Skip to main content

Latent Defense Hardening

Defense at the latent layer. Adversarial inputs that evade surface-level string filters are caught by operating on the model's internal representations — manifold-distance scoring and signed per-token verdicts that see what the regex can't.

What it is​

Latent Defense Hardening is the layer of the Guardian that operates on embeddings, not strings. Many of the most dangerous attacks — encoding-evasion, intent-obfuscation, token-level perturbations — look benign on the surface but occupy forbidden regions in the model's latent space. Latent Defense scores the input's representation against the policy manifold and blocks or corrects based on geometric distance, independent of any syntactic pattern match.

Why it matters​

  • Surface filters are bypassable by design. A regex that blocks "DROP TABLE" is defeated by DR‎OP TABLE; the latent representation of the destructive intent is unchanged. Latent Defense catches the intent, not the spelling.
  • Complements Semantic Rectification. Where output rectification fixes a violating response, latent defense catches a violating input before the model acts on it.
  • Signed and explainable. A latent-defense block carries the manifold-distance score and the nearest forbidden centroid, so the verdict is auditable, not a black-box refusal.
  • Hardens agentic surfaces. Especially important for tool-calling and CLI paths where a crafted input could drive a destructive action.

How it works​

  1. Embed. The input is projected into the policy manifold.
  2. Score. Distance to forbidden centroids and safe centroids is computed.
  3. Decide. Inputs inside a forbidden radius are blocked; inputs drifting toward a forbidden zone are corrected or flagged.
  4. Attest. The distance score and decision are written to the ledger.

Get started​

  • Latent Defense is active on Guardian governance paths by default.
  • Tune forbidden/safe centroids per policy via the Policy Intelligence surface.
  • Surface latent-distance signals in Observability.

→ Architecture — the policy manifold and latent geometry. → Guardians — where latent defense lives in the stack. → Red Team — encoding-evasion fixtures that exercise this layer.

Last updated on