Detecting Harmful Prompts from Latent States in Large Language Models

Summary

The paper investigates whether a large language model's internal representations already contain signals that indicate when a prompt is harmful, potentially reducing the latency and compute overhead of external safety guardrails. The authors extract activations from LLaMA-3.1-8B and train lightweight multilayer perceptron probes with 12.6 million parameters. The probes are evaluated on the WildJailbreak, Beavertails, and AEGIS 2.0 datasets. They achieve F1 scores of 99%, 83%, and 84%, respectively. According to the paper, these results are competitive with guard models that are 1,000 times larger. The study presents latent-state detection as a way to narrow the assurance gap created when external guard models cannot observe the protected model's internal workings, while also lowering latency and compute costs for resource-constrained or time-critical deployments.