Latent Intent Verification proposed to detect adversarial semantic camouflage in small language models

Safety alignment in LLMs is frequently implemented via refusal triggers at the final generation stage, leaving models susceptible to adversarial attacks that conceal harmful intent within benign narratives—termed 'semantic camouflage.'

By analyzing latent activation trajectories in three small language model families (Phi-3, Qwen2.5, and Gemma-2b), the authors identify a consistent 'Intent Horizon' at roughly 15–20% of total layers where the model’s pre-trained representation of harmful intent collapses as it reframes the query into a 'safe' narrative.

Late-layer representations of camouflaged attacks become statistically indistinguishable from safe queries, with detection rates below 20%, but early-layer activations retain a detectable 'harm signature.'

The proposed Latent Intent Verification (LIV) defense uses a lightweight probe to detect these early-layer signatures. On the PKU-SafeRLHF dataset, LIV improves detection performance by 20–50% over standard guardrails across all tested architectures, neutralizing zero-day semantic attacks without requiring model retraining.