Camouflaged LLM attacks hide from guardrails, but a latent-layer probe catches them
Safety alignment in LLMs is skin-deep: refusal triggers live at the final layers while pretrained harm knowledge stays buried. This paper shows how "semantic camouflage" — harmful intent wrapped in benign creative-writing prompts — becomes mathematically indistinguishable from safe queries late in the network, yet retains a detectable early-layer harm signature. Latent Intent Verification, a lightweight probing defense, exploits that, beating standard guardrails by 20–50% across Phi-3, Qwen2.5, and Gemma-2b with no retraining.