Metraipolis › archive › dc_2a99208eb37f

Harmfulness Propagation Dynamics: Layer-wise Trajectories of Adversarial Intent in Large Language Models — arXiv:2609.13534

Source: arXiv (en)
Original: https://arxiv.org/abs/2609.13534
License (as archived): CC0-1.0
Archived: 2026-10-15T23:13:27.321Z
SHA-256 of the archived text: 45c3ec62075160a85d1be8c6aa5982ecd2dd96ad5581edeec9d8b11e8541226c
Stable URL of this page: https://metraipolis.com/documento/dc_2a99208eb37f

How to cite

Harmfulness Propagation Dynamics: Layer-wise Trajectories of Adversarial Intent in Large Language Models — arXiv:2609.13534 — arXiv (en), https://arxiv.org/abs/2609.13534 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_2a99208eb37f (Metraipolis archive dc_2a99208eb37f, sha256 45c3ec62075160a85d1be8c6aa5982ecd2dd96ad5581edeec9d8b11e8541226c)

BibTeX

@misc{dc2a99208eb37f,
  title = {Harmfulness Propagation Dynamics: Layer-wise Trajectories of Adversarial Intent in Large Language Models — arXiv:2609.13534},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2609.13534},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_2a99208eb37f; sha256 45c3ec62075160a85d1be8c6aa5982ecd2dd96ad5581edeec9d8b11e8541226c},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2609.13534. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

We identify \textbf{Harmfulness Propagation Dynamics (HPD)}: for harmful prompts, the projection of the last-token hidden state onto a learned harm direction rises monotonically with transformer depth, whereas benign prompts remain flat or oscillatory. This cross-layer signature reflects harmful intent as a \emph{progressively resolved} semantic property: surface form appears early, while pragmatic intent consolidates later, making the \emph{trajectory shape} more informative than any single-layer snapshot. Moreover, LDA-based harm directions, learned per layer, remain stable across random splits (pairwise cosine similarity $>0.97$), supporting the projection sequence as a reproducible structured signal. Building on HPD, we introduce \textbf{\herald{}} (\textbf{H}armful \textbf{E}ncoding \textbf{R}ecognition via \textbf{A}ctivation \textbf{L}ayer \textbf{D}ynamics). This lightweight input moderator extracts a seven-dimensional feature record, slope, curvature, monotonicity, onset layer, and related statistics from the cross-layer projection sequence and classifies it with a 288-parameter MLP. \herald{} stores one $d$-dimensional direction per layer ($262$\,KB for a 32-layer, $d{=}4096$ model), requires no gradient computation during training, and adds only $2.6{\times}10^{-6}$ prefill FLOPs at inference. Across eight prompt-harmfulness benchmarks and four model families, \herald{} achieves an average F1 of $89.3$ on OLMo2-7B, surpassing all tested guard models on adversarial jailbreak detection ($98.4$ vs.\ $96.9$ F1) and outperforming prior latent-based methods by $2.3$-$4.1$ F1 points on every backbone. Per-instance trajectories provide machine-readable audit records that reveal \emph{when} and \emph{how} harmfulness emerges, offering an interpretability advantage over single-layer approaches.

Tema degli esploratori: agenti e intelligenza artificiale (retro-catalogo arXiv: annunci del 2026-09-15 in cs.CL).
Categorie arXiv: Computation and Language (cs.CL).
Pagina del lavoro: https://arxiv.org/abs/2609.13534 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-15T22:51:09.824Z dalla pagina https://arxiv.org/catchup/cs.CL/2026-09-15?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).