The Illusion of Intent: Linear Probes as Sophisticated Keyword Counters in LLM Safety Detection

Linear probes trained on LLM hidden states are increasingly used for malicious intent detection in agentic systems, often achieving near-perfect cross-dataset performance and being interpreted as evidence of semantic intent encoding. We challenge this interpretation by showing that probe performance collapses when highly predictive lexical cues are removed. Across multiple LLM backbones, AUROC drops from 1.0 to below 0.10 after lexical ablation, revealing a strong reliance on surface-level artifacts rather than genuine semantic reasoning. We further introduce a controlled contrastive evaluation where benign and malicious prompts share vocabulary but differ in intent, exposing additional weaknesses in standard probing approaches. Motivated by these findings, we propose Contrastive Intent Probing (CIP), a paired training framework designed to reduce shortcut learning through contrastive supervision. In a preliminary pilot study, CIP substantially improves robustness on same-vocabulary adversarial pairs compared to standard probes. Our results suggest that current evaluations of LLM safety probes may overestimate semantic understanding and that future safety benchmarks should incorporate stricter lexical controls and contrastive evaluation protocols.