mlsanityData to 14 Oct 2026

Latent Undertow: How Ordinary Typos Break Probes

arXiv 2609.15994 ↗First posted 8 Jul 2026cs.CL cs.LGcited by 2

Not on the map. Why?

Abstract (arXiv)

LLMs handle ordinary typing variation fluently: a typo or missing punctuation leaves both user intent and the model's response substantively unchanged. Yet probes that detect malicious prompts by reading the model's hidden states tell a different story: the same edit rotates the readout vector by 43--56 at the perturbed token, decaying below 15% within ~10 downstream tokens. Stacking ~3 common typos per message cuts a single-position prompt-injection probe's TPR@FPR=1% by 12.0pp, a gap recalibration alone cannot close. Multi-position aggregation cures localized perturbations (<= 0.5 loss) but only attenuates distributed ones, where even attention- and max-based aggregators still drop ~3.8pp. For single-position probes, we introduce a KV-cache fork: a short fixed suffix appended after the user message lets the probe read a few tokens downstream of the perturbation, exploiting its rapid spatial decay. This closes 95% of the gap (-0.6pp residual) -- an order of magnitude better than perturbation-augmented training (-3.7pp). The rotation-and-decay geometry replicates on Llama-3.1-8B, Qwen3-8B, and Gemma-4-E4B; probe evaluation is on Llama-3.1-8B. Code: https://github.com/eladd-ai/latent-undertow

Key facts. Cited by 2 papers in the map (data through 14 Oct 2026). Builds on 21 of its 26 references that are in the map. First posted on arXiv 8 Jul 2026.

Builds on

21 of 26 references.

References · 21

  1. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  2. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  3. 2016Understanding intermediate layers using linear classifier probescited by 1,353
  4. 2023Quantifying Language Models' Sensitivity to Spurious Features in Prompt Design or: How I learned to start worrying about prompt formattingcited by 817
  5. 2023The Geometry of Truth: Emergent Linear Structure in Large Language Model Representations of True/False Datasetscited by 712
  6. 2023The Internal State of an LLM Knows When It's Lyingcited by 659
  7. 2023State of What Art? A Call for Multi-Prompt LLM Evaluationcited by 310
  8. 2023Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Modelscited by 264
  9. 2024WildTeaming at Scale: From In-the-Wild Jailbreaks to (Adversarially) Safer Language Modelscited by 223
  10. 2024The Butterfly Effect of Altering Prompts: How Small Changes and Jailbreaks Affect Large Language Model Performancecited by 100
  11. 2024Get my drift? Catching LLM Task Drift with Activation Deltascited by 72
  12. 2026Building Production-Ready Probes For Geminicited by 47
9 more
  1. 2024Reasoning Robustness of LLMs to Adversarial Typographical Errorscited by 31
  2. 2024Resilience of Large Language Models for Noisy Instructionscited by 20
  3. 2025PIShield: Detecting Prompt Injection Attacks via Intrinsic LLM Featurescited by 20
  4. 2026When Benchmarks Lie: Evaluating Malicious Prompt Classifiers Under True Distribution Shiftcited by 11
  5. 2025Evaluating Robustness of Large Language Models Against Multilingual Typographical Errorscited by 9
  6. 2025Exploring Robustness of Multilingual LLMs on Real-World Noisy Datacited by 6
  7. 2025Probing the Robustness of Large Language Models Safety to Latent Perturbationscited by 4
  8. 2025MaxPoolBERT: Enhancing BERT Classification via Layer- and Token-Wise Aggregationcited by 2
  9. 2026Accelerating Suffix Jailbreak attacks with Prefix-Shared KV-cachecited by 1

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 2.

2 papers.

  1. 2026Safety Monitors Mostly Catch What the Model Already Refusescited by 0
  2. 2026Prompted to Discriminate: Generalizing Malicious-Input Probes in the Wildcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Probe before You Talk: Towards Black-box Defense against Backdoor Unalignment for Large Language Models
  2. 2025Robustness via Referencing: Defending against Prompt Injection Attacks by Referencing the Executed Instruction
  3. 2026The Calls are Coming from Inside the Model: Investigating Probe-based Detection of Tool-Calling Errors in LLMs
  4. 2024PROMPTFUZZ: Harnessing Fuzzing Techniques for Robust Testing of Prompt Injection in LLMs
  5. 2026Breaking Safety at the Token Boundary: How BPE Tokenization Creates Exploitable Gaps in LLM Alignment
  6. 2024The Dark Side of Human Feedback: Poisoning Large Language Models via User Inputs
  7. 2026CounterSteer: Suppressing Indirect Prompt Injection with Activation Steering
  8. 2026Bypassing Prompt Injection Detectors through Evasive Injections