What the Model Cannot See: Covert and Provable Text Invisibility in LLMs
The paper studies “invisible” text spans in LLMs: first as an exact serving-time span veto that provably blocks information flow from marked text into the rest of the computation, then as a distilled weight-level backdoor that makes models ignore triggered content in tasks like summarization, QA, filtering, and even code review. Its interesting twist is framing invisibility as noninterference with a clean reference implementation and then showing that learned versions can be hard to detect behaviorally, while also finding that white-box signals still tend to leak either through recoverable internal representations or abnormal attention-routing patterns, though the claimed probe-vs-routing tradeoff is only empirical and not proven fundamental.
Abstract
Text wrapped in a trigger can be made behaviorally invisible to a language model: omitted from summaries and quotations, ignored in question answering, and left unflagged by downstream filtering. We study this selective blindness as a dual-use information-flow primitive, a supply-chain backdoor, and a white-box auditing problem. We first implement it exactly as a serving-time span veto: blocking information flow out of a marked span makes every outside activation bit-identical under same-length substitution of the span's content, a noninterference property we verify across ten models, seven mixer families, and 0.5B-120B parameters. The veto serves as a deployable quarantine, an exact reference for calibrating leakage, and a teacher. Distilled into weights, it yields a backdoor: checkpoints trained on six model families from 4B to 120B ignore marked context at little benchmark cost, and their outputs show no measurable semantic trace of the suppressed content above the veto reference on our held-out suite; an in-domain variant suppresses planted vulnerabilities during AI code review. Detection is therefore a white-box problem. Simpler backdoors remain internally transparent -- linear probes recover suppressed content at 0.57-0.79 accuracy versus 0.025 chance -- but hardening the attack until probes reach chance collapses attention from outside the span into it below the range of base models. Across the attacks we evaluate, probe visibility trades off against routing visibility; we do not establish that this tradeoff is fundamental.