CORVUS: Red-Teaming Hallucination Detectors via Internal Signal Camouflage in Large Language Models

TL;DR

This paper introduces CORVUS, a method for adversarially camouflaging hallucination detectors in large language models by fine-tuning lightweight adapters, revealing vulnerabilities in existing detection techniques.

Contribution

We propose CORVUS, a novel adversarial red-teaming approach that effectively camouflages hallucination signals in language models, demonstrating significant degradation of multiple detectors across various models.

Findings

CORVUS successfully transfers across multiple LLMs and datasets.

It significantly reduces the effectiveness of existing hallucination detectors.

Adversary-aware auditing becomes necessary to counteract such camouflage techniques.

Abstract

Single-pass hallucination detectors rely on internal telemetry (e.g., uncertainty, hidden-state geometry, and attention) of large language models, implicitly assuming hallucinations leave separable traces in these signals. We study a white-box, model-side adversary that fine-tunes lightweight LoRA adapters on the model while keeping the detector fixed, and introduce CORVUS, an efficient red-teaming procedure that learns to camouflage detector-visible telemetry under teacher forcing, including an embedding-space FGSM attention stress test. Trained on 1,000 out-of-distribution Alpaca instructions (<0.5% trainable parameters), CORVUS transfers to FAVA-Annotation across Llama-2, Vicuna, Llama-3, and Qwen2.5, and degrades both training-free detectors (e.g., LLM-Check) and probe-based detectors (e.g., SEP, ICR-probe), motivating adversary-aware auditing that incorporates external grounding or cross-model evidence.