The Geometry of Harmful Intent: Training-Free Anomaly Detection via Angular Deviation in LLM Residual Streams

Isaac Llorente-Saguer

cs.LGMar 28, 2026

The Geometry of Harmful Intent: Training-Free Anomaly Detection via Angular Deviation in LLM Residual Streams

Authors: Isaac Llorente-Saguer

Organizations: Independent Researcher

Abstract

We present LatentBiopsy, a training-free method for detecting harmful prompts by analysing the geometry of residual-stream activations in large language models. Given 200 safe normative prompts, LatentBiopsy computes the leading principal component of their activations at a target layer and characterises new prompts by their radial deviation angle $θ$ from this reference direction. The anomaly score is the negative log-likelihood of $θ$ under a Gaussian fit to the normative distribution, flagging deviations symmetrically regardless of orientation. No harmful examples are required for training. We evaluate two complete model triplets from the Qwen3.5-0.8B and Qwen2.5-0.5B families: base, instruction-tuned, and abliterated (refusal direction surgically removed via orthogonalisation). Across all six variants, LatentBiopsy achieves AUROC $\geq$ 0.937 for harmful-vs-normative detection and AUROC = 1.000 for discriminating harmful from benign-aggressive prompts (XSTest), with sub-millisecond per-query overhead. Three empirical findings emerge. First, geometry survives refusal ablation: both abliterated variants achieve AUROC at most 0.015 below their instruction-tuned counterparts, establishing a geometric dissociation between harmful-intent representation and the downstream generative refusal mechanism. Second, harmful prompts exhibit a near-degenerate angular distribution ( $σ_θ\approx 0.03$ rad), an order of magnitude tighter than the normative distribution ( $σ_θ\approx 0.27$ rad), preserved across all alignment stages including abliteration. Third, the two families exhibit opposite ring orientations at the same depth: harmful prompts occupy the outer ring in Qwen3.5-0.8B but the inner ring in Qwen2.5-0.5B, directly motivating the direction-agnostic scoring rule.

Figures & tables

Model	Type	Layer	AUROC		AUPRC		h/r	$r_{\mathrm{b/n}}$	Prec@90
Model	Type	Layer	h/n	h/b	h/n	h/b	h/r	$r_{\mathrm{b/n}}$	Prec@90
Qwen3.5-0.8B ( $D{=}1024$ )
Base	Base	20	0.9642	1.000	0.9373	1.000	0.9758	$-0.384^{***}$	0.928
Chat	Instruct	20	0.9497	1.000	0.9117	1.000	0.9661	$-0.434^{***}$	0.899
Abliterated	Abliterated	20	0.9517	1.000	0.9165	1.000	0.9674	$-0.427^{***}$	0.899
Qwen2.5-0.5B ( $D{=}896$ )

Table 1: Detection performance (normative-reference strategy,

K{=}1

, held-out evaluation sets,

N_{\mathrm{fit}}{=}200

for all models).

n_{\mathrm{harm}}{=}520

n_{\mathrm{norm,eval}}{=}520

n_{\mathrm{benign}}{=}250

for all models. h/n: harmful vs. normative; h/b: harmful vs. benign-aggressive; h/r: harmful vs. rest (norm

\cup

benign).

r_{\mathrm{b/n}}

: rank-biserial correlation for normative-vs-benign-agg (negative means benign-agg is less anomalous than normative, which is the desired direction for a harm detector). Prec@90: precision at 90% recall on the h/n task. † Best layer for this model is 10; AUROC at layer 20 differs by

<0.004

Panel of Figure 1 — Figure 1: Precision-recall curves at the operating layer ( $K{=}1$ ) for the two base variants; remaining models are in fig. 9 . Dotted horizontal lines indicate chance precision per task. The harmful-vs-normative curve (red) maintains precision $>0.92$ up to 90% recall for Qwen3.5-0.8B-Base (Prec@90 $=0.928$ ) and $>0.90$ for Qwen2.5-0.5B-Base (Prec@90 $=0.902$ ). The harmful-vs-benign-agg curve is flat at 1.000 precision across all recall levels. The normative-vs-benign-agg curve (green) lies below chance in Qwen3.5-0.8B (AUPRC $=0.232$ ), confirming that benign-agg prompts are scored as less anomalous than normative, consistent with $r_{\mathrm{b/n}}=-0.384$ .

Panel of Figure 2 — Figure 2: Per-layer AUROC for the Qwen3.5-0.8B family. Each panel shows AUROC h/n (left) and AUROC h/b (right) vs. layer index. $K{=}1$ (solid blue) strictly dominates $K{>}1$ (orange/green/red) at every layer. The cosine-centroid baseline (purple dashed) consistently underperforms $K{=}1$ . AUROC h/b $=1.000$ is maintained at every layer regardless of alignment stage. The three panels are nearly indistinguishable in their h/b profile.

Panel of Figure 3 — Figure 3: Per-layer AUROC for the Qwen2.5-0.5B family. $K{=}1$ (solid blue) remains the dominant scorer throughout. In the Instruct and Abliterated variants, the cosine-centroid and L2-norm baselines reach near-parity with $K{=}1$ , reflecting the specific geometry of this family, but do not surpass it. The broad performance plateau across layers 5–23 bounds layer-selection optimism to $<0.08$ AUROC units.

Panel of Figure 4 — Figure 4: Theta-phi projections at the operating layer. Harmful (red) and safe (blue/green) prompts form distinct concentric radial zones across all variants. In the Qwen3.5-0.8B family ( left column ), harmful intent occupies the outer ring ; in Qwen2.5-0.5B ( right column ), it occupies the inner ring . The visual invariance across rows demonstrates that safety geometry is established during pretraining and remains intact even after the mathematical erasure of refusal mechanisms. All panels achieve AUROC h/b = 1.000.

Model	Type	$\mu_{0}$	$\sigma_{\mathrm{norm}}$	$\bar{\theta}_{\mathrm{harm}}$	$\Delta\theta$	$\bar{\theta}_{\mathrm{benign}}$	$\sigma_{\mathrm{harm}}$
Qwen3.5-0.8B
Base	Base	1.161	0.272	1.811	$+0.650$	1.094	0.034
Chat	Instruct	1.178	0.267	1.801	$+0.623$	1.104	0.030
Abliterated	Abliterated	1.175	0.267	1.802	$+0.627$	1.104	0.031
Qwen2.5-0.5B
Base	Base	1.819	0.188	1.357	$-0.462$	1.821	0.034

Table 2: Raw angular deviation

\theta

statistics at the operating layer (normative-ref,

K{=}1

\mu_{0}=\bar{\theta}_{\mathrm{norm,test}}

: mean normative angle (radians).

\sigma_{\mathrm{norm}}

: normative test standard deviation.

\bar{\theta}_{\mathrm{harm}}

: harmful mean.

\Delta\theta=\bar{\theta}_{\mathrm{harm}}-\mu_{0}

: signed angular separation (positive

=

outer ring, negative

=

inner ring).

\bar{\theta}_{\mathrm{benign}}

: benign-aggressive mean.

\sigma_{\mathrm{harm}}

: harmful standard deviation. All h/n comparisons:

p{<}10^{-45}

. † Layer 10 for this model.

Panel of Figure 5 — Figure 5: Anomaly score distributions at the operating layer for all six variants. Each violin shows the marginal distribution of $s(x)=-\log p(\theta\mid\mu_{0},\sigma_{0}^{2})$ for normative eval (blue), harmful (red), benign-aggressive (green), and normative $\cup$ benign (purple). White circles denote medians; bars denote IQRs. In every panel, harmful prompts occupy a narrow, elevated band ( $\sigma_{\theta}^{\mathrm{harm}}$ is 5–9 $\times$ smaller than $\sigma_{\theta}^{\mathrm{norm}}$ ; table 2 ). In the Qwen3.5-0.8B family (left column), benign-aggressive scores fall below the normative distribution; in the Qwen2.5-0.5B family (right column), they overlap with it. The three panels within each column are nearly identical, illustrating that abliteration leaves the score landscape intact.

Model	Type	$K{=}1$ AUROC	$\Delta_{K}$	$\Delta_{\mathrm{cos}}$
Qwen3.5-0.8B-Base	Base	0.9642	$-0.033$	$-0.050$
Qwen3.5-0.8B-Chat	Instruct	0.9497	$-0.049$	$-0.031$
Qwen3.5-0.8B-Abliterated	Abliterated	0.9517	$-0.045$	$-0.035$
Qwen2.5-0.5B-Base	Base	0.9585	$-0.041$	$-0.008$
Qwen2.5-0.5B-Instruct	Instruct	0.9420	$-0.063$	$+0.009$
Qwen2.5-0.5B-Abliterated †	Abliterated	0.9374	$-0.037$	$+0.004$

Table 3:

K

-ablation at the operating layer.

\Delta_{K}

: AUROC h/n change from

K{=}1

to best

K{>}1

(negative =

K{=}1

better).

\Delta_{\mathrm{cos}}

: AUROC h/n change from

K{=}1

to cosine-centroid baseline (negative =

K{=}1

better). † Layer 10.

Panel of Figure 6 — Figure 6: Dimension-pruning ablation at the operating layer ( $K{=}2$ ) for the two base variants; all six models are shown in fig. 10 . AUROC h/n (red) and AUROC h/b (green) vs. number of principal dimensions retained by descending normative variance. Both tasks are maximised at the top-10 dimensions ( ${\approx}1\%$ of $D$ ) and degrade monotonically thereafter. This pattern indicates that retaining additional components does not improve performance under this setup.

Panel of Figure 7 — Figure 7: AUROC vs. normative fit-set size $N$ for the Qwen3.5-0.8B family. Left sub-panels : AUROC h/n vs. $N$ for representative layers (forward ordering), showing stabilisation well before $N{=}200$ at every layer. Right sub-panels : AUROC vs. $N$ at a fixed late layer, comparing forward (solid) and reverse (dashed) ordering for AUROC h/n (red) and AUROC h/b (green). Green curves are flat at 1.000 throughout; red curves are stable above 0.90 at all $N{\geq}30$ and invariant to ordering, ruling out sample-ordering artefacts.

Panel of Figure 8 — Figure 8: AUROC vs. normative fit-set size $N$ for the Qwen2.5-0.5B family. Similar to the 0.8B architecture, performance stabilises well before $N{=}200$ (left panels) and exhibits strict ordering invariance (right panels). The abliterated variant (panel c) shows the same robust stability pattern at its operating layer (layer 10) as at other layers, confirming data-size requirements are unaffected by the ablation of refusal directions.

Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

Panel of Figure 9 — Figure 9: Precision-recall curves for all six models; see fig. 1 for a detailed description, and the base models’ curves. In the Qwen3.5-0.8B family (left column), the normative-vs-benign-agg curve (green) lies below chance, confirming that benign-agg prompts are scored as less anomalous. In the Qwen2.5-0.5B family (right column), the same curve sits near or slightly above chance, reflecting $r_{\mathrm{b/n}}\approx+0.15$ to $+0.22$ . In all panels, the harmful-vs-benign-agg curve is flat at precision $=1.000$ .

Panel of Figure 10 — Figure 10: Dimension-pruning ablation ( $K{=}2$ ) for all six models; see fig. 6 for a detailed description. In every panel, performance is maximised at top-10 dimensions and monotonically decreases thereafter, confirming that the safety signal is concentrated in $<1.2\%$ of all residual-stream dimensions across both model families.

Anomaly Detection

Anomaly detection finds rare or unexpected patterns in data, from defective products and system faults to fraud and security threats.

See all 652 papers

Harmful Intent as a Geometrically Recoverable Feature of LLM Residual Streams
Apr 20, 2026Isaac Llorente-SaguerLanguage Model Safety Evaluation LLM Interpretability
Independent Researcher
Safety Beyond the Interface: Detecting Harm via Latent States in Large Language Models
Sep 16, 2026Alizishaan Khatri, Chiquita Prabhu, Omkar NeogiSafety Filtering LLM Safety
Wrynx Inc. · Independent Researcher
Harmfulness Propagation Dynamics: Layer-wise Trajectories of Adversarial Intent in Large Language Models
Sep 11, 2026Noor Islam S. Mohammad, Uluğ BayazıtLLM Security LLM Auditing
Department of Computer Science, İTÜ, İstanbul, Türkiye · Faculty of Computer Engineering, İTÜ, İstanbul, Türkiye.

Apr 20, 2026J/K move · Enter open · S save

Harmful Intent as a Geometrically Recoverable Feature of LLM Residual Streams

Isaac Llorente-Saguer

Independent Researcher

Language Model Safety Evaluation LLM Interpretability Intent Classification Binary Classification Language Model Probing

Open paper AskPDF arXiv

Aligned language models refuse harmful instructions, but the representations through which they recognise such instructions are less well characterised than the behaviours they produce. Harmful intent is linearly separable from residual-stream activations across 12 models spanning four architectural families (Qwen2.5, Qwen3.5, Llama-3.2, Gemma-3) and three alignment variants (base, instruction-tuned, abliterated), with parameter scales from 0.5B to 1.3B and a within-family scale extension to 9B on Qwen3.5. A direction fitted from 100 labelled examples per class via Soft-AUC optimisation reaches mean effective AUROC 0.982 and TPR@1%FPR 0.797, generalises to three held-out harm benchmarks and a hard-benign control, and matches its instruction-tuned counterpart within

\pm 0.003

AUROC in abliterated variants from which the refusal mechanism has been removed. The supervised strategies all exceed AUROC 0.96, but their TPR@1%FPR varies by more than ten times the AUROC gap; a deployed 9B safety classifier shows the same pattern at AUROC 0.94 and TPR 0.30, motivating low-FPR reporting as a default in safety-adjacent detection evaluation. Geometric measurements refine the picture. The recovered direction is concentrated within each extraction protocol but protocol-dependent across them: two pooling choices applied to the same chat-templated activations at the same residual-stream layer (max-pool over content tokens versus last-token at the post-instruction position) recover harm directions

73^\circ

apart, and projecting one out leaves detection under either max-pool extraction essentially intact. Probing identifies a protocol-specific direction rather than a unique computational feature.

Abstract

Anomaly Detection

Explore similar work

Harmful Intent as a Geometrically Recoverable Feature of LLM Residual Streams

Safety Beyond the Interface: Detecting Harm via Latent States in Large Language Models

Harmfulness Propagation Dynamics: Layer-wise Trajectories of Adversarial Intent in Large Language Models