We identify Harmfulness Propagation Dynamics (HPD): for harmful prompts, the projection of the last-token hidden state onto a learned harm direction rises monotonically with transformer depth, whereas benign prompts remain flat or oscillatory. This cross-layer signature reflects harmful intent as a progressively resolved semantic property: surface form appears early, while pragmatic intent consolidates later, making the trajectory shape more informative than any single-layer snapshot. Moreover, LDA-based harm directions, learned per layer, remain stable across random splits (pairwise cosine similarity >0.97), supporting the projection sequence as a reproducible structured signal. Building on HPD, we introduce \herald{} (Harmful Encoding Recognition via Activation Layer Dynamics). This lightweight input moderator extracts a seven-dimensional feature record, slope, curvature, monotonicity, onset layer, and related statistics from the cross-layer projection sequence and classifies it with a 288-parameter MLP. \herald{} stores one d-dimensional direction per layer (262,KB for a 32-layer, d=4096 model), requires no gradient computation during training, and adds only 2.6×10−6 prefill FLOPs at inference. Across eight prompt-harmfulness benchmarks and four model families, \herald{} achieves an average F1 of 89.3 on OLMo2-7B, surpassing all tested guard models on adversarial jailbreak detection (98.4 vs.\ 96.9 F1) and outperforming prior latent-based methods by 2.3-4.1 F1 points on every backbone. Per-instance trajectories provide machine-readable audit records that reveal when and how harmfulness emerges, offering an interpretability advantage over single-layer approaches.
Figures & tables
Method
Backbone
Aegis
HarmB
OAI
SimpST
TChat
WGMix
WJB
XSTest
Avg F1
Latent-based methods (lightweight; use backbone activations)
Embed. Clf.
Llama-8B
79.3
93.1
63.7
96.4
52.8
77.9
79.4
89.6
79.0
Act. Delta
Llama-8B
81.6
92.4
65.2
97.1
57.3
83.5
90.8
87.9
82.0
Herald (ours)
Llama-8B
84.1
97.6
69.5
98.4
64.9
86.3
95.8
93.7
86.3
Embed. Clf.
Mistral-7B
77.4
88.5
72.6
96.8
61.0
80.6
84.7
91.8
81.7
Act. Delta
Mistral-7B
81.9
94.7
62.3
96.3
55.4
82.9
88.4
91.3
81.6
Table 1: Average F1 on eight prompt-harmfulness benchmarks. Green text marks the top result within each group. Herald outperforms all latent-based baselines on every backbone and surpasses all guard models on adversarial jailbreak detection (WJB). Results are the mean F1 over three seeds; standard deviations are ≤0.3 for all Herald configurations and are omitted for space.
Figure 1: Herald achieves state-of-the-art jailbreak detection at a fraction of the cost of guard models. The structured trajectory representation is most advantageous when harmful intent accumulates progressively, exactly the setting where single-layer methods are most limited.
Backbone
Method
F1@100
F1@1k
F1@10k
F1@Full
Llama-8B
Embed. Clf.
79.3
81.6
82.9
83.6
Act. Delta
77.8
80.4
82.1
82.7
Herald
79.6
84.1
85.9
86.3
Mistral-7B
Embed. Clf.
74.7
79.3
82.0
83.1
Act. Delta
71.2
77.1
80.6
81.4
Herald
77.3
83.5
85.8
86.7
Table 2: WildGuardMix F1 at varying training set sizes. Herald approaches plateau at 1,000 samples per class and leads by >2 F1 at 100 samples on all backbones.
Feature configuration
Llama-8B
Mistral-7B
OLMo2-7B
WJB (OLMo2)
pL only
84.7
84.4
87.8
96.3
+ mean pˉ
85.0
84.7
88.1
96.6
+ total rise (pL−p1)
85.5
85.2
88.5
97.1
+ monotonicity mono
85.9
85.8
88.9
97.6
+ curvature Δ2p
86.1
86.1
89.1
97.9
+ onset l^∗ (full)
86.3
86.3
89.3
98.4
Table 3: Trajectory feature ablation. Features are added cumulatively, green text marking the full model. The onset layer contributes the most to adversarial jailbreak detection (WJB column).
Figure 2: Feature and direction-learning ablations. Each trajectory feature contributes positively; LDA outperforms simpler direction choices, confirming that accounting for within-class scatter is essential.
Direction method
Llama-8B
Mistral-7B
OLMo2-7B
Random (control)
77.2
76.9
79.9
Class-mean diff. μharm−μsafe
85.8
85.5
88.5
PCA on harm-class residuals
85.4
85.1
88.1
LDA (used in Herald )
86.3
86.3
89.3
Table 4: Direction learning method. LDA produces the most discriminative per-layer harm direction across all backbones.
Layer selection
Llama-8B
Mistral-7B
OLMo2-7B
Single best layer (oracle)
85.5
85.0
88.5
Early third ( l≤10 )
80.4
79.9
83.2
Middle third ( 11≤l≤21 )
84.2
84.7
87.1
Late third ( l≥22 )
84.9
83.8
88.0
Top-8 by validation F1
85.9
85.8
89.0
All layers (used in Herald )
86.3
86.3
89.3
Table 5: Layer coverage strategy. All-layer aggregation is best; the oracle single-layer falls short by 0.8 – 1.4 F1.
Figure 3: Herald is data-efficient (plateau near 1,000 samples/class) and benefits from full-layer aggregation. The top-8 selection offers a compelling storage-accuracy trade-off.
Token position
Llama-8B
Mistral-7B
OLMo2-7B
First token
80.6
79.3
82.4
Mean over all tokens
84.1
83.7
87.2
Last token (used in Herald )
86.3
86.3
89.3
Table 6: Token position. Last-token representations are consistently superior for harm-direction projection.
Variant
k=0
k=10
k=50
k=100
k=200
Last token (default)
86.3
85.8
85.0
83.7
81.5
Max projection over layers
85.9
85.7
85.4
85.0
83.8
Table 7: Suffix-padding robustness (Llama-8B, WildGuardMix). Max-pooling is more robust under long-suffix attacks. Best results per column are shown in green .
Normalization
Llama-8B
Mistral-7B
OLMo2-7B
No normalization
84.5
84.0
87.5
Normalize vl only
85.1
84.8
88.0
Normalize hl and vl
86.3
86.3
89.3
Table 8: Projection normalization. Normalizing both hl and vl yields the most stable trajectory signal ( +1.3 – 1.8 F1). Best results are shown in green .
Architecture
Params
Llama-8B
Mistral-7B
OLMo2-7B
Logistic regression (0 hidden)
8
85.3
85.3
88.4
MLP, hidden =16
128
85.9
85.8
88.9
MLP, hidden =32 (used)
288
86.3
86.3
89.3
MLP, hidden =64
512
86.3
86.2
89.3
MLP, hidden =128
1024
86.3
86.2
89.2
MLP, 2 hidden layers ( 32×32 )
1344
86.4
86.3
89.4
Table 9: MLP classifier capacity. Logistic regression is within 1.0 F1 of the full model; hidden size 32 reaches the plateau. Best results are shown in green .
Inversion strategy
Llama-8B
Mistral-7B
OLMo2-7B
F1@100
No regularization (raw inverse)
61.3
59.8
63.7
52.1
Diagonal covariance approx.
85.2
84.9
88.2
78.3
Fixed ridge ( λ=0.01 )
86.0
85.9
89.0
81.7
Ledoit–Wolf (used in Herald )
86.3
86.3
89.3
79.6
Table 10: Covariance regularization. Ledoit-Wolf shrinkage is most stable and yields strong F1, especially under data scarcity (F1@100). Best results are shown in green .
Appendix figures & tables15 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 4: Memory and computational overhead. Herald stores 262 KB ( 650× less than full covariance; 53,000× less than a 7B guard) and adds 2.6×10−6 of prefill FLOPs.
Table 12: Harm direction stability: mean pairwise cosine similarity across five random training splits ( >0.97 throughout).
Llama-8B
OLMo2-7B
Harm category
l^∗
Mono.
l^∗
Mono.
Jailbreak
7.4
0.83
5.9
0.86
Direct harmful request
14.2
0.79
13.1
0.82
Hate speech
10.8
0.75
9.4
0.77
Violence and physical harm
9.1
0.81
8.7
0.83
Cyberattack
11.3
0.77
10.2
0.79
Appendix
Table 13: Mean onset layer l^∗ and monotonicity index by harm category. Jailbreaks (earliest onset, highest monotonicity) are structurally most amenable to HPD-based detection; social stereotypes (latest onset, lowest monotonicity) are least.
Backbone
Alpaca
BBH
Codex
GSM8k
MMLU
MTBench
TruthQA
Avg
Llama-8B-Inst
94.7
99.4
100.0
100.0
99.6
100.0
97.8
98.8
Mistral-7B-Inst
93.9
99.5
100.0
100.0
99.4
100.0
97.3
98.6
OLMo2-7B-Inst
97.1
99.6
100.0
100.0
99.7
98.8
97.1
98.9
Qwen3-8B-Inst
95.4
99.5
100.0
100.0
99.6
100.0
97.9
98.9
Appendix
Table 14: True Negative Rate (%) on seven benign evaluation benchmarks. Herald maintains >98.5% average TNR across all four backbones.
Classifier
Llama-8B
Mistral-7B
OLMo2-7B
Qwen3-8B
LDA direction (used in Herald )
84.7
84.4
87.8
83.4
Logistic Regression
83.1
83.6
85.9
83.2
MLP (1 hidden layer)
84.2
82.7
86.4
83.0
Linear SVM
83.6
83.9
86.6
82.8
Random Forest
82.9
81.4
86.7
81.9
Appendix
Table 15: Average F1 of last-layer representation with varying classifiers. LDA scoring has no free per-layer parameters yet remains competitive with supervised methods, confirming that representation quality dominates classifier capacity.
Figure 5: Robustness and category analysis. Max-pooling is more stable under long benign suffixes. Single LDA directions excel for explicit harms but degrade on diffuse categories (social stereotypes), motivating subspace extensions.
Method
Llama-8B
Mistral-7B
OLMo2-7B
WJB (OLMo2)
Params
All-layers MLP ( {pl} raw input)
85.2
85.0
88.4
97.1
288
1D-CNN over {pl}
85.6
85.4
88.8
97.6
≈ 600
GRU over {pl}
85.7
85.3
88.9
97.8
≈ 900
Herald ( ϕ , MLP)
86.3
86.3
89.3
98.4
288
Appendix
Table 16: Learned sequence-model baselines vs. Herald . All models receive identical per-layer projections {pl} . Herald ’s seven-dimensional hand-crafted feature vector matches or exceeds learned aggregators on every backbone, while requiring no hyperparameter tuning of a sequence architecture. Best result per column in green .
Condition
Llama-8B (% refuse)
OLMo2-7B (% refuse)
No intervention (baseline)
94.5
93.0
Ablate vl† (peak layer)
61.0
58.5
Ablate vl† (early, l=4 )
89.0
90.5
Ablate vl† (late, l=30 )
88.0
86.5
Appendix
Table 17: Generation-time refusal rate under harm-direction ablation. Ablating vl† at the peak-monotonicity layer reduces the refusal rate substantially, confirming that the harm direction has causal influence on safety behavior and is not merely a post-hoc correlate.
Train → Test
Method
Llama-8B
Mistral-7B
OLMo2-7B
Aegis → HarmBench
Embed. Clf.
79.1 (93.1)
77.3 (88.5)
82.4 (93.8)
Act. Delta
78.4 (92.4)
79.0 (94.7)
79.8 (90.7)
Herald
84.9 (97.6)
85.2 (97.9)
88.6 (97.4)
Aegis → XSTest
Embed. Clf.
77.6
76.9
80.3
Act. Delta
76.2
77.4
80.0
Herald
83.8
84.1
87.3
Appendix
Table 18: Cross-distribution OOD generalization. Models are trained exclusively on one dataset and evaluated on others. Herald consistently maintains the smallest performance drop relative to in-distribution results, confirming that LDA-based trajectory features are robust to distributional shift. In-distribution F1 (from Table 1) shown for reference in parentheses.
Method
Backbone
WJB (full)
HD-WJB ( N=412 )
Embed. Clf.
OLMo2-7B
94.2
90.1
Act. Delta
OLMo2-7B
91.0
87.3
Herald
OLMo2-7B
98.4
95.7
Guard C (ShieldGemma-2)
NE
96.9
94.2
Guard D (Llama-Guard-3)
NE
96.4
94.8
Embed. Clf.
Llama-8B
79.4
75.9
Appendix
Table 19: WildJailbreak results on the full set vs. the hard-divergent (HD-WJB) subset. Performance drops modestly on HD-WJB, confirming that distributional overlap provides a modest advantage but is not the primary driver of Herald ’s jailbreak performance.
Threshold
Llama-8B
Mistral-7B
OLMo2-7B
WJB (OLMo2)
τ70
85.5
85.4
88.6
97.5
τ80
86.1
86.0
89.1
98.1
τ85
86.2
86.2
89.2
98.2
τ90 (default)
86.3
86.3
89.3
98.4
τ95
86.0
86.0
89.0
98.1
Δ (max − min)
0.8
0.9
0.7
0.9
Appendix
Table 20: Sensitivity of average F1 to onset threshold percentile. Herald is robust to the choice of onset threshold between τ80 and τ95 ; the performance difference across this range is ≤0.4 F1 on all backbones. The threshold τ90 was selected by cross-validation and is optimal or near-optimal in all cases.
Method
Backbone
WGMix
WJB
Aegis
HarmB
Avg F1
Embed. Clf.
Qwen3-8B-Instruct
78.2
79.6
77.8
88.3
80.5
Embed. Clf.
Qwen3-8B-Thinking
77.4
78.1
76.9
87.1
79.9
Herald
Qwen3-8B-Instruct
84.9
92.1
82.4
98.6
84.7
Herald
Qwen3-8B-Thinking
83.8
90.4
81.0
97.2
83.4
Δ (Thinking − Instruct)
− 1.1
− 1.7
− 1.4
− 1.4
− 1.3
Appendix
Table 21: Herald on a reasoning model (Qwen3-8B-Thinking) vs. the instruction-tuned variant (Qwen3-8B-Instruct). HPD persists on the reasoning model; trajectory shape remains discriminative at prefill, before any CoT generation begins. The modest drop ( ≈1.3 F1) relative to the instruct variant reflects a minor calibration difference, not a structural failure of HPD.
Method (OLMo2-7B)
Aegis
HarmB
OAI
SimpST
TChat
WGMix
WJB
Avg
Oracle single layer
87.3
96.4
72.4
99.3
73.6
87.1
96.5
87.5
Herald (all layers)
88.7
97.4
73.1
99.5
74.6
87.9
98.4
89.3
Δ
+1.4
+1.0
+0.7
+0.2
+1.0
+0.8
+1.9
+1.8
Appendix
Table 22: Oracle single-layer vs. Herald trajectory, per benchmark. The trajectory gap is small on SimpST (simple, surface-level safety tests) and large on WildJailbreak (adversarial, multi-step jailbreaks), directly reflecting the HPD claim: trajectory information is most valuable precisely where harmful intent is most gradually revealed.
Method
Llama-8B
Mistral-7B
OLMo2-7B
Embed. clf., last layer
79.3
77.4
85.6
Embed. clf., oracle layer
82.7
82.6
85.8
Herald (all layers)
86.3
86.3
89.3
Δ ( Herald − oracle embed.)
+3.6
+3.7
+3.5
Appendix
Table 23: Embed. clf. at oracle single layer vs. Herald trajectory. Even when embed. clf. is given oracle access to the best single layer, Herald outperforms it by 3.5 – 4.8 F1.
Autonomous systems increasingly rely on Large Language Models (LLMs) yet the safety infrastructure surrounding these models introduces latency and compute overhead. This limits utility in resource-constrained, time-critical deployments. Existing external guardrail models remain blind to the model's internal workings, creating a fundamental assurance gap. We ask: does the model already know when the content is harmful? We extract activations from LLaMA-3.1-8B and train lightweight MLP classifier probes (12.6M parameters) to detect harmful prompts. Evaluated on WildJailbreak, Beavertails, and AEGIS 2.0, our probes achieve F1 scores of 99%, 83%, and 84%, respectively competitive with 1000x larger guard models while cutting latency and compute costs.
Aligned language models refuse harmful instructions, but the representations through which they recognise such instructions are less well characterised than the behaviours they produce. Harmful intent is linearly separable from residual-stream activations across 12 models spanning four architectural families (Qwen2.5, Qwen3.5, Llama-3.2, Gemma-3) and three alignment variants (base, instruction-tuned, abliterated), with parameter scales from 0.5B to 1.3B and a within-family scale extension to 9B on Qwen3.5. A direction fitted from 100 labelled examples per class via Soft-AUC optimisation reaches mean effective AUROC 0.982 and TPR@1%FPR 0.797, generalises to three held-out harm benchmarks and a hard-benign control, and matches its instruction-tuned counterpart within ±0.003 AUROC in abliterated variants from which the refusal mechanism has been removed. The supervised strategies all exceed AUROC 0.96, but their TPR@1%FPR varies by more than ten times the AUROC gap; a deployed 9B safety classifier shows the same pattern at AUROC 0.94 and TPR 0.30, motivating low-FPR reporting as a default in safety-adjacent detection evaluation. Geometric measurements refine the picture. The recovered direction is concentrated within each extraction protocol but protocol-dependent across them: two pooling choices applied to the same chat-templated activations at the same residual-stream layer (max-pool over content tokens versus last-token at the post-instruction position) recover harm directions 73∘ apart, and projecting one out leaves detection under either max-pool extraction essentially intact. Probing identifies a protocol-specific direction rather than a unique computational feature.
Large language models have been reported to encode the harmfulness of a request separately from their decision to refuse it, and latent safety monitors such as Latent Guard build on this report by classifying prompts as harmful from the internal activations of the model, with the aim of catching harmful intent even when the model complies. Whether these representations give a signal of harm that survives distribution shift and is independent of model behaviour is unclear. We test this on out-of-distribution prompts made by rewriting existing harmful and benign requests with surface rewording, persuasive framing and jailbreak-style wrappers. Across 15 instruction-tuned LLMs and 38 activation-based readers, we compare harm detection with that of TF-IDF and sentence-embedding classifiers, with independently trained safety classifiers, and with the refusal of each model. Activations are read at the last token of the user instruction, where the model has read the whole request, and at the last chat-template token before the reply, where the planned response can be represented. Because models disagree about which prompts to refuse, we can separate a signal of the harmfulness of the prompt from a signal of the refusal decision of the model. At the end of the instruction, the representation is largely independent of the refusal behaviour of each model but degrades under distribution shift, so that a TF-IDF classifier ranks harm better than the original Latent Guard in every model we test, and linear and MLP probes do about as well as sentence-embedding classifiers trained on the same examples. The representation just before generation detects more, catching 44 percent of harmful prompts at a matched false-alarm rate against 32 percent for the refusal of the model, but that gain follows the refusal decision itself, and part of it comes from refusals that string-matching evaluation misses.