Latent Undertow: How Ordinary Typos Break Probes
Elad David, Max Fomin and Amit LeVi (Zenity) show that ordinary typos, which leave model behavior unchanged, rotate hidden states enough to break activation probes for prompt injection.
Ask this paper
Geometry: A single edit rotates the readout vector by 43 to 56 degrees at the perturbed token, decaying below 15% within about 10 tokens; the pattern replicates on Llama-3.1-8B, Qwen3-8B and Gemma-4-E4B.
Probe damage: Stacking about three common typos per message cuts a single-position injection probe's TPR at 1% FPR by 12.0 points, and recalibration alone does not recover it.
Aggregation: Multi-position probes handle localized typos but still lose about 3.8 points on distributed ones.
KV-cache fork: Appending a short fixed suffix lets the probe read downstream of the perturbation, closing most of the gap and doing an order of magnitude better than augmentation training.
Abstract
LLMs handle ordinary typing variation fluently: a typo or missing punctuation leaves both user intent and the model's response substantively unchanged. Yet probes that detect malicious prompts by reading the model's hidden states tell a different story: the same edit rotates the readout vector by 43--56 at the perturbed token, decaying below 15% within ~10 downstream tokens. Stacking ~3 common typos per message cuts a single-position prompt-injection probe's TPR@FPR$=1% by 12.0pp, a gap recalibration alone cannot close. Multi-position aggregation cures localized perturbations (<= 0.5 loss) but only attenuates distributed ones, where even attention- and max-based aggregators still drop ~3.8pp. For single-position probes, we introduce a KV-cache fork: a short fixed suffix appended after the user message lets the probe read a few tokens downstream of the perturbation, exploiting its rapid spatial decay. This closes 95% of the gap (-0.6pp residual) -- an order of magnitude better than perturbation-augmented training (-3.7pp). The rotation-and-decay geometry replicates on Llama-3.1-8B, Qwen3-8B, and Gemma-4-E4B; probe evaluation is on Llama-3.1-8B. Code: https://github.com/eladd-ai/latent-undertow