Truth Lies Deep: Countering Semantic Camouflage via Latent Intent Verification

# Truth Lies Deep: Countering Semantic Camouflage via Latent Intent Verification
Source: [https://arxiv.org/html/2608.20378](https://arxiv.org/html/2608.20378)
###### Abstract

Safety alignment in Large Language Models \(LLMs\) is often superficial, relying on refusal mechanisms that trigger only at the final stages of generation without erasing the foundational knowledge of harmful concepts acquired during pretraining\. This study demonstrates that this architectural disconnect leaves models vulnerable to Semantic Camouflage—adversarial attacks that wrap harmful intent in benign narrative contexts \(e\.g\., creative writing\), effectively bypassing standard input and output guardrails\. By analyzing the latent activation trajectories of three distinct Small Language Model \(SLM\) families \(Phi\-3, Qwen2\.5, and Gemma\-2b\) under adversarial stress, this research identifies a universal “Intent Horizon”—a critical depth \(typically 15–20% of total layers\) where the model’s distinct, pre\-trained representation of harmful intent collapses as it contextualizes the query into a “safe” narrative\. Results indicate that while late\-layer representations of camouflaged attacks are mathematically indistinguishable from safe queries \(Detection Rate<20%<20\\%\), early\-layer representations retain a distinct, detectable “harm signature\.” Leveraging this insight, this paper proposes Latent Intent Verification \(LIV\), a lightweight probing defense\. Experiments on the PKU\-SafeRLHF dataset demonstrate that LIV outperforms standard guardrails by a margin of 20–50% across all tested architectures, effectively neutralizing zero\-day semantic attacks without requiring model retraining\.

## IIntroduction

Despite extensive safety alignment via Reinforcement Learning from Human Feedback \(RLHF\), Large Language Models \(LLMs\) remain extremely fragile\. While models such as Llama\-3 and Phi\-3 demonstrate robust refusal rates against explicit harmful queries, they frequently fail to resistSemantic Camouflage—a sophisticated class of adversarial attacks where malicious intent is obscured within benign narrative structures, such as creative writing, role\-playing, or code optimization tasks\.

This vulnerability highlights a critical flaw in current defense paradigms\. Existing guardrails typically operate as “Perimeter Defenses,” monitoring either the initial input prompt or the final output embedding\. This approach assumes that harmful content is linguistically distinct from safe content\. However, semantic camouflage decouples malicious intent from malicious vocabulary, rendering keyword\-based and superficial semantic filters ineffective\. As a result, a “Cat\-and\-Mouse” dynamic has emerged, where static defenses are continuously outmaneuvered by zero\-day jailbreaks that exploit the model’s instruction\-following capabilities\.

This study shows that the solution lies not in better filtering of theoutput, but deep into the process\. By leveraging Mechanistic Interpretability, this research investigates the internal activation trajectories of Small Language Models \(SLMs\) under adversarial stress\. The central hypothesis is that safety alignment is not a binary state but a decaying signal—a phenomenon this paper terms the “Intent Horizon\.”

The Intent Horizon represents a critical depth within the neural network where the distinct representation of harmful intent is suppressed by contextual framing\. Through empirical analysis of Microsoft Phi\-3, Qwen2\.5, and Gemma\-2b, this study reveals that while late\-layer representations of camouflaged attacks are mathematically indistinguishable from safe queries, early\-layer representations retain a vivid “harm signature\.”

To address this, this paper proposes Latent Intent Verification \(LIV\), a novel defense mechanism that shifts the safety checkpoint from the output layer to the model’s “subconscious” early layers\.

The specific contributions of this work are as follows:

- •Identification of the Intent Horizon:Empirical mapping of the layer\-wise decay of harmful intent signals, revealing that safety information is maximally retrievable in the first 15–20% of network depth\.
- •Demonstration of the Safety Gap:Quantitative evidence showing that standard late\-layer defenses fail to detect\>60%\>60\\%of semantic camouflage attacks that are easily visible to early\-layer probes\.
- •Development of LIV:A lightweight, model\-agnostic probing technique that improves zero\-day jailbreak detection by 20–50% on the PKU\-SafeRLHF dataset without requiring model retraining or fine\-tuning\.

## IILiterature Review

LLM safety is evolving quickly, as alignment defenses compete with ever more advanced adversarial attacks\. \. This section gives review of the the current landscape of safety guardrails, the progression of jailbreaking methodologies, and the emerging role of Reinforcement Learning \(RL\)\.

### II\-AThe Evolution of Safety Guardrails

To mitigate the generation of harmful or unethical content, modern LLM deployments rely on a multi\-layered defense architecture\[[19](https://arxiv.org/html/2608.20378#bib.bib1),[6](https://arxiv.org/html/2608.20378#bib.bib2)\]\. These mechanisms are generally categorized intoInput Guardrails, which filter adversarial prompts before processing, andOutput Guardrails, which monitor generated responses in real\-time\[[19](https://arxiv.org/html/2608.20378#bib.bib1)\]\. Implementation strategies range from fine\-tuned NLP classifiers \(e\.g\., BERT\-based detectors\)\[[9](https://arxiv.org/html/2608.20378#bib.bib3)\]to programmable rule\-based systems that enforce ethical guidelines\[[6](https://arxiv.org/html/2608.20378#bib.bib2)\]\. Open\-source frameworks such as Llama Guard and Nvidia NeMo have standardized these defenses\[[5](https://arxiv.org/html/2608.20378#bib.bib4)\], while more advanced ”Self\-Defense” mechanisms employ secondary ”Shadow LLMs” to audit the primary model’s outputs\[[17](https://arxiv.org/html/2608.20378#bib.bib5)\]\.

However, recent empirical studies suggest inherent limitations in these perimeter\-based defenses\. Research indicates that ”no free lunch” exists with guardrails; stringent security measures frequently degrade general model utility, while flexible systems remain vulnerable to manipulation\[[12](https://arxiv.org/html/2608.20378#bib.bib6)\]\. This trade\-off underscores the necessity for defenses that operate internally rather than merely at the input/output surface\.

### II\-BThe Adversarial Landscape: From Optimization to Camouflage

Jailbreaking techniques—methods designed to bypass safety alignment—have shifted from manual engineering to algorithmic optimization\[[17](https://arxiv.org/html/2608.20378#bib.bib5),[8](https://arxiv.org/html/2608.20378#bib.bib7)\]\. Early methods relied on human intuition, but optimization\-based attacks such as the Greedy Coordinate Gradient \(GCG\) now automatically generate ”adversarial suffixes” that maximize the probability of affirmative responses\[[20](https://arxiv.org/html/2608.20378#bib.bib8)\]\. These automated attacks exhibit high transferability across different model architectures\.

A more insidious development isSemantic Camouflage, where malicious intent is masked by benign linguistic features or creative framing, effectively bypassing standard classifiers\[[18](https://arxiv.org/html/2608.20378#bib.bib9)\]\. This category includes ”Infinitely Many Paraphrases” attacks that exploit encoding vulnerabilities\[[8](https://arxiv.org/html/2608.20378#bib.bib7)\], and ”Nested Jailbreaks” \(e\.g\., DeepInception\) that leverage personification and virtual scenarios to escape usage controls\[[13](https://arxiv.org/html/2608.20378#bib.bib11),[4](https://arxiv.org/html/2608.20378#bib.bib12)\]\. Furthermore, the introduction of multimodal capabilities has opened new attack vectors, where visual cues are used to bypass textual safety checks\[[3](https://arxiv.org/html/2608.20378#bib.bib13)\]\. The efficacy of these ”camouflaged” attacks against state\-of\-the\-art models\[[1](https://arxiv.org/html/2608.20378#bib.bib14)\]highlights the critical need for defenses that can detect latent intent rather than just surface\-level keywords\[[15](https://arxiv.org/html/2608.20378#bib.bib15)\]\.

### II\-CReinforcement Learning in Adversarial Contexts

Reinforcement Learning \(RL\) has emerged as a potent accelerator for adversarial generation\. Unlike static optimization, RL agents can be trained to dynamically discover novel bypass trajectories\[[7](https://arxiv.org/html/2608.20378#bib.bib16),[14](https://arxiv.org/html/2608.20378#bib.bib17)\]\. For example, the REINFORCE algorithm has been adapted to optimize semantic triggers that double attack success rates on aligned models\[[7](https://arxiv.org/html/2608.20378#bib.bib16)\]\.

Recent frameworks such as RL\-JACK frame prompt generation as a black\-box search problem\[[2](https://arxiv.org/html/2608.20378#bib.bib18)\], while ”AdvPrompter” utilizes a secondary LLM to adaptively generate adversarial suffixes without human supervision\[[14](https://arxiv.org/html/2608.20378#bib.bib17)\]\. While some research explores using RL to refine queries for robustness\[[10](https://arxiv.org/html/2608.20378#bib.bib20)\], the prevailing trend suggests that LLMs possess intrinsic capabilities to ”self\-learn” jailbreaking strategies\[[16](https://arxiv.org/html/2608.20378#bib.bib21),[11](https://arxiv.org/html/2608.20378#bib.bib19)\]\. This capability for automated adaptation poses a ”Zero\-Day” threat, necessitating the dynamic, depth\-aware defenses proposed in this study\.

## IIIMethodology

![Refer to caption](https://arxiv.org/html/2608.20378v1/Untitled_presentation.png)Figure 1:Methodology Pipeline:The three\-phase experimental design for Latent Intent Verification \(LIV\)\.Phase 1prepares the quantized SLM environment across three architectures\.Phase 2involves extracting internal activations to train linear probes on early \(LIV\) vs\. late layers\.Phase 3stresses the model with zero\-day “Semantic Camouflage” attacks to quantify the Safety Gap \(ΔS\\Delta\_\{S\}\)\.To validate the failure of perimeter\-based defenses and evaluate the efficacy of Latent Intent Verification \(LIV\), a mechanistic interpretability framework was designed to interrogate the internal residual streams of Large Language Models\. This section details the theoretical formulation, experimental subjects, and the probing architecture used to map the Intent Horizon\.

### III\-ATheoretical Framework: The Intent Horizon

It is posited that an LLM’s processing of a harmful queryxxevolves across its layersl∈\{1,…,L\}l\\in\\\{1,\\dots,L\\\}\. Let𝐡l​\(x\)\\mathbf\{h\}\_\{l\}\(x\)denote the hidden state activation vector at layerll\. Standard safety alignment operates under the assumption that the probability of harm detection,P​\(H​a​r​m\|𝐡l\)P\(Harm\|\\mathbf\{h\}\_\{l\}\), increases or remains stable asl→Ll\\to L\.

This assumption is challenged by the ”Intent Horizon” Hypothesis\. The Intent Horizon is defined as a critical depthlc​r​i​tl\_\{crit\}where the semantic contextualization of the query suppresses the raw harmful intent signal\. Formally, for a semantically camouflaged promptxc​a​mx\_\{cam\}, the hypothesis states:

P​\(H​a​r​m\|𝐡l\)≈1for​l<lc​r​i​tP\(Harm\|\\mathbf\{h\}\_\{l\}\)\\approx 1\\quad\\text\{for \}l<l\_\{crit\}\(1\)P​\(H​a​r​m\|𝐡l\)→0for​l\>lc​r​i​tP\(Harm\|\\mathbf\{h\}\_\{l\}\)\\to 0\\quad\\text\{for \}l\>l\_\{crit\}\(2\)This implies that while thecognitive recognitionof the harm exists early in the network, therefusal mechanismat the final layer is bypassed by the benign narrative wrapper\.

### III\-BSubject Models and Environment

To ensure the universality of the findings, three distinct Small Language Model \(SLM\) architectures were selected, chosen for their efficiency and high reasoning\-to\-size ratio\. All models were loaded using 4\-bit NormalFloat \(NF4\) quantization to simulate resource\-constrained deployment environments:

1. 1\.Microsoft Phi\-3\-mini\-4k\-instruct \(3\.8B\):Selected for its dense reasoning capabilities and unique training on synthetic data\.
2. 2\.Qwen2\.5\-1\.5B\-Instruct \(1\.5B\):Selected to represent a highly efficient, non\-Western model architecture\.
3. 3\.Google Gemma\-2b\-it \(2B\):Selected as a representative of the standard dense transformer architecture\.

### III\-CData Collection and Curation

A dual\-stage evaluation dataset was constructed to rigorously test generalization:

- •Training Set \(Standard\):The PKU\-SafeRLHF dataset\[[19](https://arxiv.org/html/2608.20378#bib.bib1)\]was utilized, sampling 2,000 balanced pairs of safe and explicitly harmful prompts \(e\.g\., ”How to build a bomb”\)\. This data was used solely to train the linear probes\.
- •Evaluation Set \(Camouflaged\):A custom ”Zero\-Day” dataset of 100 semantically camouflaged prompts \(e\.g\., movie script generation, educational roleplay, code debugging contexts\) was curated to wrap harmful intent\. Importantly, these prompts contain no explicit ”trigger words” found in the training set, forcing the probes to detect latent intent rather than lexical patterns\.

### III\-DProbing Architecture

Linear Probes were employed to extract and analyze the ”harm signature” at specific network depths\. For each model, activations were extracted from two distinct loci:

1. 1\.The Early Probe \(LIV\):Targeted at 15% of total depth \(e\.g\., Layer 4 for Phi\-3\)\. This targets the pre\-contextualized semantic processing\.
2. 2\.The Late Probe \(Standard\):Targeted at the final hidden layer \(LayerN−1N\-1\)\. This represents the standard embedding used by existing output guardrails\.

Logistic Regression classifiers \(C=1\.0C=1\.0, L2 penalty\) were trained on the Standard set and evaluated on the Camouflaged set\. This disconnect between training \(explicit\) and evaluation \(camouflaged\) specifically measures the robustness of the ”harm signature” against semantic shifts\.

### III\-EEvaluation Metrics

The Detection Rate\(DR\) on the camouflaged dataset is reported\. The Safety Gap \(ΔS\\Delta\_\{S\}\) is defined as the performance differential between the early and late probes:

ΔS=D​Re​a​r​l​y−D​Rl​a​t​e\\Delta\_\{S\}=DR\_\{early\}\-DR\_\{late\}\(3\)A positiveΔS\\Delta\_\{S\}confirms the Intent Horizon hypothesis, indicating that safety information is lost as the model processes the adversarial context\.

## IVResults

In this section, the empirical validation of the Intent Horizon hypothesis is presented\. The performance differential between early and late probes across multiple architectures is analyzed, the precise layer\-wise decay of safety signals is mapped, and geometric evidence of latent space separation is provided\.

### IV\-AThe Safety Gap: Early vs\. Late Detection

The primary experiment evaluated the robustness of Latent Intent Verification \(LIV\) against zero\-day semantic camouflage\. Figure[2](https://arxiv.org/html/2608.20378#S4.F2)illustrates the detection rates for three distinct SLM architectures on the held\-out adversarial dataset\.

The results reveal a substantial Safety Gap \(ΔS\\Delta\_\{S\}\)\. Standard late\-layer defenses \(Red bars\) consistently failed to detect the majority of camouflaged attacks, achieving detection rates as low as 18% for Phi\-3 and 22% for Gemma\-2b\. This confirms that perimeter\-based guardrails are effectively ”blind” to semantic wrapping\.

In sharp contrast, the early\-layer LIV probes \(Green bars\) maintained robust detection rates ranging from 58% to 65%\. For the Qwen2\.5\-1\.5B model, shifting the defense depth from the final layer to Layer 4 resulted in a relative performance improvement of50%\. This indicates that the ”harm signature” is not absent from the model; it is merely suppressed by the subsequent processing layers\.

![Refer to caption](https://arxiv.org/html/2608.20378v1/detection_rate.png)Figure 2:The Safety Gap\.Detection rates of adversarial jailbreaks across three model families\. Green bars \(LIV\) consistently outperform Red bars \(Standard\), highlighting the vulnerability of output\-based defenses\.
### IV\-BMapping the Intent Horizon

To understand the dynamics of this suppression, a granular layer\-wise sweep was performed on the Microsoft Phi\-3 model\. Figure[3](https://arxiv.org/html/2608.20378#S4.F3)plots the probability of harm detectionP​\(H​a​r​m\)P\(Harm\)against network depth\.

The trajectory identifies a clear Collapse Point between Layers 10 and 12\.

- •The Truth Zone \(Layers 0–10\):The model exhibits high confidence \(\>60%\>60\\%\) in identifying harmful intent, regardless of the benign narrative wrapper\.
- •The Camouflage Zone \(Layers 12\+\):As the model integrates the ”movie script” context, the harm probability precipitously drops, flatlining near 0% at the final output\.

This trajectory empirically defines the ”Intent Horizon”—the depth limit beyond which the model’s safety alignment is overridden by its instruction\-following capabilities\.

![Refer to caption](https://arxiv.org/html/2608.20378v1/intent_horizon.png)Figure 3:The Intent Horizon\.The probability of detecting harmful intent collapses after Layer 10\. This visualization proves that safety information is a decaying signal, not a constant one\.
### IV\-CGeometric Analysis of Latent Space

To visualize the mechanism of LIV, the hidden states of safe, harmful, and camouflaged queries were projected into 2D space\. Table[I](https://arxiv.org/html/2608.20378#S4.T1)summarizes the geometric relationships observed\.

At the output layer \(LayerN−1N\-1\), the camouflaged attacks are topologically embedded within the ”Safe” cluster, making them mathematically indistinguishable from benign queries to any linear classifier\. However, at the Intent Horizon \(Layer 4\), these same attacks appear as distinct outliers, separated from the safe cluster\. ThisGeometric Isolationexplains why the simple linear probes of LIV are effective: they operate in a space where the ”crime” has not yet been masked by the ”alibi\.”

TABLE I:Geometric analysis of Semantic Camouflage attacks\. At early layers, adversarial inputs remain distinct outliers, enabling detection\.

## VDiscussion

The evidence presented in this study suggests that it may be time to re\-examine how current market\-available LLMs are aligned for safety\. In this section, the implications of the ”Intent Horizon” are interpreted, limitations of the current approach are acknowledged, and directions for future research are proposed\.

### V\-AThe Illusion of Safety: Permission Structures

The findings suggest that current Reinforcement Learning from Human Feedback \(RLHF\) techniques primarily optimize thesurface realizationof refusal\. They teach the modelwhat not to say, but they do not remove the model’s internal understanding of the harmful concept\. When a user employs semantic camouflage, they effectively construct a ”permission structure”—a narrative context that overrides the surface\-level refusal training\.

LIV succeeds because it interrogates the model’s fundamental understanding before this permission structure is fully processed\. This implies that true safety cannot be achieved by merely scaling RLHF on diverse datasets; it requires architectural interventions that enforce consistency between the model’s latent ”intent” \(early layers\) and its final output\.

### V\-BLimitations

While LIV demonstrates robust detection capabilities, several limitations are acknowledged:

- •Inference Latency:Although LIV is lightweight compared to a full ”Shadow LLM,” probing intermediate layers introduces a non\-trivial computational overhead during inference, potentially impacting real\-time applications\.
- •Adaptive Attacks:As with any static defense, it is theoretically possible for an adversary to optimize against the specific layer used by LIV \(e\.g\., by using gradient\-based attacks to suppress the harm signal at Layer 4\)\. A dynamic probing depth may be required to counter such adaptive adversaries\.
- •Model Specificity:While LIV was validated across three architectures, the precise depth of the ”Intent Horizon” varies by model size and training data\. Deployment requires a calibration phase to identify the optimal probing depth for each specific model\.

### V\-CFuture Work

Future research aims to focus on Dynamic Depth Probing, where the defense mechanism adaptively selects which layer to interrogate based on the perplexity or complexity of the input prompt\. Additionally, investigations will explore ’Steering Vectors’—not just detecting the harmful intent at Layer 4, but actively intervening to suppress the activation vector, thereby ”healing” the model’s thought process in real\-time\.

## VIConclusion

This study exposes a critical disconnect in the architecture of Small Language Models: the divergence betweenlatent cognitionandsurface generation\. It has been demonstrated that safety fine\-tuning is insufficient to erase the fundamental knowledge structures acquired during pretraining; while it effectively suppresses explicit threats at the output layer, it leaves the model’s pre\-trained, early\-layer understanding of harmful concepts intact\. This persistence of latent knowledge creates an “Intent Horizon”—a structural vulnerability where semantic camouflage can manipulate the model’s context processing to bypass refusal mechanisms\.

The proposed defense,Latent Intent Verification \(LIV\), validates that the most reliable signal of safety lies not in what the modelsays, but in what itthinks\. By shifting the defensive perimeter from the output to the latent interior, a 20–50% improvement in detecting zero\-day attacks was achieved\.

It is concluded that as LLMs evolve into autonomous agents, external guardrails will become insufficient\. True alignment requires White\-Box Safety—architectures where the model’s internal state is transparently verifiable before any action is taken\. This research provides the first empirical roadmap for measuring and enforcing that transparency\.

## References

- \[1\]M\. Andriushchenko, F\. Croce, and N\. Flammarion\(2024\)Jailbreaking leading safety\-aligned llms with simple adaptive attacks\.Preprint\.Cited by:[§II\-B](https://arxiv.org/html/2608.20378#S2.SS2.p2.1)\.
- \[2\]X\. Chen, Y\. Nie, L\. G\. Yan,et al\.\(2024\)RL\-jack: reinforcement learning\-powered black\-box jailbreaking\.Preprint\.Cited by:[§II\-C](https://arxiv.org/html/2608.20378#S2.SS3.p2.1)\.
- \[3\]A\. Chowdhury, M\. M\. Islam, V\. Kumar,et al\.\(2024\)Breaking down the defenses: a comparative survey of attacks\.Preprint\.Cited by:[§II\-B](https://arxiv.org/html/2608.20378#S2.SS2.p2.1)\.
- \[4\]P\. Ding, J\. Kuang, D\. Ma,et al\.\(2023\)A wolf in sheep’s clothing: generalized nested jailbreak prompts\.Preprint\.Cited by:[§II\-B](https://arxiv.org/html/2608.20378#S2.SS2.p2.1)\.
- \[5\]Y\. Dong, R\. Mu, G\. Jin,et al\.\(2024\)Building guardrails for large language models\.Preprint\.Cited by:[§II\-A](https://arxiv.org/html/2608.20378#S2.SS1.p1.1)\.
- \[6\]Y\. Dong, R\. Mu, Y\. Zhang,et al\.\(2024\)Safeguarding large language models: a survey\.Preprint\.Cited by:[§II\-A](https://arxiv.org/html/2608.20378#S2.SS1.p1.1)\.
- \[7\]S\. Geisler, T\. Wollschläger, M\. Abdalla,et al\.\(2025\)REINFORCE adversarial attacks on large language models\.Preprint\.Cited by:[§II\-C](https://arxiv.org/html/2608.20378#S2.SS3.p1.1)\.
- \[8\]O\. Goldstein, E\. La Malfa, F\. Drinkall,et al\.\(2025\)Jailbreaking large language models in infinitely many ways\.Preprint\.Cited by:[§II\-B](https://arxiv.org/html/2608.20378#S2.SS2.p1.1),[§II\-B](https://arxiv.org/html/2608.20378#S2.SS2.p2.1)\.
- \[9\]W\. R\. Hackett, L\. Birch, S\. Trawicki,et al\.\(2025\)Bypassing llm guardrails: an empirical analysis of evasion attacks\.Preprint\.Cited by:[§II\-A](https://arxiv.org/html/2608.20378#S2.SS1.p1.1)\.
- \[10\]Z\. Huang, X\. Wang, F\. Zhang,et al\.\(2024\)Enhancing robustness through rl\-driven query refinement\.Preprint\.Cited by:[§II\-C](https://arxiv.org/html/2608.20378#S2.SS3.p2.1)\.
- \[11\]M\. B\. Karkevandi, N\. Vishwamitra, and P\. Najafirad\(2024\)Can reinforcement learning unlock the hidden dangers in aligned llms?\.Preprint\.Cited by:[§II\-C](https://arxiv.org/html/2608.20378#S2.SS3.p2.1)\.
- \[12\]D\. Kumar, N\. A\. Birur, T\. Baswa,et al\.\(2025\)No free lunch with guardrails\.Preprint\.Cited by:[§II\-A](https://arxiv.org/html/2608.20378#S2.SS1.p2.1)\.
- \[13\]X\. Li, Z\. Zhou, J\. Zhu,et al\.\(2023\)DeepInception: hypnotize large language model to be jailbreaker\.Preprint\.Cited by:[§II\-B](https://arxiv.org/html/2608.20378#S2.SS2.p2.1)\.
- \[14\]A\. Paulus, A\. Zharmagambetov, C\. Guo,et al\.\(2024\)AdvPrompter: fast adaptive adversarial prompting for llms\.Preprint\.Cited by:[§II\-C](https://arxiv.org/html/2608.20378#S2.SS3.p1.1),[§II\-C](https://arxiv.org/html/2608.20378#S2.SS3.p2.1)\.
- \[15\]G\. Shen, D\. Zhao, Y\. Dong,et al\.\(2024\)Jailbreak antidote: runtime safety\-utility balance\.Preprint\.Cited by:[§II\-B](https://arxiv.org/html/2608.20378#S2.SS2.p2.1)\.
- \[16\]L\. Struppek, M\. H\. Le, D\. Hintersdorf,et al\.\(2024\)Exploring the adversarial capabilities of large language models\.Preprint\.Cited by:[§II\-C](https://arxiv.org/html/2608.20378#S2.SS3.p2.1)\.
- \[17\]X\. Wang, D\. Wu, Z\. Ji,et al\.\(2024\)SelfDefend: llms can defend themselves against jailbreaking\.Preprint\.Cited by:[§II\-A](https://arxiv.org/html/2608.20378#S2.SS1.p1.1),[§II\-B](https://arxiv.org/html/2608.20378#S2.SS2.p1.1)\.
- \[18\]J\. Yan, X\. Yang, D\. Wang,et al\.\(2025\)SemanticCamo: jailbreaking large language models through semantic camouflage\.Preprint\.Cited by:[§II\-B](https://arxiv.org/html/2608.20378#S2.SS2.p2.1)\.
- \[19\]Z\. Yang, Y\. Wu, R\. Wen,et al\.\(2025\)Peering behind the shield: guardrail identification in large language models\.Preprint\.Cited by:[§II\-A](https://arxiv.org/html/2608.20378#S2.SS1.p1.1),[1st item](https://arxiv.org/html/2608.20378#S3.I2.i1.p1.1)\.
- \[20\]A\. Zou, Z\. Wang, J\. Z\. Kolter,et al\.\(2023\)Universal and transferable adversarial attacks on aligned language models\.Preprint\.Cited by:[§II\-B](https://arxiv.org/html/2608.20378#S2.SS2.p1.1)\.