Harmfulness Propagation Dynamics: Layer-wise Trajectories of Adversarial Intent in Large Language Models

• URL: http://arxiv.org/abs/2609.13534v1
• Date: Fri, 11 Sep 2026 21:04:55 GMT
• Title: Harmfulness Propagation Dynamics: Layer-wise Trajectories of Adversarial Intent in Large Language Models
• Abstract summary: textbfherald (textbfEncoding textbfRecognition via textbfActivation textbfLayer textbfDynamics)<n>textbfherald (textbfHarmful textbfEncoding textbfRecognition via textbfActivation textbfLayer textbfDynamics)<n>
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: We identify \textbf{Harmfulness Propagation Dynamics (HPD)}: for harmful prompts, the projection of the last-token hidden state onto a learned harm direction rises monotonically with transformer depth, whereas benign prompts remain flat or oscillatory. This cross-layer signature reflects harmful intent as a \emph{progressively resolved} semantic property: surface form appears early, while pragmatic intent consolidates later, making the \emph{trajectory shape} more informative than any single-layer snapshot. Moreover, LDA-based harm directions, learned per layer, remain stable across random splits (pairwise cosine similarity $>0.97$), supporting the projection sequence as a reproducible structured signal. Building on HPD, we introduce \textbf{\herald{}} (\textbf{H}armful \textbf{E}ncoding \textbf{R}ecognition via \textbf{A}ctivation \textbf{L}ayer \textbf{D}ynamics). This lightweight input moderator extracts a seven-dimensional feature record, slope, curvature, monotonicity, onset layer, and related statistics from the cross-layer projection sequence and classifies it with a 288-parameter MLP. \herald{} stores one $d$-dimensional direction per layer ($262$\,KB for a 32-layer, $d{=}4096$ model), requires no gradient computation during training, and adds only $2.6{\times}10^{-6}$ prefill FLOPs at inference. Across eight prompt-harmfulness benchmarks and four model families, \herald{} achieves an average F1 of $89.3$ on OLMo2-7B, surpassing all tested guard models on adversarial jailbreak detection ($98.4$ vs.\ $96.9$ F1) and outperforming prior latent-based methods by $2.3$-$4.1$ F1 points on every backbone. Per-instance trajectories provide machine-readable audit records that reveal \emph{when} and \emph{how} harmfulness emerges, offering an interpretability advantage over single-layer approaches.

Related papers

• Round-Trip Consistency: Bidirectional Diffusion Models Can Predict Their Own Rollout Errors [51.56484100374058]
  Autoregressive models accumulate error over long rollouts, yet at deployment there is no ground truth to measure it against.<n>We train a single conditional latent diffusion model that steps a dynamical system forward or backward in time via a direction flag.<n>We show that this bidirectionality supplies a measurement-free test-time error signal.
  arXiv  Detail & Related papers  (2026-08-01T13:49:46Z)
• The Multiscale Single-Index Model: A Stylized Model for Hierarchical Feature Learning [33.59654714700262]
  We consider the Multiscale Single-Index Model (MSIM) as a stylized model for hierarchical learning with emphscale separation.<n>We perform a fine-grained analysis of the chaos using Wiener Edgeworth expansions.<n>We prove that online SGD on the correlation objective, where all layers evolve in the same timescale, $1 - o_d(1)$ recovery with $n = widetildeO( dK-1)$ samples, recovering the same sample complexity as in the linear counterpart.
  arXiv  Detail & Related papers  (2026-07-03T14:02:42Z)
• CaricHarmony: Contrastive Diffusion Paths for Identity-Preserving Caricature Synthesis [49.596677723190886]
  Sketch-based caricature synthesis suffers from a fundamental failure mode.<n>Identity and shape conditions are combined in diffusion models, causing collapse toward bland portraits or unrecognizable distortions.<n>We present CaricHarmony, the first training-free method that explicitly resolves this contamination through parallel uncontaminated diffusion paths.
  arXiv  Detail & Related papers  (2026-06-11T22:57:59Z)
• Extra-Merge: Tracing the Rank-1 Subspace of Model Merging in Language Model Pre-Training [56.323119575322146]
  Extra-Merge consistently outperforms standard merging baselines in experiments across GPT-2 and LLaMA families.<n>It yields consistent zero-shot accuracy gains on Pythia-12B downstream tasks and generalizes effectively to the Muon citepjordan2024muon.
  arXiv  Detail & Related papers  (2026-05-26T02:48:34Z)
• When Do LLM Agents Treat Surface Noise Differently from Semantic Noise? A 68-Cell Measurement Study with a Held-Out Trace-Level Validation [9.055086193088083]
  We document an empirical phenomenon in chain-of-thought and ReAct agents driven by ten large language models.<n>Mean-bearing perturbations alter final answers more often than presentation perturbations of comparable severity.
  arXiv  Detail & Related papers  (2026-05-25T15:57:11Z)
• One Token Away from Collapse: The Fragility of Instruction-Tuned Helpfulness [12.183451602438753]
  We show that simple lexical constraints (banning a single punctuation character or common word) cause instruction-tuned LLMs to collapse their responses.<n>We show that base models show no systematic collapse under identical constraints, with effects that are small, noisy, and bidirectional.
  arXiv  Detail & Related papers  (2026-04-14T17:40:01Z)
• The Spectral Geometry of Thought: Phase Transitions, Instruction Reversal, Token-Level Dynamics, and Perfect Correctness Prediction in How Transformers Reason [4.28787537081191]
  We find that large language models exhibit emphspectral phase transitions in their hidden activation spaces when engaging in reasoning versus factual recall.<n>We establish a comprehensive emphspectral theory of reasoning in transformers, revealing that the geometry of thought is universal in direction, architecture-specific, and predictive of outcome.
  arXiv  Detail & Related papers  (2026-04-03T09:18:57Z)
• Learning Accurate Segmentation Purely from Self-Supervision [87.78965637247107]
  Selfment is a fully self-supervised framework that segments objects directly from raw images without human labels.<n>Selfment sets new state-of-the-art (SoTA) results across multiple benchmarks.
  arXiv  Detail & Related papers  (2026-02-27T07:36:32Z)
• Learning to Forget Attention: Memory Consolidation for Adaptive Compute Reduction [6.908972852063454]
  Hybrid architectures combining state-space models with attention have achieved strong efficiency-quality tradeoffs.<n>We present a surprising finding from analyzing GPT-2 models: textbf88% of attention operations retrieve information already predictable from the model's hidden state.<n>We introduce textbfours (textbfConsolidation-based textbfRouting for textbfAdaptive textbfMemory), a biologically inspired memory consolidation mechanism that gradually distills episodic retrievals into parametric semantic memory
  arXiv  Detail & Related papers  (2026-02-12T17:40:15Z)
• Grokking and Generalization Collapse: Insights from \texttt{HTSR} theory [4.371245698184159]
  We study the well-known grokking phenomena in neural networks (NNs) using a 3-layer trained on 1 k-sample subset of MNIST.<n>We discover a novel third phase -- emphanti-grokking -- that occurs very late in training and resembles but is distinct from the familiar emphpre-grokking phases.
  arXiv  Detail & Related papers  (2025-06-04T20:34:37Z)
• UniF$^2$ace: A Unified Fine-grained Face Understanding and Generation Model [62.66515621965686]
  We introduce a novel theoretical framework with a Dual Discrete Diffusion (D3Diff) loss, unifying masked generative models with discrete score matching diffusion.<n>This D3Diff significantly enhances the model's ability to synthesize high-fidelity facial details aligned with text input.<n>We construct UniF$2$aceD-1M, a large-scale dataset comprising 130K fine-grained image-caption pairs and 1M visual question-answering pairs.
  arXiv  Detail & Related papers  (2025-03-11T07:34:59Z)
• Toward Adversarial Robustness via Semi-supervised Robust Training [93.36310070269643]
  Adrial examples have been shown to be the severe threat to deep neural networks (DNNs) We propose a novel defense method, the robust training (RT), by jointly minimizing two separated risks ($R_stand$ and $R_rob$)
  arXiv  Detail & Related papers  (2020-03-16T02:14:08Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.