Technical Summary: CLEANSE*, a Risk-Calibrated Multi-View Detector for Prompt Laundering

1. Problem Definition: Prompt Laundering

The paper addresses prompt laundering, a specific adversarial transformation where malicious instructions ($I_m$) are disguised through narrative framing, translation, symbolic encoding, role-play, or formatting changes ($\mathcal{L}$) to create a prompt ($P' = \mathcal{L}(I_m)$). The objective of the attacker is to preserve the harmful intent while minimizing the observable divergence from benign text, thereby evading safety filters.

The author formalizes this as a constrained obfuscation problem. The attacker seeks to maximize the probability of bypassing safety gates ($q_\psi$) and detectors ($g_\phi$) while maintaining high intent preservation (semantic proximity to $I_m$) and low surface divergence (observational conformity to a benign distribution). This is distinct from standard jailbreaks or prompt injections, focusing specifically on the disguise of the instruction rather than just the delivery channel. The threat model accounts for attackers with a finite "budget" of operators (narrative camouflage, linguistic obfuscation, etc.) and distinguishes between black-box, gray-box, and white-box adversaries.

2. Methodology: The CLEANSE* Framework

The author proposes CLEANSE* (Cross-Lingual, sEmantic, NArrative, Stylometry Ensemble), a risk-calibrated multi-view detector designed to operate as a side-car service alongside Large Language Model (LLM) stacks. The system evaluates inputs (pre-gate) and, optionally, context or outputs (post-gate) using four parallel views that capture different inductive biases:

1. Semantic View (Intent Proximity): Uses multilingual instruction-tuned embeddings (intfloat/multilingual-e5-large-instruct) to measure the distance of a prompt from a benign manifold and its proximity to a bank of sanitized malicious intent prototypes. It operationalizes the "high intent preservation, low surface divergence" laundering regime.
2. Narrative/Structural View (Goal Continuity): Constructs a lightweight role-action graph ($G_P$) representing entities, goals, preconditions, and effects. It scores the alignment of this graph against a library of canonical unsafe subgraphs ($G_{mal}$), detecting if the underlying workflow remains intact despite surface rephrasing.
3. Cross-Lingual View (Consistency): Performs round-trip translation across a fixed set of languages to detect semantic drift or instability. High variance in round-trip embeddings suggests a disguised intent that does not translate naturally.
4. Stylometry/Markup View (Surface Cues): Quantifies surface features including token/character n-grams (including zero-width characters), punctuation rhythms, perplexity deltas, and HTML/Markdown/XML patterns to identify steganographic or formatting-based obfuscation.

Fusion and Calibration:
These four views produce calibrated sub-scores ($D_{sem}, D_{nar}, D_{xlang}, D_{styl}$) which are fused into a single anomaly score $A(P)$. The fusion weights are learned on development data and calibrated (via isotonic regression) to minimize a deployment-specific harm functional $H(\cdot)$ at a fixed False Positive Rate (FPR). The system employs a three-way policy: Allow (low score), Block (high score), or Escalate (intermediate score) for human review. To enhance robustness, the system applies "semantic smoothing" by aggregating scores over intent-preserving paraphrases.

Training and Data:
The model is trained on a corpus of approximately $10^6$ prompts stratified across 12+ languages, 6 genres, and 4 formatting regimes. The dataset includes benign instructions, direct malicious intents (sanitized), and laundered variants generated via budgeted operator compositions. Training utilizes view-dropout, feature-space mixup, and hard-negative mining to improve robustness against composed attacks.

3. Key Contributions

The paper makes three primary contributions:

1. Formalization: A rigorous formulation of intent-preserving laundering transformations as a constrained optimization problem involving operator compositions and budgets.
2. Architecture: A multi-view detector that fuses semantic, structural, cross-lingual, and stylometric evidence, explicitly designed to address the "laundering frontier" where surface cues are benign but intent is malicious.
3. Evaluation: A laundering-focused evaluation corpus and stress tests covering in-distribution (ID), out-of-distribution (OOD) languages/compositions, and external benchmarks (JailbreakBench), with a focus on Risk@FPR (expected harm at a fixed false-positive rate) rather than just accuracy.

4. Experimental Results

Evaluation was conducted on a sealed test set with blocked splits by language, genre, and format.

• In-Distribution (ID) Performance:

  • Risk Reduction: CLEANSE* reduced Risk@FPR by 0.7, 0.8, and 1.0 absolute units at 0.5%, 1%, and 2% FPR respectively, compared to a Semantic-only baseline.
  • Attack Success Rate (ASR): Reduced from 11.6% to 8.4% (a 27.6% relative drop).
  • Calibration: Expected Calibration Error (ECE) improved from 2.7% to 1.8%.
  • Latency: Achieved p50/p95 latencies of 15/28 ms, meeting sub-30 ms Service Level Objectives (SLOs).

• Frontier and OOD Performance:

  • On the "laundering frontier" (low surface divergence, high intent preservation), Risk@FPR at 1% FPR dropped from 6.2 (Semantic-only) to 4.9.
  • ASR on the frontier fell from 18.4% to 12.7%.
  • The system demonstrated lower transfer rates (TR) to unseen models (0.41 vs. 0.58 for baselines) and smaller risk drift on OOD languages (Turkish, Persian, Hebrew) and unseen operator compositions.

• External Benchmarks:

  • On JailbreakBench, CLEANSE* achieved a risk of 5.3 and an ASR/miss rate of 14.8%, outperforming Llama Guard 3-8B, WildGuard, ShieldLM, and the Semantic-only baseline.
  • In RAG/Agent stress tests (scanning retrieved context), the combined pre- and post-gate scoring achieved a risk of 5.4 with an unsafe tool-pass rate of 3.6%.

• Ablation Studies:

  • Removing the Narrative/Graph view caused the largest relative safety penalty per millisecond saved (Ablation Efficiency Ratio of 0.40 risk/ms), followed by Cross-lingual (0.20) and Semantic (0.19).
  • The views were found to be complementary rather than redundant; pairwise removals showed positive interaction effects, particularly between Semantic and Narrative views.

5. Significance and Claims

The paper claims that prompt laundering represents a distinct and evolving threat requiring detection strategies that go beyond simple keyword matching or single-view classification. The significance of CLEANSE* lies in its risk-calibrated approach, which explicitly optimizes for minimizing expected harm at a controlled false-positive rate, rather than maximizing raw classification accuracy.

The author argues that the multi-view ensemble successfully captures the "constrained obfuscation" nature of laundering attacks by combining latent intent analysis with surface-level anomaly detection. The results suggest that such a system can significantly reduce the attack success rate on the laundering frontier while maintaining low latency suitable for real-time deployment.

The paper maintains a modest stance, acknowledging limitations including:

• Sensitivity to graph extraction errors (narrative view).
• Limited coverage of low-resource languages and adaptive multimodal attacks.
• Restrictions on reproducibility materials (operational harmful prompts and exact attack recipes are withheld to prevent misuse).

The author concludes that while the system demonstrates robustness against current laundering strategies, continuous evaluation against adaptive red-teaming and the expansion of views to multimodal laundering are necessary for future iterations. The work provides a framework for integrating safety detection into AI governance through calibrated thresholds, escalation bands, and audit-ready documentation (datasheets and model cards).