# False Sense of Security: Why Probing-based Malicious Input Detection Fails to Generalize

arXiv: https://arxiv.org/abs/2509.03888 · HTML: https://mlsanity.com/paper/2509.03888/

## Key facts

- Cited by 19 papers in the map (data through 14 Oct 2026).
- Builds on 27 of its 53 references that are in the map.
- First posted on arXiv 4 Sep 2025.

## Builds on (most cited first, 27 of 27)

- [Training language models to follow instructions with human feedback](https://mlsanity.com/paper/2203.02155/) (2022)
- [Direct Preference Optimization: Your Language Model is Secretly a Reward Model](https://mlsanity.com/paper/2305.18290/) (2023)
- [Universal and Transferable Adversarial Attacks on Aligned Language Models](https://mlsanity.com/paper/2307.15043/) (2023)
- [HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal](https://mlsanity.com/paper/2402.04249/) (2024)
- [BeaverTails: Towards Improved Safety Alignment of LLM via a Human-Preference Dataset](https://mlsanity.com/paper/2307.04657/) (2023)
- [Prompt Injection attack against LLM-integrated Applications](https://mlsanity.com/paper/2306.05499/) (2023)
- [Catastrophic Jailbreak of Open-source LLMs via Exploiting Generation](https://mlsanity.com/paper/2310.06987/) (2023)
- [Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrations](https://mlsanity.com/paper/2310.06387/) (2023)
- [Layer by Layer: Uncovering Hidden Representations in Language Models](https://mlsanity.com/paper/2502.02013/) (2025)
- [ShieldGemma: Generative AI Content Moderation Based on Gemma](https://mlsanity.com/paper/2407.21772/) (2024)
- [Poisoning Retrieval Corpora by Injecting Adversarial Passages](https://mlsanity.com/paper/2310.19156/) (2023)
- [Aegis2.0: A Diverse AI Safety Dataset and Risks Taxonomy for Alignment of LLM Guardrails](https://mlsanity.com/paper/2501.09004/) (2025)
- [A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deployment](https://mlsanity.com/paper/2504.15585/) (2025)
- [How Alignment and Jailbreak Work: Explain LLM Safety through Intermediate Hidden States](https://mlsanity.com/paper/2406.05644/) (2024)
- [The Geometry of Multilingual Language Model Representations](https://mlsanity.com/paper/2205.10964/) (2022)
- [How Large Language Models Encode Context Knowledge? A Layer-Wise Probing Study](https://mlsanity.com/paper/2402.16061/) (2024)
- [Towards Understanding Jailbreak Attacks in LLMs: A Representation Space Analysis](https://mlsanity.com/paper/2406.10794/) (2024)
- [Safety in Large Reasoning Models: A Survey](https://mlsanity.com/paper/2504.17704/) (2025)
- [Large Language Model Safety: A Holistic Survey](https://mlsanity.com/paper/2412.17686/) (2024)
- [Safety Arithmetic: A Framework for Test-time Safety Alignment of Language Models by Steering Parameters and Activations](https://mlsanity.com/paper/2406.11801/) (2024)
- [Probing Language Models for Pre-training Data Detection](https://mlsanity.com/paper/2406.01333/) (2024)
- [HSF: Defending against Jailbreak Attacks with Hidden State Filtering](https://mlsanity.com/paper/2409.03788/) (2024)
- [Con-ReCall: Detecting Pre-training Data in LLMs via Contrastive Decoding](https://mlsanity.com/paper/2409.03363/) (2024)
- [Quantized Delta Weight Is Safety Keeper](https://mlsanity.com/paper/2411.19530/) (2024)
- [FactCheckmate: Preemptively Detecting and Mitigating Hallucinations in LMs](https://mlsanity.com/paper/2410.02899/) (2024)
- [Tricking Retrievers with Influential Tokens: An Efficient Black-Box Corpus Poisoning Attack](https://mlsanity.com/paper/2503.21315/) (2025)
- [SafeSteer: Interpretable Safety Steering with Refusal-Evasion in LLMs](https://mlsanity.com/paper/2506.04250/) (2025)

## Built on by (most cited first, 19 of 19)

- [Rethinking Jailbreak Detection of Large Vision Language Models with Representational Contrastive Scoring](https://mlsanity.com/paper/2512.12069/) (2025)
- [Unified Defense for Large Language Models against Jailbreak and Fine-Tuning Attacks in Education](https://mlsanity.com/paper/2511.14423/) (2025)
- [Backdoors in RLVR: Jailbreak Backdoors in LLMs From Verifiable Reward](https://mlsanity.com/paper/2604.09748/) (2026)
- [LASA: Language-Agnostic Semantic Alignment at the Semantic Bottleneck for LLM Safety](https://mlsanity.com/paper/2604.12710/) (2026)
- [The Entanglement Wall: Activation-Space Probes as Risk Detectors, Not Context Adjudicators](https://mlsanity.com/paper/2607.13075/) (2026)
- [GAMBIT: A Gamified Jailbreak Framework for Multimodal Large Language Models](https://mlsanity.com/paper/2601.03416/) (2026)
- [Safeguards Based on Copyable Context Cannot Provide Reliable Safety for LLMs](https://mlsanity.com/paper/2607.27951/) (2026)
- [Fine-grained Verbal Attack Detection via a Hierarchical Divide-and-Conquer Framework](https://mlsanity.com/paper/2601.06907/) (2026)
- [RACC: Representation-Aware Coverage Criteria for LLM Safety Testing](https://mlsanity.com/paper/2602.02280/) (2026)
- [D2-Monitor: Dynamic Safety Monitoring for Diffusion LLMs via Hesitation Signals](https://mlsanity.com/paper/2605.25893/) (2026)
- [PRISM: Recovering Instruction Sets from Language Model Activations](https://mlsanity.com/paper/2606.09563/) (2026)
- [Regime-Conditional Verification: Correctness Estimation for Adapting and Monitoring Safety Classifiers](https://mlsanity.com/paper/2608.14089/) (2026)
- [Probing the Prefill: Detecting Code Vulnerabilities via Latent Activations](https://mlsanity.com/paper/2608.16970/) (2026)
- [Probe Generalization as Subspace Selection for OOD Deception Detection](https://mlsanity.com/paper/2609.02893/) (2026)
- [Safety Monitors Mostly Catch What the Model Already Refuses](https://mlsanity.com/paper/2609.05797/) (2026)
- [MechAudit-40: White-Box Auditing across 40 LLM Attack Mechanisms](https://mlsanity.com/paper/2609.06612/) (2026)
- [Prompted to Discriminate: Generalizing Malicious-Input Probes in the Wild](https://mlsanity.com/paper/2610.02413/) (2026)
- [From Probe Scores to Alarm Policies: Operational Validity of Activation Monitors for Language-Model Agents](https://mlsanity.com/paper/2610.04575/) (2026)
- [Cross-Model In-Context Neurofeedback Reveals (Limited) Activation Control in LLMs](https://mlsanity.com/paper/2610.20179/) (2026)

## Abstract (arXiv)

Large Language Models (LLMs) can comply with harmful instructions, raising serious safety concerns despite their impressive capabilities. Recent work has leveraged probing-based approaches to study the separability of malicious and benign inputs in LLMs' internal representations, and researchers have proposed using such probing methods for safety detection. We systematically re-examine this paradigm. Motivated by poor out-of-distribution performance, we hypothesize that probes learn superficial patterns rather than semantic harmfulness. Through controlled experiments, we confirm this hypothesis and identify the specific patterns learned: instructional patterns and trigger words. Our investigation follows a systematic approach, progressing from demonstrating comparable performance of simple n-gram methods, to controlled experiments with semantically cleaned datasets, to detailed analysis of pattern dependencies. These results reveal a false sense of security around current probing-based approaches and highlight the need to redesign both models and evaluation protocols, for which we provide further discussions in the hope of suggesting responsible further research in this direction. We have open-sourced the project at https://github.com/WangCheng0116/Why-Probe-Fails.