Abstract:Final-token safety probes monitor a single hidden state after prompt prefill, but jailbreak prompts can contain probe-visible unsafe evidence distributed across earlier user-token representations that is missed by this readout. We study this prefill-time failure mode using SafeSwitch-style probes trained only on clean harmful and benign prompts across three instruction-tuned LLMs. The probes achieve high recall on clean harmful prompts, but miss many jailbreaks and can produce false positives on safety-adjacent benign prompts. Subspace analyses suggest that missed jailbreaks differ from clean benign prompts along directions that are poorly captured by the probe's representational subspace, and increasing probe bottleneck width does not reliably resolve this mismatch. Token-level prefill analyses reveal that probe-visible unsafe evidence often appears earlier in the sequence but is not exposed at the final-token readout, while naive max-pooling over token positions overfires on safe prompts. A simple PCA-HMM trajectory model, trained only on the same clean split, recovers many final-token misses from user-content prefill trajectories without the catastrophic false-positive behavior of naive token pooling, motivating trajectory-aware hidden-state analyses as diagnostic complements to final-token probes
| Comments: | 8 pages, 2 figures, 7 tables |
| Subjects: | Machine Learning (cs.LG) |
| ACM classes: | I.2.7; I.2.6; K.6.5 |
| Cite as: | arXiv:2605.12726 [cs.LG] |
| (or arXiv:2605.12726v1 [cs.LG] for this version) | |
| https://doi.org/10.48550/arXiv.2605.12726 arXiv-issued DOI via DataCite (pending registration) |
From: Shravan Doda [view email]
[v1]
Tue, 12 May 2026 20:30:24 UTC (75 KB)
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。