Truth Lies Deep: Countering Semantic Camouflage via Latent Intent Verification
06:00 · August 24, 2026 · arXiv cs.AI RSS
Safety alignment in Large Language Models (LLMs) is often superficial, relying on refusal mechanisms that trigger only at the final stages of generation without erasing the foundational knowledge of harmful concepts acquired during pretraining. This study demonstrates that this architectural disconnect leaves models vulnerable to Semantic Camouflage -- adversarial attacks that wrap harmful intent in benign narrative contexts (e.g., creative writing), effectively bypassing standard input and output guardrails. By analyzing the latent activation trajectories of three distinct Small Language Model (SLM) families (Phi-3, Qwen2.5, and Gemma-2b) under adversarial stress, this research identifies a universal ``Intent Horizon'' -- a critical depth (typically 15--20\% of total layers) where the model's distinct, pre-trained representation of harmful intent collapses as it contextualizes the query into a ``safe'' narrative. Results indicate that while late-layer representations of camouflaged attacks are mathematically indistinguishable from safe queries (Detection Rate $< 20\%$), early-layer representations retain a distinct, detectable ``harm signature.'' Leveraging this insight, this paper proposes Latent Intent Verification (LIV), a lightweight probing defense. Experiments on the PKU-SafeRLHF dataset demonstrate that LIV outperforms standard guardrails by a margin of 20--50\% across all tested architectures, effectively neutralizing zero-day semantic attacks without requiring model retraining.
Summary
Safety alignment in large language models often remains superficial, with refusal behaviors triggered only near the final output layers even though the models retain pre-trained knowledge of harmful concepts. This architectural gap leaves Small Language Models particularly exposed to semantic camouflage, in which malicious intent is embedded inside benign narrative frames such as creative writing or role-play scenarios. Standard input and output guardrails, which rely on surface-level linguistic signals, therefore fail to intercept these attacks.
Analysis of internal activations across three SLM families—Phi-3, Qwen2.5, and Gemma-2b—reveals a consistent pattern termed the Intent Horizon. At roughly 15–20 % of total network depth, the distinct latent representation of harmful intent collapses once the model integrates the query into a contextual “safe” narrative. Early-layer states still carry a detectable harm signature, whereas later layers render camouflaged prompts mathematically indistinguishable from benign ones, yielding detection rates below 20 % for conventional perimeter defenses.
To exploit this early-layer signal, the study introduces Latent Intent Verification, a lightweight probing technique that inspects residual-stream activations before contextual suppression occurs. When evaluated on the PKU-SafeRLHF dataset, LIV raises zero-day jailbreak detection by 20–50 % across the tested architectures. The method requires no retraining or architectural changes and operates as an internal checkpoint rather than an external filter.
Why it matters
This research is highly relevant for Dutch AI researchers and enterprises focused on ethical AI and EU AI Act compliance. By offering a lightweight, mechanistic interpretability-based defense against sophisticated jailbreaks, it provides actionable methods to enhance the robustness and safety of deployed language models.
