This is immediately useful. The method is simple (one forward pass, one dot product), requires no generation, and works across model families. For builders using small LLMs (1-8B), this is a better hallucination detector than existing approaches. You can train it on fifty examples and get strong AUROC on factual tasks. For inference, the overhead is negligible. Test this on your domain and consider swapping it in for probability-based baselines. The directions are interpretable too—correctness is a learnable signal.
This is a real gap in deployed agent safety. Steganographic attacks on memory are novel and credible, and the fact that one in five succeed at extracting secrets without triggering oversight is worth taking seriously. If you're building multi-turn agents with persistent memory, you need memory auditing that catches encoded payloads, not just content filtering on visible text. This is the kind of threat model that becomes standard after the first real incident.
This is the core problem deployed agents face in regulated domains. Models collapse on regulatory text even though they agree on obvious cases, and they err consistently in the same direction on deployed systems, so picking one as the conservative choice doesn't work. If you're building agents in finance, healthcare, or law, this says you cannot rely on the model to route decisions correctly. You need a hard audit layer, not a soft one.