Harmfulness Propagation Dynamics: Layer-wise Trajectories of Adversarial Intent in Large Language Models
arXiv:2609.13534
Abstract
We identify \textbf{Harmfulness Propagation Dynamics (HPD)}: for harmful prompts, the projection of the last-token hidden state onto a learned harm direction rises monotonically with transformer depth, whereas benign prompts remain flat or oscillatory. This cross-layer signature reflects harmful intent as a \emph{progressively resolved} semantic property: surface form appears early, while pragmatic intent consolidates later, making the \emph{trajectory shape} more informative than any single-layer snapshot. Moreover, LDA-based harm directions, learned per layer, remain stable across random splits (pairwise cosine similarity ), supporting the projection sequence as a reproducible structured signal. Building on HPD, we introduce \textbf{\herald{}} (\textbf{H}armful \textbf{E}ncoding \textbf{R}ecognition via \textbf{A}ctivation \textbf{L}ayer \textbf{D}ynamics). This lightweight input moderator extracts a seven-dimensional feature record, slope, curvature, monotonicity, onset layer, and related statistics from the cross-layer projection sequence and classifies it with a 288-parameter MLP. \herald{} stores one -dimensional direction per layer (\,KB for a 32-layer, model), requires no gradient computation during training, and adds only prefill FLOPs at inference. Across eight prompt-harmfulness benchmarks and four model families, \herald{} achieves an average F1 of on OLMo2-7B, surpassing all tested guard models on adversarial jailbreak detection ( vs.\ F1) and outperforming prior latent-based methods by - F1 points on every backbone. Per-instance trajectories provide machine-readable audit records that reveal \emph{when} and \emph{how} harmfulness emerges, offering an interpretability advantage over single-layer approaches.
International Conference on Machine Learning (ICML) Workshop on Mechanistic Interpretability in 2026, accepted in South Korea. https://openreview.net/pdf?id=SGnAkwZ3VV