mlsanityData to 14 Oct 2026

Layerwise Convergence Fingerprints for Runtime Misbehavior Detection in Large Language Models

arXiv 2604.24542 ↗First posted 27 Apr 2026cs.CR cs.AI cs.CLcited by 1

On the map: LLM alignment / RLHF / preference optimisation → Safety alignment and jailbreak attacks

also in 1 more
Abstract (arXiv)

Large language models deployed at runtime can misbehave in ways that clean-data validation cannot anticipate: training-time backdoors lie dormant until triggered, jailbreaks subvert safety alignment, and prompt injections override the deployer's instructions. Existing runtime defenses address these threats one at a time and often assume a clean reference model, trigger knowledge, or editable weights, assumptions that rarely hold for opaque third-party artifacts. We introduce Layerwise Convergence Fingerprinting (LCF), a tuning-free runtime monitor that treats the inter-layer hidden-state trajectory as a health signal: LCF computes a diagonal Mahalanobis distance on every inter-layer difference, aggregates via Ledoit-Wolf shrinkage, and thresholds via leave-one-out calibration on 200 clean examples, with no reference model, trigger knowledge, or retraining. Evaluated on four architectures (Llama-3-8B, Qwen2.5-7B, Gemma-2-9B, Qwen2.5-14B) across backdoors, jailbreaks, and prompt injection (56 backdoor combinations, 3 jailbreak techniques, and BIPIA email + code-QA), LCF reduces mean backdoor attack success rate (ASR) below 1% on Qwen2.5-7B and Gemma-2 and to 1.3% on Qwen2.5-14B, detects 92-100% of DAN jailbreaks (62-100% for GCG and softer role-play), and flags 100% of text-payload injections across all eight (model, domain) cells, at 12-16% backdoor FPR and <0.1% inference overhead. A single aggregation score covers all three threat families without threat-specific tuning, positioning LCF as a general-purpose runtime safety layer for cloud-served and on-device LLMs.

Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Placed in Safety alignment and jailbreak attacks, one of 10 directions in LLM alignment / RLHF / preference optimisation. Builds on 29 of its 34 references that are in the map. First posted on arXiv 27 Apr 2026.

Builds on

29 of 34 references.

Closest ancestors · 1

Same direction, newest first

  1. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul

Other references · 28

  1. 2021TruthfulQA: Measuring How Models Mimic Human Falsehoodscited by 2,975
  2. 2023Inference-Time Intervention: Eliciting Truthful Answers from a Language Modelcited by 1,302
  3. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
  4. 2023Eliciting Latent Predictions from Transformers with the Tuned Lenscited by 623
  5. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 580
  6. 2018Spectral Signatures in Backdoor Attackscited by 484
  7. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 459
  8. 2023DoLa: Decoding by Contrasting Layers Improves Factuality in Large Language Modelscited by 376
  9. 2023Poisoning Language Models During Instruction Tuningcited by 269
  10. 2023Benchmarking and Defending Against Indirect Prompt Injection Attacks on Large Language Modelscited by 264
  11. 2020ONION: A Simple and Effective Defense Against Textual Backdoor Attackscited by 263
  12. 2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Triggercited by 222
16 more
  1. 2021Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfercited by 158
  2. 2023Backdooring Instruction-Tuned Large Language Models with Virtual Prompt Injectioncited by 157
  3. 2021SPECTRE: Defending Against Backdoor Attacks Using Robust Statisticscited by 130
  4. 2024Not All Layers of LLMs Are Necessary During Inferencecited by 96
  5. 2024Transformers represent belief state geometry in their residual streamcited by 77
  6. 2024BackdoorLLM: A Comprehensive Benchmark for Backdoor Attacks and Defenses on Large Language Modelscited by 50
  7. 2024Tracing Representation Progression: Analyzing and Enhancing Layer-Wise Similaritycited by 36
  8. 2024CROW: Eliminating Backdoors from Large Language Models via Internal Consistency Regularizationcited by 33
  9. 2024PURE: Turning Polysemantic Neurons Into Pure Features by Identifying Relevant Circuitscited by 29
  10. 2024CleanGen: Mitigating Backdoor Attacks for Generation Tasks in Large Language Modelscited by 24
  11. 2024BadActs: A Universal Backdoor Defense in the Activation Spacecited by 21
  12. 2024LLMScan: Causal Scan for LLM Misbehavior Detectioncited by 13
  13. 2025Backdoor Attribution: Elucidating and Controlling Backdoor in Language Modelscited by 10
  14. 2025ConfGuard: A Simple and Effective Backdoor Detection for Large Language Modelscited by 9
  15. 2025Exposing the Ghost in the Transformer: Abnormal Detection for Large Language Models via Hidden State Forensicscited by 6
  16. 2025Mechanistic Exploration of Backdoored Large Language Model Attention Patternscited by 3

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 1.

1 paper.

  1. 2026Send a SCOUT First: Pre-hoc Reasoning for Adaptive Detector Allocation in Prompt-Injection Defensecited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Patcher: Post-Hoc Patching of Backdoored Large Language Models
  2. 2025SafeMERGE: Preserving Safety Alignment in Fine-Tuned Large Language Models via Selective Layer-Wise Model Merging
  3. 2024Jailbreak Antidote: Runtime Safety-Utility Balance via Sparse Representation Adjustment in Large Language Models
  4. 2026Continual Safety Alignment via Gradient-Based Sample Selection
  5. 2026Understanding and Preserving Safety in Fine-Tuned LLMs
  6. 2026HyperSafe: Inference-Time Safety Recovery for Fine-Tuned Language Models
  7. 2026PRISM: Transfer and Limits of Activation Interventions in Tool-Calling Language Models
  8. 2025SABER: Uncovering Vulnerabilities in Safety Alignment via Cross-Layer Residual Connection