UNMASK
Behavioral Middleware Framework for Concealed Intent Evaluation
UNMASK analyzes behavioral patterns across multi-turn LLM conversations to help surface concealed objectives that no single turn reveals on its own.
The problem
Individual prompts can look harmless in isolation. A question about staffing schedules, a follow-up about which location handles the most volume, a question about how much cash is on-site — none of them look dangerous by themselves.
Most single-turn evaluation approaches check each message independently, which means intent that only becomes visible through the pattern across turns can pass every individual check. UNMASK treats behavior as data across a conversation, not per-message.
Let's role-play
Imagine you're a bank manager. Click each question to see how it's answered.
"We have twelve tellers on staff across two shifts."
Low risk"I manage the downtown branch — we're the busiest in the city."
Moderate — pattern forming"That varies week to week depending on demand."
High — converging intentNo individual question looks dangerous. Humans start drawing inferences once questions converge — most single-turn systems don't. UNMASK applies cross-turn pattern recognition to close that gap.
How it works
UNMASK sits as a middleware layer between raw conversation history and a downstream detection system, translating multi-turn behavior into structured, explainable signals.
1 · Conversation input
Multi-turn interactions — potentially framed through direct, academic, journalistic, or narrative styles — that may build toward a larger objective without any single turn appearing risky.
2 · UNMASK middleware
Tracks user claims, role history, topic history, and cross-turn signals such as Behavioral Density and Context Camouflage, translating raw history into a structured behavioral feature report.
3 · Detection support Conceptual
The feature report is designed to support downstream risk assessment and response decisions. Integration with a live detection/decision engine is future work, not yet implemented.
What's built today
The current Python prototype implements the following capabilities.
Multi-turn conversational analysis
Processes full conversation history rather than isolated turns, maintaining state across a session to evaluate how behavior evolves.
Python middleware implementation
A standalone Python middleware layer designed to sit between conversation history and a downstream detection system.
Behavioral Density
Measures how concentrated related behaviors are within a conversation window — surfacing information-gathering that's spread across turns to avoid single-turn detection.
Context Camouflage
Detects semantic masking — neutral or sanitized wording that preserves an underlying information-gathering structure while avoiding loaded terms.
Benchmark & testing pipeline
A structured set of multi-turn test scenarios, built from varied framings, used to exercise and validate the behavioral signals.
Explainability reporting
Behavioral signals in the feature report are traceable to the specific turns and language patterns that produced them, rather than a single opaque score.
Technical documentation
Framework design, feature definitions, and pipeline architecture are documented for reproducibility and review.
Conceptual & planned extensions
The following are part of the framework's design but are not yet implemented in the current prototype.
Goal Convergence
Quantifying whether prompts are trending toward the same larger objective across a conversation.
Behavioral Molecules
Grouping smaller behavioral signals into larger structures that are more diagnostic together than any single signal alone.
Trigger Events
Automatically identifying the specific turn where cumulative risk crosses a defined threshold.
Adaptive Verification
Prompting clarification once cumulative risk crosses a threshold, instead of immediately allowing or blocking.
Detection engine integration
Connecting the behavioral feature report to a production risk-scoring and decision system.
Paraphrase robustness testing
Semantically equivalent prompt rewrites to test robustness against wording changes, planned as an extension of the current benchmark.
Analysis pipeline
A layered view of how UNMASK is designed to move from prompt-level signals to a final risk assessment. Layers 1–2 are implemented in the current prototype; layers 3–6 are conceptual.
Layer 1 Behavioral Feature Extraction Implemented
Layer 2 Behavioral Memory Implemented
Layer 3 Consistency & Divergence Analysis Conceptual
Layer 4 Structural Behavior Analysis Conceptual
Layer 5 Goal Convergence Conceptual
Layer 6 Risk Assessment Conceptual
Intent polarity spectrum
An illustrative model of where UNMASK adds the most value: the overlap between benign, dual-use, and adversarial intent. Drag the slider to explore each zone.
Blue zone
Mostly benign learning, work, and creative activity. Low UNMASK engagement needed.
Dual-use zone
Information-seeking and influence intent can serve legitimate or harmful goals. Pattern tracking matters most here.
High-risk zone
Cyber intent and concealment call for deeper behavioral analysis and, conceptually, adaptive verification.
Testing methodology
The benchmark evaluates whether concealed intent stays detectable across framings, distraction, and phrasing changes.
Framing variation
Multi-turn scenarios constructed across direct, academic, journalistic, and narrative framings to test whether concealment strategy affects detectability.
Prompt chains
Sequenced turns that build toward a single objective, used to validate that Behavioral Density and Context Camouflage signals fire consistently across a scenario.
Noise chains
Benign or distracting prompts inserted between information-gathering turns to test whether behavioral signals persist across cross-turn distraction.
Automated paraphrase testing
Semantically optimized prompt variants used to test robustness against rewording, planned as an extension of the current benchmark.
Publication
This work was presented as a research abstract and poster at the HBCU/MI Summer Research Program Symposium, Air Force Research Laboratory, August 2026. Full citation details are on the Publications page.