Safety Beyond the Interface: Detecting Harm via Latent States in Large Language Models
Alizishaan Khatri, Chiquita Prabhu, Omkar Neogi
cs.AI · cs.CL · cs.CR · cs.LG
Quick verdict
12.6M-param MLP probes on LLaMA-3.1-8B hidden states detect harmful prompts (F1 99/83/84); promising, but only vanilla prompts tested, no baselines.
Summary
The paper asks whether an LLM's internal states already encode enough signal to detect harmful prompts without external guard models. The authors extract final-layer hidden states from frozen LLaMA-3.1-8B via last-token pooling and train a 6-layer MLP classifier (12.6M parameters, ~0.16% of the base model) for binary harm classification. On three public benchmarks the probes reach 99.1% F1 on the vanilla (non-adversarial) subset of WildJailbreak, 82.7% on BeaverTails, and 83.5% on AEGIS 2.0 — per Table III competitive with 7B guard models such as WildGuard (84.4/81.9) at far lower cost, though below BeaverDam (89.9) and GPT-4 (86.1) on BeaverTails. The discussion frames probes as cheaper (claimed sub-millisecond latency), capable of early termination, and information-advantaged because they observe internal states a black-box attacker cannot manipulate. The main limitations are self-acknowledged: only LLaMA-3.1-8B, only final-layer activations, binary labels, and — critically — adversarial WildJailbreak data was excluded, so the adversarial threat model motivating the paper (Section II-C) is never actually tested. There are also no ablations (layers, pooling), no simple baselines (e.g., logistic regression or text-embedding classifiers), no variance estimates, and no code release is mentioned.
Review complete
Assessment at a glance
6
risk flags identified
● high 1
● medium 4
● low 1
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Final-layer hidden states of LLaMA-3.1-8B encode harmful-prompt information separably enough that a 12.6M-parameter MLP reaches 99.1/82.7/83.5 F1 on WildJailbreak (vanilla), BeaverTails and AEGIS 2.0.
- These probes are competitive with 7B-scale external guard models at a tiny fraction of the parameters, latency and compute.
- Probe-based detection runs concurrently with generation (claimed <1 ms) and enables early termination, unlike sequential external guardrails.
- Latent-state detection gives defenders an informational advantage structurally inaccessible to black-box adversaries.
Strengths
Fully specified, reimplementable pipeline
Algorithm 1 plus Table I give the exact architecture (4096→2048→2048→512→512→64→2, GELU+dropout), optimizer (AdamW, lr 2.5e-4, batch 1024, 50 epochs) and pooling scheme; all three datasets are public.
Multi-benchmark evaluation with full metric triplets
Table II reports precision, recall and F1 (not just accuracy) on three benchmarks with distinct label sources; abstract numbers match the tables exactly.
Candid scoping in methods and limitations
Genuine efficiency data point on AEGIS 2.0
Interesting defender-information framing
Weaknesses
Threat model is never actually tested
No baselines or ablations
Statistically thin reporting
Uneven comparison in Table III
Under-specified latency and label claims
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
The paper (arXiv 2609.19472) claims that a frozen LLaMA-3.1-8B already encodes enough signal in its final-layer hidden states to detect harmful prompts, and that a 12.6M-parameter MLP probe (0.16% of the base model) matches or beats 7B-scale external guard models at a fraction of the cost. Three claims carry the argument: (1) probe F1 of 99.1% / 82.7% / 83.5% on WildJailbreak (vanilla subset), BeaverTails and AEGIS 2.0 respectively (Table II); (2) probe latency is effectively free (claimed <1 ms vs 50–500 ms generation, Section V-B); and (3) latent-state detection gives defenders an informational advantage 'structurally inaccessible' to black-box adversaries (Sections II-C, V-B). Claim (3) is conceptual only — no attack experiments support it.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 6 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
Does this paper show that LLMs can detect jailbreak attacks?
No. The probes are evaluated only on non-adversarial ('vanilla') harmful prompts from WildJailbreak plus BeaverTails and AEGIS 2.0. Adversarial jailbreak prompts were explicitly excluded, and the paper lists adversarial robustness as future work, even though its threat model is framed around adversarial prompt injection.
How do these safety probes compare to guard models like Llama Guard in size and accuracy?
The MLP probes have 12.6M parameters — about 0.16% of LLaMA-3.1-8B and roughly 500× smaller than 7B guard models (the paper says '1000×+'). On AEGIS 2.0 the probe's 83.5% F1 exceeds reported WildGuard (81.9) and LlamaGuard3 (77.3) numbers; on BeaverTails (82.7) it trails BeaverDam (89.9), MD-Judge (86.7) and GPT-4 (86.1) but beats LlamaGuard2 (71.8).
Is code or data available for this paper?
The paper does not mention a code or data release. All three benchmarks (WildJailbreak, BeaverTails, AEGIS 2.0) are public, and the full architecture and hyperparameters are specified, so independent reimplementation is feasible, though several preprocessing details are under-specified.
Why is the F1 so much higher on WildJailbreak (99%) than on the other datasets (83–84%)?
The WildJailbreak results use only its vanilla (non-adversarial) subset of straightforward harmful/benign requests, which appears much easier to separate than BeaverTails' response-level labels or AEGIS 2.0's multi-turn conversations. The paper provides no baselines or error analysis to explain the gap, which is one of the review's noted weaknesses.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figures appear only as captions in the extracted text; their content could not be verified.
- No appendix is visible in the extraction; some details (dropout rates, per-dataset test sizes, random seeds) may exist but were not extractable.
- Table III numbers are as cited by the paper from third-party sources and were not independently checked.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.