AIBRIEF
A lightweight check that reads a model's early internal processing rather than just its final answer catches 20–50% more "camouflaged" attacks than output filters, without retraining.
Most AI safety filters read a model's final answer. New research argues that is the wrong place to look. By the time the last layer speaks, a harmful request wrapped in a creative-writing frame has already been re-classified as something benign.
The paper, Truth Lies Deep: Countering Semantic Camouflage via Latent Intent Verification, calls the trick "semantic camouflage": a harmful prompt hidden inside an innocent narrative such as a story-writing exercise. The authors trace how three small open language models (Phi-3, Qwen2.5, and Gemma-2b) process these attacks. They find that models resolve intent early, then keep building on a "safe" framing. After roughly the first 15–20% of layers, the internal representation of harm collapses into something mathematically indistinguishable from a normal prompt. Output filters, which only read the final reply, see a clean answer.
The team's proposed fix, a lightweight probe they call Latent Intent Verification (LIV), reads that earlier signal directly. On the authors' PKU-SafeRLHF benchmark, they report LIV beats standard guardrails by 20–50% across all three models, with no retraining required.
The caveats matter. The work is an arXiv preprint, not peer-reviewed. The evaluation is single-team and self-run. The tested models are small open systems, not the largest frontier LLMs. The claim that a universal "Intent Horizon" exists across model sizes is not yet corroborated.