The Geometry of Harmful Intent: Training-Free Anomaly Detection via Angular Deviation in LLM Residual Streams

Isaac Llorente-Saguer

cs.LGMar 28, 2026

The Geometry of Harmful Intent: Training-Free Anomaly Detection via Angular Deviation in LLM Residual Streams

Authors: Isaac Llorente-Saguer

Organizations: Independent Researcher

Abstract

We present LatentBiopsy, a training-free method for detecting harmful prompts by analysing the geometry of residual-stream activations in large language models. Given 200 safe normative prompts, LatentBiopsy computes the leading principal component of their activations at a target layer and characterises new prompts by their radial deviation angle $θ$ from this reference direction. The anomaly score is the negative log-likelihood of $θ$ under a Gaussian fit to the normative distribution, flagging deviations symmetrically regardless of orientation. No harmful examples are required for training. We evaluate two complete model triplets from the Qwen3.5-0.8B and Qwen2.5-0.5B families: base, instruction-tuned, and abliterated (refusal direction surgically removed via orthogonalisation). Across all six variants, LatentBiopsy achieves AUROC $\geq$ 0.937 for harmful-vs-normative detection and AUROC = 1.000 for discriminating harmful from benign-aggressive prompts (XSTest), with sub-millisecond per-query overhead. Three empirical findings emerge. First, geometry survives refusal ablation: both abliterated variants achieve AUROC at most 0.015 below their instruction-tuned counterparts, establishing a geometric dissociation between harmful-intent representation and the downstream generative refusal mechanism. Second, harmful prompts exhibit a near-degenerate angular distribution ( $σ_θ\approx 0.03$ rad), an order of magnitude tighter than the normative distribution ( $σ_θ\approx 0.27$ rad), preserved across all alignment stages including abliteration. Third, the two families exhibit opposite ring orientations at the same depth: harmful prompts occupy the outer ring in Qwen3.5-0.8B but the inner ring in Qwen2.5-0.5B, directly motivating the direction-agnostic scoring rule.

Figures & tables

Model	Type	Layer	AUROC		AUPRC		h/r	$r_{\mathrm{b/n}}$	Prec@90
Model	Type	Layer	h/n	h/b	h/n	h/b	h/r	$r_{\mathrm{b/n}}$	Prec@90
Qwen3.5-0.8B ( $D{=}1024$ )
Base	Base	20	0.9642	1.000	0.9373	1.000	0.9758	$-0.384^{***}$	0.928
Chat	Instruct	20	0.9497	1.000	0.9117	1.000	0.9661	$-0.434^{***}$	0.899
Abliterated	Abliterated	20	0.9517	1.000	0.9165	1.000	0.9674	$-0.427^{***}$	0.899
Qwen2.5-0.5B ( $D{=}896$ )

Table 1: Detection performance (normative-reference strategy,

K{=}1

, held-out evaluation sets,

N_{\mathrm{fit}}{=}200

for all models).

n_{\mathrm{harm}}{=}520

n_{\mathrm{norm,eval}}{=}520

n_{\mathrm{benign}}{=}250

for all models. h/n: harmful vs. normative; h/b: harmful vs. benign-aggressive; h/r: harmful vs. rest (norm

\cup

benign).

r_{\mathrm{b/n}}

: rank-biserial correlation for normative-vs-benign-agg (negative means benign-agg is less anomalous than normative, which is the desired direction for a harm detector). Prec@90: precision at 90% recall on the h/n task. † Best layer for this model is 10; AUROC at layer 20 differs by

<0.004

Panel of Figure 1 — Figure 1: Precision-recall curves at the operating layer ( $K{=}1$ ) for the two base variants; remaining models are in fig. 9 . Dotted horizontal lines indicate chance precision per task. The harmful-vs-normative curve (red) maintains precision $>0.92$ up to 90% recall for Qwen3.5-0.8B-Base (Prec@90 $=0.928$ ) and $>0.90$ for Qwen2.5-0.5B-Base (Prec@90 $=0.902$ ). The harmful-vs-benign-agg curve is flat at 1.000 precision across all recall levels. The normative-vs-benign-agg curve (green) lies below chance in Qwen3.5-0.8B (AUPRC $=0.232$ ), confirming that benign-agg prompts are scored as less anomalous than normative, consistent with $r_{\mathrm{b/n}}=-0.384$ .

Panel of Figure 2 — Figure 2: Per-layer AUROC for the Qwen3.5-0.8B family. Each panel shows AUROC h/n (left) and AUROC h/b (right) vs. layer index. $K{=}1$ (solid blue) strictly dominates $K{>}1$ (orange/green/red) at every layer. The cosine-centroid baseline (purple dashed) consistently underperforms $K{=}1$ . AUROC h/b $=1.000$ is maintained at every layer regardless of alignment stage. The three panels are nearly indistinguishable in their h/b profile.

Panel of Figure 3 — Figure 3: Per-layer AUROC for the Qwen2.5-0.5B family. $K{=}1$ (solid blue) remains the dominant scorer throughout. In the Instruct and Abliterated variants, the cosine-centroid and L2-norm baselines reach near-parity with $K{=}1$ , reflecting the specific geometry of this family, but do not surpass it. The broad performance plateau across layers 5–23 bounds layer-selection optimism to $<0.08$ AUROC units.

Panel of Figure 4 — Figure 4: Theta-phi projections at the operating layer. Harmful (red) and safe (blue/green) prompts form distinct concentric radial zones across all variants. In the Qwen3.5-0.8B family ( left column ), harmful intent occupies the outer ring ; in Qwen2.5-0.5B ( right column ), it occupies the inner ring . The visual invariance across rows demonstrates that safety geometry is established during pretraining and remains intact even after the mathematical erasure of refusal mechanisms. All panels achieve AUROC h/b = 1.000.

Model	Type	$\mu_{0}$	$\sigma_{\mathrm{norm}}$	$\bar{\theta}_{\mathrm{harm}}$	$\Delta\theta$	$\bar{\theta}_{\mathrm{benign}}$	$\sigma_{\mathrm{harm}}$
Qwen3.5-0.8B
Base	Base	1.161	0.272	1.811	$+0.650$	1.094	0.034
Chat	Instruct	1.178	0.267	1.801	$+0.623$	1.104	0.030
Abliterated	Abliterated	1.175	0.267	1.802	$+0.627$	1.104	0.031
Qwen2.5-0.5B
Base	Base	1.819	0.188	1.357	$-0.462$	1.821	0.034

Table 2: Raw angular deviation

\theta

statistics at the operating layer (normative-ref,

K{=}1

\mu_{0}=\bar{\theta}_{\mathrm{norm,test}}

: mean normative angle (radians).

\sigma_{\mathrm{norm}}

: normative test standard deviation.

\bar{\theta}_{\mathrm{harm}}

: harmful mean.

\Delta\theta=\bar{\theta}_{\mathrm{harm}}-\mu_{0}

: signed angular separation (positive

=

outer ring, negative

=

inner ring).

\bar{\theta}_{\mathrm{benign}}

: benign-aggressive mean.

\sigma_{\mathrm{harm}}

: harmful standard deviation. All h/n comparisons:

p{<}10^{-45}

. † Layer 10 for this model.

Panel of Figure 5 — Figure 5: Anomaly score distributions at the operating layer for all six variants. Each violin shows the marginal distribution of $s(x)=-\log p(\theta\mid\mu_{0},\sigma_{0}^{2})$ for normative eval (blue), harmful (red), benign-aggressive (green), and normative $\cup$ benign (purple). White circles denote medians; bars denote IQRs. In every panel, harmful prompts occupy a narrow, elevated band ( $\sigma_{\theta}^{\mathrm{harm}}$ is 5–9 $\times$ smaller than $\sigma_{\theta}^{\mathrm{norm}}$ ; table 2 ). In the Qwen3.5-0.8B family (left column), benign-aggressive scores fall below the normative distribution; in the Qwen2.5-0.5B family (right column), they overlap with it. The three panels within each column are nearly identical, illustrating that abliteration leaves the score landscape intact.

Model	Type	$K{=}1$ AUROC	$\Delta_{K}$	$\Delta_{\mathrm{cos}}$
Qwen3.5-0.8B-Base	Base	0.9642	$-0.033$	$-0.050$
Qwen3.5-0.8B-Chat	Instruct	0.9497	$-0.049$	$-0.031$
Qwen3.5-0.8B-Abliterated	Abliterated	0.9517	$-0.045$	$-0.035$
Qwen2.5-0.5B-Base	Base	0.9585	$-0.041$	$-0.008$
Qwen2.5-0.5B-Instruct	Instruct	0.9420	$-0.063$	$+0.009$
Qwen2.5-0.5B-Abliterated †	Abliterated	0.9374	$-0.037$	$+0.004$

Table 3:

K

-ablation at the operating layer.

\Delta_{K}

: AUROC h/n change from

K{=}1

to best

K{>}1

(negative =

K{=}1

better).

\Delta_{\mathrm{cos}}

: AUROC h/n change from

K{=}1

to cosine-centroid baseline (negative =

K{=}1

better). † Layer 10.

Panel of Figure 6 — Figure 6: Dimension-pruning ablation at the operating layer ( $K{=}2$ ) for the two base variants; all six models are shown in fig. 10 . AUROC h/n (red) and AUROC h/b (green) vs. number of principal dimensions retained by descending normative variance. Both tasks are maximised at the top-10 dimensions ( ${\approx}1\%$ of $D$ ) and degrade monotonically thereafter. This pattern indicates that retaining additional components does not improve performance under this setup.

Panel of Figure 7 — Figure 7: AUROC vs. normative fit-set size $N$ for the Qwen3.5-0.8B family. Left sub-panels : AUROC h/n vs. $N$ for representative layers (forward ordering), showing stabilisation well before $N{=}200$ at every layer. Right sub-panels : AUROC vs. $N$ at a fixed late layer, comparing forward (solid) and reverse (dashed) ordering for AUROC h/n (red) and AUROC h/b (green). Green curves are flat at 1.000 throughout; red curves are stable above 0.90 at all $N{\geq}30$ and invariant to ordering, ruling out sample-ordering artefacts.

Panel of Figure 8 — Figure 8: AUROC vs. normative fit-set size $N$ for the Qwen2.5-0.5B family. Similar to the 0.8B architecture, performance stabilises well before $N{=}200$ (left panels) and exhibits strict ordering invariance (right panels). The abliterated variant (panel c) shows the same robust stability pattern at its operating layer (layer 10) as at other layers, confirming data-size requirements are unaffected by the ablation of refusal directions.

Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

Panel of Figure 9 — Figure 9: Precision-recall curves for all six models; see fig. 1 for a detailed description, and the base models’ curves. In the Qwen3.5-0.8B family (left column), the normative-vs-benign-agg curve (green) lies below chance, confirming that benign-agg prompts are scored as less anomalous. In the Qwen2.5-0.5B family (right column), the same curve sits near or slightly above chance, reflecting $r_{\mathrm{b/n}}\approx+0.15$ to $+0.22$ . In all panels, the harmful-vs-benign-agg curve is flat at precision $=1.000$ .

Panel of Figure 10 — Figure 10: Dimension-pruning ablation ( $K{=}2$ ) for all six models; see fig. 6 for a detailed description. In every panel, performance is maximised at top-10 dimensions and monotonically decreases thereafter, confirming that the safety signal is concentrated in $<1.2\%$ of all residual-stream dimensions across both model families.

Anomaly Detection

Anomaly detection finds rare or unexpected patterns in data, from defective products and system faults to fraud and security threats.

See all 652 papers

Apr 20, 2026

Harmful Intent as a Geometrically Recoverable Feature of LLM Residual Streams

Aligned language models refuse harmful instructions, but the representations through which they recognise such instructions are less well characterised than the behaviours they produce. Harmful intent is linearly separable from residual-stream activations across 12 models spanning four architectural families (Qwen2.5, Qwen3.5, Llama-3.2, Gemma-3) and three alignment variants (base, instruction-tuned, abliterated), with parameter scales from 0.5B to 1.3B and a within-family scale extension to 9B on Qwen3.5. A direction fitted from 100 labelled examples per class via Soft-AUC optimisation reaches mean effective AUROC 0.982 and TPR@1%FPR 0.797, generalises to three held-out harm benchmarks and a hard-benign control, and matches its instruction-tuned counterpart within

\pm 0.003

AUROC in abliterated variants from which the refusal mechanism has been removed. The supervised strategies all exceed AUROC 0.96, but their TPR@1%FPR varies by more than ten times the AUROC gap; a deployed 9B safety classifier shows the same pattern at AUROC 0.94 and TPR 0.30, motivating low-FPR reporting as a default in safety-adjacent detection evaluation. Geometric measurements refine the picture. The recovered direction is concentrated within each extraction protocol but protocol-dependent across them: two pooling choices applied to the same chat-templated activations at the same residual-stream layer (max-pool over content tokens versus last-token at the post-instruction position) recover harm directions

73^\circ

apart, and projecting one out leaves detection under either max-pool extraction essentially intact. Probing identifies a protocol-specific direction rather than a unique computational feature.

Isaac Llorente-Saguer

Independent Researcher

Language Model Safety Evaluation LLM Interpretability Intent Classification Binary Classification Language Model Probing

Ask PDF

Sep 16, 2026

Safety Beyond the Interface: Detecting Harm via Latent States in Large Language Models

Autonomous systems increasingly rely on Large Language Models (LLMs) yet the safety infrastructure surrounding these models introduces latency and compute overhead. This limits utility in resource-constrained, time-critical deployments. Existing external guardrail models remain blind to the model's internal workings, creating a fundamental assurance gap. We ask: does the model already know when the content is harmful? We extract activations from LLaMA-3.1-8B and train lightweight MLP classifier probes (12.6M parameters) to detect harmful prompts. Evaluated on WildJailbreak, Beavertails, and AEGIS 2.0, our probes achieve F1 scores of 99%, 83%, and 84%, respectively competitive with 1000x larger guard models while cutting latency and compute costs.

Alizishaan Khatri, Chiquita Prabhu, Omkar Neogi

Wrynx Inc. · Independent Researcher

Safety Filtering LLM Safety Language Model Probing LLM Safety Monitoring Trustworthy AI

Ask PDF

Sep 11, 2026

Harmfulness Propagation Dynamics: Layer-wise Trajectories of Adversarial Intent in Large Language Models

We identify Harmfulness Propagation Dynamics (HPD): for harmful prompts, the projection of the last-token hidden state onto a learned harm direction rises monotonically with transformer depth, whereas benign prompts remain flat or oscillatory. This cross-layer signature reflects harmful intent as a progressively resolved semantic property: surface form appears early, while pragmatic intent consolidates later, making the trajectory shape more informative than any single-layer snapshot. Moreover, LDA-based harm directions, learned per layer, remain stable across random splits (pairwise cosine similarity

>0.97

), supporting the projection sequence as a reproducible structured signal. Building on HPD, we introduce \herald{} (Harmful Encoding Recognition via Activation Layer Dynamics). This lightweight input moderator extracts a seven-dimensional feature record, slope, curvature, monotonicity, onset layer, and related statistics from the cross-layer projection sequence and classifies it with a 288-parameter MLP. \herald{} stores one

d

-dimensional direction per layer (

262

,KB for a 32-layer,

d{=}4096

model), requires no gradient computation during training, and adds only

2.6{\times}10^{-6}

prefill FLOPs at inference. Across eight prompt-harmfulness benchmarks and four model families, \herald{} achieves an average F1 of

89.3

on OLMo2-7B, surpassing all tested guard models on adversarial jailbreak detection (

98.4

vs.\

96.9

F1) and outperforming prior latent-based methods by

2.3

4.1

F1 points on every backbone. Per-instance trajectories provide machine-readable audit records that reveal when and how harmfulness emerges, offering an interpretability advantage over single-layer approaches.

Noor Islam S. Mohammad, Uluğ Bayazıt

Department of Computer Science, İTÜ, İstanbul, Türkiye · Faculty of Computer Engineering, İTÜ, İstanbul, Türkiye.

LLM Security LLM Auditing LLM Interpretability

Ask PDF

Abstract

Anomaly Detection

Explore similar work

Harmful Intent as a Geometrically Recoverable Feature of LLM Residual Streams

Safety Beyond the Interface: Detecting Harm via Latent States in Large Language Models

Harmfulness Propagation Dynamics: Layer-wise Trajectories of Adversarial Intent in Large Language Models