New Defense Counters Semantic Camouflage in LLMs

Current safety alignment mechanisms in Large Language Models (LLMs) often prove superficial, triggering only at the final stages of generation and failing to erase harmful knowledge acquired during pretraining. This architectural flaw leaves LLMs vulnerable to "Semantic Camouflage," where malicious intent is disguised within benign narrative contexts, bypassing standard input and output guardrails. Researchers analyzed the latent activation trajectories of three Small Language Model (SLM) families (Phi-3, Qwen2.5, Gemma-2b) under adversarial stress. They identified an "Intent Horizon"—a critical depth (15-20% of total layers) where the model's distinct representation of harmful intent collapses as it contextualizes the query into a "safe" narrative. While late-layer representations of camouflaged attacks are indistinguishable from safe queries, early-layer representations retain a detectable "harm signature." Leveraging this insight, the paper proposes Latent Intent Verification (LIV), a lightweight probing defense. Experiments on the PKU-SafeRLHF dataset demonstrated that LIV significantly outperforms standard guardrails by 20-50% across all tested architectures, effectively neutralizing zero-day semantic attacks without requiring model retraining.