A new study titled "Latent Undertow: How Ordinary Typos Break Probes" investigates how standard typing errors affect Large Language Model (LLM) safety mechanisms. While LLMs handle typos fluently without changing user intent, these edits significantly alter the model's hidden states used for malicious prompt detection.
Vector Rotation and Decay
At the perturbed token, a typo rotates the readout vector by 43 to 56 degrees. This effect decays rapidly, dropping below 15% within approximately 10 downstream tokens. Stacking roughly three common typos per message reduces a single-position prompt-injection probe's true positive rate at one false positive rate by 12.0 percentage points.
Probe Evaluation Results
The research evaluated probes on Llama-3.1-8B, Qwen3-8B, and Gemma-4-E4B models. Localized perturbations with loss values less than or equal to 0.5 can be cured by multi-position aggregation. However, distributed perturbations remain difficult; even attention- and max-based aggregators still drop performance by approximately 3.8 percentage points.
Mitigation Strategies
For single-position probes, the authors introduce a KV-cache fork technique. This involves appending a short fixed suffix after the user message to allow the probe to read tokens downstream of the perturbation. This method closes 95% of the performance gap, leaving only a -0.6pp residual loss. It is an order of magnitude better than perturbation-augmented training, which achieves only -3.7pp.
Source: https://arxiv.org/abs/2609.15994
