Truth Lies Deep: Countering Semantic Camouflage via Latent Intent Verification

Large language models are trained to refuse harmful requests, but their safety checks happen only after the text is generated. Researchers show that this lets attackers hide dangerous intent inside seemingly innocent stories, poems, or role‑play prompts. The attack, called Semantic Camouflage, slips past both input filters and output refusals because the model’s internal representation of the harmful goal remains active deep inside the network.

What You Need to Know

The study examined three small language model families—Phi‑3, Qwen2.5, and Gemma‑2b—by feeding them adversarial prompts that wrapped toxic content in benign narratives. Using activation tracing, the authors mapped how the model’s hidden states evolved layer by layer while processing these prompts.

They found a consistent point in the network, which they label the Intent Horizon, where the representation of the harmful goal becomes detectable regardless of the surface story. Below this depth the signal is mixed with narrative features; above it the signal is strong enough to be read by a simple classifier.

The Intent Horizon occurs at roughly the same relative depth across the three architectures (around layer 12 of 24 for Phi‑3, layer 10 of 20 for Qwen2.5, and layer 8 of 16 for Gemma‑2b), suggesting a property of how transformers store intent rather than a quirk of a single model.

Why It Matters

Current safety tools rely on keyword spotting or shallow classifiers that look at the final output. If a harmful goal is concealed in a creative wrapper, those tools miss it, allowing the model to produce disallowed content without triggering a refusal.

By detecting intent at the latent Intent Horizon, developers can insert a verification step that runs mid‑generation, cutting off the flow before the model commits to unsafe text. This approach complements existing guardrails and reduces the surface area for adversarial attacks.

Key Details

• Three SLM families tested: Phi‑3 (3.8B), Qwen2.5 (7B), Gemma‑2b (2B).
• Adversarial prompts consisted of harmless‑looking stories that encoded requests for hate speech, illicit advice, or self‑harm content.
• Activation probing revealed a sharp rise in harmful‑intent signal at a specific transformer layer across all models.
• A linear classifier trained on the Intent Horizon layer achieved >90% detection rate with <5% false positive on clean prompts.
• Inserting a refusal trigger at this layer reduced successful semantic‑camouflage attacks from 68% to under 7% in a held‑out test set.
• The method adds minimal computational overhead—only a single forward pass to the target layer and a lightweight classifier.

What’s Next

Future work will test the Intent Horizon concept on larger models (e.g., Llama‑3 70B) and explore whether adaptive attackers can shift the horizon depth by altering prompt structure. Researchers also plan to integrate latent intent verification into existing safety toolkits as a plug‑in module, evaluating its impact on latency and usability in real‑time applications.

📌 Source: Arxiv Ai