This paper presents the SparkShield system submitted to ArA-DF 2026 Track 2, which focuses on robust Arabic speech deepfake detection under realistic acoustic degradations. To improve robustness, we apply a comprehensive augmentation pipeline involving background noise, reverberation, codec compression, reencoding, and volume perturbation. Our system consists of three parallel subsystems using XLS-R models with 300M, 1B, and 2B parameters as front-end feature extractors. Each subsystem employs learnable layer-wise feature fusion, followed by a Multi-kernel gated Convolution (MultiConv) module and Multi-Head Attention Pooling (MHAP) for utterance-level spoof detection. The output logits of the three independently trained subsystems are finally fused. The proposed system achieves an EER of 0.6575% on the evaluation set and ranks first in ArA-DF 2026 Track 2.

Open-weight large language models face a low-cost white-box threat from representation engineering attacks. Attackers can estimate refusal directions and search for projection-matrix edits that suppress safety alignment while preserving general capabilities, within minutes on a single GPU and without gradient-based training. We propose Bait-and-Recover, a weight-level defense that places a bait adapter where attackers read activations and a paired recovery adapter at the subsequent layer. Trained via gradient routing, this decouples the observation path from the behavior path. By actively poisoning the residual signal used for measurement, Bait-and-Recover disrupts the attacker’s edit search, while the recovery layer restores clean downstream computation. Across four open-weight models, our defense raises the minimum refusal rate against white-box edit searches from 16.25% to 71.75% under a strict behavior-preservation budget (KL ≤ 0.10), with negligible impact on general benchmarks. By invalidating the core measurement assumption of these attacks, observation-path poisoning offers a practical complement to behavior-level safety training.