Hiding in Plain Text: Detecting Concealed Jailbreaks via Activation Disentanglement

2026-02-22

AI Summary

This work addresses the vulnerability of large language models to jailbreak attacks that are semantically fluent yet conceal malicious intent, which evade conventional detection methods due to their adaptive camouflage. To tackle this challenge, we introduce semantic disentanglement into jailbreak detection for the first time and propose ReDAct, a self-supervised framework that disentangles goal-related and phrasing-related factors in model activations during inference. Building upon the disentangled phrasing representations, we develop FrameShield—a lightweight, model-agnostic anomaly detector. To support this approach, we construct GoalFrameBench, a controllable prompt dataset. Experiments demonstrate that FrameShield significantly improves detection of stealthy jailbreaks across multiple large language model families with minimal computational overhead. Both theoretical analysis and empirical results validate the effectiveness and interpretability of the disentangled representations.

Technology Category

• Natural Language Processing: Safety and Robustness
• Machine Learning: Large Multimodal Models (LMMs)
• Computer Vision: Adversarial Attacks & Robustness

Application Category

• Search and Retrieval-Augmented AI: Large language models for search
• Semantics and Knowledge: Data modeling to support human-machine intelligence, including LLMs agents, intelligent system behavior, explanations, and user-friendly interactions
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems

Abstract

Large language models (LLMs) remain vulnerable to jailbreak prompts that are fluent and semantically coherent, and therefore difficult to detect with standard heuristics. A particularly challenging failure mode occurs when an attacker tries to hide the malicious goal of their request by manipulating its framing to induce compliance. Because these attacks maintain malicious intent through a flexible presentation, defenses that rely on structural artifacts or goal-specific signatures can fail. Motivated by this, we introduce a self-supervised framework for disentangling semantic factor pairs in LLM activations at inference. We instantiate the framework for goal and framing and construct GoalFrameBench, a corpus of prompts with controlled goal and framing variations, which we use to train Representation Disentanglement on Activations (ReDAct) module to extract disentangled representations in a frozen LLM. We then propose FrameShield, an anomaly detector operating on the framing representations, which improves model-agnostic detection across multiple LLM families with minimal computational overhead. Theoretical guarantees for ReDAct and extensive empirical validations show that its disentanglement effectively powers FrameShield. Finally, we use disentanglement as an interpretability probe, revealing distinct profiles for goal and framing signals and positioning semantic disentanglement as a building block for both LLM safety and mechanistic interpretability.

Problem

• jailbreak detection
• semantic disentanglement
• LLM safety
• malicious intent concealment
• framing manipulation

Innovation

• activation disentanglement
• jailbreak detection
• self-supervised learning
• model interpretability
• anomaly detection