Harmfulness Propagation Dynamics: Layer-wise Trajectories of Adversarial Intent in Large Language Models

Noor Islam S. Mohammad; Uluğ Bayazıt

cs.CLSep 11, 2026

Harmfulness Propagation Dynamics: Layer-wise Trajectories of Adversarial Intent in Large Language Models

Authors: Noor Islam S. Mohammad, Uluğ Bayazıt

Organizations: Department of Computer Science, İTÜ, İstanbul, Türkiye · Faculty of Computer Engineering, İTÜ, İstanbul, Türkiye.

Abstract

We identify Harmfulness Propagation Dynamics (HPD): for harmful prompts, the projection of the last-token hidden state onto a learned harm direction rises monotonically with transformer depth, whereas benign prompts remain flat or oscillatory. This cross-layer signature reflects harmful intent as a progressively resolved semantic property: surface form appears early, while pragmatic intent consolidates later, making the trajectory shape more informative than any single-layer snapshot. Moreover, LDA-based harm directions, learned per layer, remain stable across random splits (pairwise cosine similarity $>0.97$ ), supporting the projection sequence as a reproducible structured signal. Building on HPD, we introduce \herald{} (Harmful Encoding Recognition via Activation Layer Dynamics). This lightweight input moderator extracts a seven-dimensional feature record, slope, curvature, monotonicity, onset layer, and related statistics from the cross-layer projection sequence and classifies it with a 288-parameter MLP. \herald{} stores one $d$ -dimensional direction per layer ( $262$ ,KB for a 32-layer, $d{=}4096$ model), requires no gradient computation during training, and adds only $2.6{\times}10^{-6}$ prefill FLOPs at inference. Across eight prompt-harmfulness benchmarks and four model families, \herald{} achieves an average F1 of $89.3$ on OLMo2-7B, surpassing all tested guard models on adversarial jailbreak detection ( $98.4$ vs.\ $96.9$ F1) and outperforming prior latent-based methods by $2.3$ - $4.1$ F1 points on every backbone. Per-instance trajectories provide machine-readable audit records that reveal when and how harmfulness emerges, offering an interpretability advantage over single-layer approaches.

Figures & tables

Latent-based methods (lightweight; use backbone activations)
Method	Backbone	Aegis	HarmB	OAI	SimpST	TChat	WGMix	WJB	XSTest	Avg F1
Embed. Clf.	Llama-8B	79.3	93.1	63.7	96.4	52.8	77.9	79.4	89.6	79.0
Act. Delta	Llama-8B	81.6	92.4	65.2	97.1	57.3	83.5	90.8	87.9	82.0
Herald (ours)	Llama-8B	84.1	97.6	69.5	98.4	64.9	86.3	95.8	93.7	86.3
Embed. Clf.	Mistral-7B	77.4	88.5	72.6	96.8	61.0	80.6	84.7	91.8	81.7
Act. Delta	Mistral-7B	81.9	94.7	62.3	96.3	55.4	82.9	88.4	91.3	81.6

Table 1: Average F1 on eight prompt-harmfulness benchmarks. Green text marks the top result within each group. Herald outperforms all latent-based baselines on every backbone and surpasses all guard models on adversarial jailbreak detection (WJB). Results are the mean F1 over three seeds; standard deviations are

{\leq}0.3

for all Herald configurations and are omitted for space.

Panel of Figure 1 — Figure 1: Herald achieves state-of-the-art jailbreak detection at a fraction of the cost of guard models. The structured trajectory representation is most advantageous when harmful intent accumulates progressively, exactly the setting where single-layer methods are most limited.

Backbone	Method	F1@100	F1@1k	F1@10k	F1@Full
Llama-8B	Embed. Clf.	79.3	81.6	82.9	83.6
	Act. Delta	77.8	80.4	82.1	82.7
	Herald	79.6	84.1	85.9	86.3
Mistral-7B	Embed. Clf.	74.7	79.3	82.0	83.1
	Act. Delta	71.2	77.1	80.6	81.4
	Herald	77.3	83.5	85.8	86.7

Table 2: WildGuardMix F1 at varying training set sizes. Herald approaches plateau at

1{,}000

samples per class and leads by

>2

F1 at

100

samples on all backbones.

Feature configuration	Llama-8B	Mistral-7B	OLMo2-7B	WJB (OLMo2)
$p_{L}$ only	84.7	84.4	87.8	96.3
$+$ mean $\bar{p}$	85.0	84.7	88.1	96.6
$+$ total rise $(p_{L}-p_{1})$	85.5	85.2	88.5	97.1
$+$ monotonicity $\mathrm{mono}$	85.9	85.8	88.9	97.6
$+$ curvature $\Delta^{2}\mathbf{p}$	86.1	86.1	89.1	97.9
$+$ onset $\hat{l}^{*}$ (full)	86.3	86.3	89.3	98.4

Table 3: Trajectory feature ablation. Features are added cumulatively, green text marking the full model. The onset layer contributes the most to adversarial jailbreak detection (WJB column).

Panel of Figure 2 — Figure 2: Feature and direction-learning ablations. Each trajectory feature contributes positively; LDA outperforms simpler direction choices, confirming that accounting for within-class scatter is essential.

Direction method	Llama-8B	Mistral-7B	OLMo2-7B
Random (control)	77.2	76.9	79.9
Class-mean diff. $\boldsymbol{\mu}^{\mathrm{harm}}-\boldsymbol{\mu}^{\mathrm{safe}}$	85.8	85.5	88.5
PCA on harm-class residuals	85.4	85.1	88.1
LDA (used in Herald )	86.3	86.3	89.3

Table 4: Direction learning method. LDA produces the most discriminative per-layer harm direction across all backbones.

Layer selection	Llama-8B	Mistral-7B	OLMo2-7B
Single best layer (oracle)	85.5	85.0	88.5
Early third ( $l\leq 10$ )	80.4	79.9	83.2
Middle third ( $11\leq l\leq 21$ )	84.2	84.7	87.1
Late third ( $l\geq 22$ )	84.9	83.8	88.0
Top-8 by validation F1	85.9	85.8	89.0
All layers (used in Herald )	86.3	86.3	89.3

Table 5: Layer coverage strategy. All-layer aggregation is best; the oracle single-layer falls short by

0.8

–

1.4

F1.

Panel of Figure 3 — Figure 3: Herald is data-efficient (plateau near $1{,}000$ samples/class) and benefits from full-layer aggregation. The top-8 selection offers a compelling storage-accuracy trade-off.

Token position	Llama-8B	Mistral-7B	OLMo2-7B
First token	80.6	79.3	82.4
Mean over all tokens	84.1	83.7	87.2
Last token (used in Herald )	86.3	86.3	89.3

Table 6: Token position. Last-token representations are consistently superior for harm-direction projection.

Variant	$k{=}0$	$k{=}10$	$k{=}50$	$k{=}100$	$k{=}200$
Last token (default)	86.3	85.8	85.0	83.7	81.5
Max projection over layers	85.9	85.7	85.4	85.0	83.8

Table 7: Suffix-padding robustness (Llama-8B, WildGuardMix). Max-pooling is more robust under long-suffix attacks. Best results per column are shown in green .

Normalization	Llama-8B	Mistral-7B	OLMo2-7B
No normalization	84.5	84.0	87.5
Normalize $\mathbf{v}_{l}$ only	85.1	84.8	88.0
Normalize $\mathbf{h}_{l}$ and $\mathbf{v}_{l}$	86.3	86.3	89.3

Table 8: Projection normalization. Normalizing both

\mathbf{h}_{l}

and

\mathbf{v}_{l}

yields the most stable trajectory signal (

+1.3

–

1.8

F1). Best results are shown in green .

Architecture	Params	Llama-8B	Mistral-7B	OLMo2-7B
Logistic regression (0 hidden)	8	85.3	85.3	88.4
MLP, hidden $=16$	128	85.9	85.8	88.9
MLP, hidden $=32$ (used)	288	86.3	86.3	89.3
MLP, hidden $=64$	512	86.3	86.2	89.3
MLP, hidden $=128$	1024	86.3	86.2	89.2
MLP, 2 hidden layers ( $32{\times}32$ )	1344	86.4	86.3	89.4

Table 9: MLP classifier capacity. Logistic regression is within

1.0

F1 of the full model; hidden size 32 reaches the plateau. Best results are shown in green .

Inversion strategy	Llama-8B	Mistral-7B	OLMo2-7B	F1@100
No regularization (raw inverse)	61.3	59.8	63.7	52.1
Diagonal covariance approx.	85.2	84.9	88.2	78.3
Fixed ridge ( $\lambda=0.01$ )	86.0	85.9	89.0	81.7
Ledoit–Wolf (used in Herald )	86.3	86.3	89.3	79.6

Table 10: Covariance regularization. Ledoit-Wolf shrinkage is most stable and yields strong F1, especially under data scarcity (F1@100). Best results are shown in green .

Appendix figures & tables15 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 4: Memory and computational overhead. Herald stores $262$ KB ( $650\times$ less than full covariance; $53{,}000\times$ less than a 7B guard) and adds $2.6{\times}10^{-6}$ of prefill FLOPs.

Feature	Symbol	What it captures
Final value	$p_{L}$	Terminal harm alignment
Mean	$\bar{p}$	Global bias across all layers
Total rise	$p_{L}-p_{1}$	Net directional movement with depth
Curvature	$\Delta^{2}p$	Trajectory smoothness / oscillation
Monotonicity	$\mathrm{mono}(\boldsymbol{p})$	Consistency of directional increase
Onset value	$p_{\hat{l}^{*}}$	Projection at first salient layer

Appendix

Table 11: Trajectory feature vector

\boldsymbol{\phi}(\boldsymbol{p})\in\mathbb{R}^{7}

: geometric interpretation.

Model	L4	L8	L16	L24	L32
Llama-8B-Inst	0.984	0.991	0.994	0.992	0.989
Mistral-7B-Inst	0.979	0.987	0.993	0.990	0.983
OLMo2-7B-Inst	0.975	0.988	0.991	0.993	0.991
Qwen3-8B-Inst	0.972	0.984	0.991	0.988	0.986

Appendix

Table 12: Harm direction stability: mean pairwise cosine similarity across five random training splits (

>0.97

throughout).

	Llama-8B		OLMo2-7B
Harm category	$\hat{l}^{*}$	Mono.	$\hat{l}^{*}$	Mono.
Jailbreak	7.4	0.83	5.9	0.86
Direct harmful request	14.2	0.79	13.1	0.82
Hate speech	10.8	0.75	9.4	0.77
Violence and physical harm	9.1	0.81	8.7	0.83
Cyberattack	11.3	0.77	10.2	0.79

Appendix

Table 13: Mean onset layer

\hat{l}^{*}

and monotonicity index by harm category. Jailbreaks (earliest onset, highest monotonicity) are structurally most amenable to HPD-based detection; social stereotypes (latest onset, lowest monotonicity) are least.

Backbone	Alpaca	BBH	Codex	GSM8k	MMLU	MTBench	TruthQA	Avg
Llama-8B-Inst	94.7	99.4	100.0	100.0	99.6	100.0	97.8	98.8
Mistral-7B-Inst	93.9	99.5	100.0	100.0	99.4	100.0	97.3	98.6
OLMo2-7B-Inst	97.1	99.6	100.0	100.0	99.7	98.8	97.1	98.9
Qwen3-8B-Inst	95.4	99.5	100.0	100.0	99.6	100.0	97.9	98.9

Appendix

Table 14: True Negative Rate (%) on seven benign evaluation benchmarks. Herald maintains

>98.5\%

average TNR across all four backbones.

Classifier	Llama-8B	Mistral-7B	OLMo2-7B	Qwen3-8B
LDA direction (used in Herald )	84.7	84.4	87.8	83.4
Logistic Regression	83.1	83.6	85.9	83.2
MLP (1 hidden layer)	84.2	82.7	86.4	83.0
Linear SVM	83.6	83.9	86.6	82.8
Random Forest	82.9	81.4	86.7	81.9

Appendix

Table 15: Average F1 of last-layer representation with varying classifiers. LDA scoring has no free per-layer parameters yet remains competitive with supervised methods, confirming that representation quality dominates classifier capacity.

Panel of Figure 5 — Figure 5: Robustness and category analysis. Max-pooling is more stable under long benign suffixes. Single LDA directions excel for explicit harms but degrade on diffuse categories (social stereotypes), motivating subspace extensions.

Method	Llama-8B	Mistral-7B	OLMo2-7B	WJB (OLMo2)	Params
All-layers MLP ( $\{p_{l}\}$ raw input)	85.2	85.0	88.4	97.1	288
1D-CNN over $\{p_{l}\}$	85.6	85.4	88.8	97.6	$\approx$ 600
GRU over $\{p_{l}\}$	85.7	85.3	88.9	97.8	$\approx$ 900
Herald ( $\boldsymbol{\phi}$ , MLP)	86.3	86.3	89.3	98.4	288

Appendix

Table 16: Learned sequence-model baselines vs. Herald . All models receive identical per-layer projections

\{p_{l}\}

. Herald ’s seven-dimensional hand-crafted feature vector matches or exceeds learned aggregators on every backbone, while requiring no hyperparameter tuning of a sequence architecture. Best result per column in green .

Condition	Llama-8B (% refuse)	OLMo2-7B (% refuse)
No intervention (baseline)	94.5	93.0
Ablate $\mathbf{v}_{l^{\dagger}}$ (peak layer)	61.0	58.5
Ablate $\mathbf{v}_{l^{\dagger}}$ (early, $l{=}4$ )	89.0	90.5
Ablate $\mathbf{v}_{l^{\dagger}}$ (late, $l{=}30$ )	88.0	86.5

Appendix

Table 17: Generation-time refusal rate under harm-direction ablation. Ablating

\mathbf{v}_{l^{\dagger}}

at the peak-monotonicity layer reduces the refusal rate substantially, confirming that the harm direction has causal influence on safety behavior and is not merely a post-hoc correlate.

Train $\to$ Test	Method	Llama-8B	Mistral-7B	OLMo2-7B
Aegis $\to$ HarmBench	Embed. Clf.	79.1 (93.1)	77.3 (88.5)	82.4 (93.8)
	Act. Delta	78.4 (92.4)	79.0 (94.7)	79.8 (90.7)
	Herald	84.9 (97.6)	85.2 (97.9)	88.6 (97.4)
Aegis $\to$ XSTest	Embed. Clf.	77.6	76.9	80.3
	Act. Delta	76.2	77.4	80.0
	Herald	83.8	84.1	87.3

Appendix

Table 18: Cross-distribution OOD generalization. Models are trained exclusively on one dataset and evaluated on others. Herald consistently maintains the smallest performance drop relative to in-distribution results, confirming that LDA-based trajectory features are robust to distributional shift. In-distribution F1 (from Table 1) shown for reference in parentheses.

Method	Backbone	WJB (full)	HD-WJB ( $N{=}412$ )
Embed. Clf.	OLMo2-7B	94.2	90.1
Act. Delta	OLMo2-7B	91.0	87.3
Herald	OLMo2-7B	98.4	95.7
Guard C (ShieldGemma-2)	NE	96.9	94.2
Guard D (Llama-Guard-3)	NE	96.4	94.8
Embed. Clf.	Llama-8B	79.4	75.9

Appendix

Table 19: WildJailbreak results on the full set vs. the hard-divergent (HD-WJB) subset. Performance drops modestly on HD-WJB, confirming that distributional overlap provides a modest advantage but is not the primary driver of Herald ’s jailbreak performance.

Threshold	Llama-8B	Mistral-7B	OLMo2-7B	WJB (OLMo2)
$\tau_{70}$	85.5	85.4	88.6	97.5
$\tau_{80}$	86.1	86.0	89.1	98.1
$\tau_{85}$	86.2	86.2	89.2	98.2
$\tau_{90}$ (default)	86.3	86.3	89.3	98.4
$\tau_{95}$	86.0	86.0	89.0	98.1
$\Delta$ (max $-$ min)	0.8	0.9	0.7	0.9

Appendix

Table 20: Sensitivity of average F1 to onset threshold percentile. Herald is robust to the choice of onset threshold between

\tau_{80}

and

\tau_{95}

; the performance difference across this range is

\leq 0.4

F1 on all backbones. The threshold

\tau_{90}

was selected by cross-validation and is optimal or near-optimal in all cases.

Method	Backbone	WGMix	WJB	Aegis	HarmB	Avg F1
Embed. Clf.	Qwen3-8B-Instruct	78.2	79.6	77.8	88.3	80.5
Embed. Clf.	Qwen3-8B-Thinking	77.4	78.1	76.9	87.1	79.9
Herald	Qwen3-8B-Instruct	84.9	92.1	82.4	98.6	84.7
Herald	Qwen3-8B-Thinking	83.8	90.4	81.0	97.2	83.4
$\Delta$ (Thinking $-$ Instruct)		$-$ 1.1	$-$ 1.7	$-$ 1.4	$-$ 1.4	$-$ 1.3

Appendix

Table 21: Herald on a reasoning model (Qwen3-8B-Thinking) vs. the instruction-tuned variant (Qwen3-8B-Instruct). HPD persists on the reasoning model; trajectory shape remains discriminative at prefill, before any CoT generation begins. The modest drop (

{\approx}1.3

F1) relative to the instruct variant reflects a minor calibration difference, not a structural failure of HPD.

Method (OLMo2-7B)	Aegis	HarmB	OAI	SimpST	TChat	WGMix	WJB	Avg
Oracle single layer	87.3	96.4	72.4	99.3	73.6	87.1	96.5	87.5
Herald (all layers)	88.7	97.4	73.1	99.5	74.6	87.9	98.4	89.3
$\Delta$	+1.4	+1.0	+0.7	+0.2	+1.0	+0.8	+1.9	+1.8

Appendix

Table 22: Oracle single-layer vs. Herald trajectory, per benchmark. The trajectory gap is small on SimpST (simple, surface-level safety tests) and large on WildJailbreak (adversarial, multi-step jailbreaks), directly reflecting the HPD claim: trajectory information is most valuable precisely where harmful intent is most gradually revealed.

Method	Llama-8B	Mistral-7B	OLMo2-7B
Embed. clf., last layer	79.3	77.4	85.6
Embed. clf., oracle layer	82.7	82.6	85.8
Herald (all layers)	86.3	86.3	89.3
$\Delta$ ( Herald $-$ oracle embed.)	+3.6	+3.7	+3.5

Appendix

Table 23: Embed. clf. at oracle single layer vs. Herald trajectory. Even when embed. clf. is given oracle access to the best single layer, Herald outperforms it by

3.5

–

4.8

F1.

LLM Security

Large language model (LLM) security studies attacks, privacy risks, and defenses across model training, inference, and deployment.

See all 322 papers

Safety Beyond the Interface: Detecting Harm via Latent States in Large Language Models
Sep 16, 2026Alizishaan Khatri, Chiquita Prabhu, Omkar NeogiSafety Filtering LLM Safety
Wrynx Inc. · Independent Researcher
Harmful Intent as a Geometrically Recoverable Feature of LLM Residual Streams
Apr 20, 2026Isaac Llorente-SaguerLanguage Model Safety Evaluation LLM Interpretability
Independent Researcher
Faithful Latent Harm Monitors Work No Better Than the Models Own Behaviour at a Matched False Alarm Rate
Oct 22, 2026Abhishek Mishra, Sagnik Chatterjee, Suyash ManiyarLLM Safety Monitoring Language Model Safety Evaluation
University of Massachusetts Amherst

Sep 16, 2026J/K move · Enter open · S save

Safety Beyond the Interface: Detecting Harm via Latent States in Large Language Models

Alizishaan Khatri, Chiquita Prabhu, Omkar Neogi

Wrynx Inc. · Independent Researcher

Safety Filtering LLM Safety Language Model Probing LLM Safety Monitoring Trustworthy AI

Open paper AskPDF arXiv

Autonomous systems increasingly rely on Large Language Models (LLMs) yet the safety infrastructure surrounding these models introduces latency and compute overhead. This limits utility in resource-constrained, time-critical deployments. Existing external guardrail models remain blind to the model's internal workings, creating a fundamental assurance gap. We ask: does the model already know when the content is harmful? We extract activations from LLaMA-3.1-8B and train lightweight MLP classifier probes (12.6M parameters) to detect harmful prompts. Evaluated on WildJailbreak, Beavertails, and AEGIS 2.0, our probes achieve F1 scores of 99%, 83%, and 84%, respectively competitive with 1000x larger guard models while cutting latency and compute costs.

Abstract

LLM Security

Explore similar work

Safety Beyond the Interface: Detecting Harm via Latent States in Large Language Models

Harmful Intent as a Geometrically Recoverable Feature of LLM Residual Streams

Faithful Latent Harm Monitors Work No Better Than the Models Own Behaviour at a Matched False Alarm Rate