Truth Lies Deep: Countering Semantic Camouflage via Latent Intent Verification

真相深藏：通过潜在意图验证对抗语义伪装

Abstract: Safety alignment in Large Language Models (LLMs) is often superficial, relying on refusal mechanisms that trigger only at the final stages of generation without erasing the foundational knowledge of harmful concepts acquired during pretraining.

摘要： 大语言模型（LLM）的安全对齐往往流于表面，仅依赖于在生成最后阶段触发的拒绝机制，而并未抹除预训练过程中习得的有害概念的基础知识。

This study demonstrates that this architectural disconnect leaves models vulnerable to Semantic Camouflage — adversarial attacks that wrap harmful intent in benign narrative contexts (e.g., creative writing), effectively bypassing standard input and output guardrails.

本研究表明，这种架构上的脱节使得模型容易受到“语义伪装”的攻击——即通过将有害意图包裹在良性叙事语境（如创意写作）中，从而有效地绕过标准的输入和输出护栏。

By analyzing the latent activation trajectories of three distinct Small Language Model (SLM) families (Phi-3, Qwen2.5, and Gemma-2b) under adversarial stress, this research identifies a universal Intent Horizon'' -- a critical depth (typically 15--20\% of total layers) where the model's distinct, pre-trained representation of harmful intent collapses as it contextualizes the query into a safe” narrative.

通过分析三种不同的小语言模型（SLM）系列（Phi-3、Qwen2.5 和 Gemma-2b）在对抗性压力下的潜在激活轨迹，本研究确定了一个通用的“意图视界”（Intent Horizon）——即一个临界深度（通常为总层数的 15%—20%），在该深度处，模型对有害意图的独特预训练表征会随着其将查询语境化为“安全”叙事而坍缩。

Results indicate that while late-layer representations of camouflaged attacks are mathematically indistinguishable from safe queries (Detection Rate $< 20%$), early-layer representations retain a distinct, detectable “harm signature.”

结果表明，虽然伪装攻击在深层（late-layer）的表征在数学上与安全查询无法区分（检测率 < 20%），但浅层（early-layer）的表征仍保留了独特且可检测的“危害特征”。

Leveraging this insight, this paper proposes Latent Intent Verification (LIV), a lightweight probing defense. Experiments on the PKU-SafeRLHF dataset demonstrate that LIV outperforms standard guardrails by a margin of 20—50% across all tested architectures, effectively neutralizing zero-day semantic attacks without requiring model retraining.

基于这一洞察，本文提出了潜在意图验证（LIV），这是一种轻量级的探测防御机制。在 PKU-SafeRLHF 数据集上的实验证明，LIV 在所有测试架构中均优于标准护栏，性能提升了 20%—50%，能够在无需重新训练模型的情况下有效中和零日语义攻击。