanding of harmful concepts intact.Source: §VI · p. 5
  • LIV shifts defense from output behavior to latent internal states, achieving a 20–50% improvement in zero-day attack detection.Source: §VI · p. 5
  • The paper concludes that autonomous-agent safety requires White-Box Safety with internally verifiable states before action.Source: §VI · p. 5
Loading 2608.20378v1…