Preserving Semantic Integrity: Who May Covertly Redefine an LLM's Task?

Traditional prompt injection attacks add, replace, or override instructions that compete with what a language model is authorized to do. This paper studies a different problem, which we call semantic reanchoring. The authorized instruction remains literally unchanged, while untrusted examples or records change what parts of it are taken to mean. A pattern such as OFF -> ON can cause "turn OFF the stove when no one is home" to be interpreted and executed as turning it ON. Likewise, examples can reanchor "-" from subtraction to addition, turning a 100 - 10 discount into 110. Across about forty-one thousand generations and verification calls spanning eight LLMs, we show that preserving literal or instruction integrity does not guarantee semantic integrity: a model can coherently execute an unauthorized interpretation of an unchanged instruction. We make authority explicit by testing both cases in which contextual reinterpretation is forbidden and cases in which the owner authorizes it, separating unauthorized reinterpretation from legitimate adaptation and rigidity. Reasoning mode and owner wording can move behavior in opposite directions across configurations, and an interpretation can later be restored toward its prior meaning, complicating retrospective detection. Crucially, semantic verification is feasible on the two tested one-token task families when the authority structure and complete owner-authorized reference are supplied. Two LLM auditors detect nearly all observed violations in same-context mode with low false rejection; hiding contextual material from the auditor becomes harmful when the owner delegated meaning to that material.