{"slug": "harmfulness-propagation-dynamics-layer-wise-trajectories-of-adversarial-intent", "title": "Harmfulness Propagation Dynamics: Layer-wise Trajectories of Adversarial Intent in Large Language Models", "summary": "Researchers identified Harmfulness Propagation Dynamics (HPD), a cross-layer signature in which the projection of the last-token hidden state onto a learned harm direction rises monotonically with transformer depth for harmful prompts while benign prompts stay flat or oscillatory, according to an arXiv paper (arXiv:2609.13534v1). Building on HPD, the authors introduced HERALD (Harmful Encoding Recognition via Activation Layer Dynamics), a 288-parameter MLP moderator that stores one d-dimensional direction per layer (262 KB for a 32-layer, d=4096 model), adds only 2.6×10⁻⁶ prefill FLOPs at inference, and requires no gradient computation during training. Across eight prompt-harmfulness benchmarks and four model families, HERALD reached an average F1 of 89.3 on OLMo2-7B, beating all tested guard models on adversarial jailbreak detection (98.4 vs. 96.9 F1) and outperforming prior latent-based methods by 2.3–4.1 F1 points on every backbone.", "body_md": "arXiv:2609.13534v1 Announce Type: new \nAbstract: We identify \\textbf{Harmfulness Propagation Dynamics (HPD)}: for harmful prompts, the projection of the last-token hidden state onto a learned harm direction rises monotonically with transformer depth, whereas benign prompts remain flat or oscillatory. This cross-layer signature reflects harmful intent as a \\emph{progressively resolved} semantic property: surface form appears early, while pragmatic intent consolidates later, making the \\emph{trajectory shape} more informative than any single-layer snapshot. Moreover, LDA-based harm directions, learned per layer, remain stable across random splits (pairwise cosine similarity $>0.97$), supporting the projection sequence as a reproducible structured signal. Building on HPD, we introduce \\textbf{\\herald{}} (\\textbf{H}armful \\textbf{E}ncoding \\textbf{R}ecognition via \\textbf{A}ctivation \\textbf{L}ayer \\textbf{D}ynamics). This lightweight input moderator extracts a seven-dimensional feature record, slope, curvature, monotonicity, onset layer, and related statistics from the cross-layer projection sequence and classifies it with a 288-parameter MLP. \\herald{} stores one $d$-dimensional direction per layer ($262$\\,KB for a 32-layer, $d{=}4096$ model), requires no gradient computation during training, and adds only $2.6{\\times}10^{-6}$ prefill FLOPs at inference. Across eight prompt-harmfulness benchmarks and four model families, \\herald{} achieves an average F1 of $89.3$ on OLMo2-7B, surpassing all tested guard models on adversarial jailbreak detection ($98.4$ vs.\\ $96.9$ F1) and outperforming prior latent-based methods by $2.3$-$4.1$ F1 points on every backbone. Per-instance trajectories provide machine-readable audit records that reveal \\emph{when} and \\emph{how} harmfulness emerges, offering an interpretability advantage over single-layer approaches.", "url": "https://wpnews.pro/news/harmfulness-propagation-dynamics-layer-wise-trajectories-of-adversarial-intent", "canonical_source": "https://arxiv.org/abs/2609.13534", "published_at": "2026-09-15 04:00:00+00:00", "updated_at": "2026-09-15 04:32:19.295089+00:00", "lang": "en", "topics": ["ai-safety", "large-language-models", "ai-research", "machine-learning"], "entities": ["Harmfulness Propagation Dynamics", "HERALD", "OLMo2-7B", "arXiv"], "alternates": {"html": "https://wpnews.pro/news/harmfulness-propagation-dynamics-layer-wise-trajectories-of-adversarial-intent", "markdown": "https://wpnews.pro/news/harmfulness-propagation-dynamics-layer-wise-trajectories-of-adversarial-intent.md", "text": "https://wpnews.pro/news/harmfulness-propagation-dynamics-layer-wise-trajectories-of-adversarial-intent.txt", "jsonld": "https://wpnews.pro/news/harmfulness-propagation-dynamics-layer-wise-trajectories-of-adversarial-intent.jsonld"}}