mlsanityData to 7 Oct 2026

The Entanglement Wall: Activation-Space Probes as Risk Detectors, Not Context Adjudicators

arXiv 2607.13075 ↗First posted 12 Jul 2026cs.CR cs.AI cs.LGcited by 2

On the map: LLM safety and security → Safety alignment, refusal and guardrails

Abstract (arXiv)

An activation-based safety gate must distinguish harmful assistance from legitimate work on the same topic. We test whether probes trained on broad harmful-versus-harmless data provide this decision boundary. Five checkpoint-specific readouts and their source-derived thresholds are transferred unchanged to four matched-pair cohorts containing 450 pairs, manually reviewed for topic and request-frame similarity. On Twin-70, the primary cohort of 70 pairs, central harmful and harmless score intervals overlap. Area under the receiver operating characteristic curve (AUROC) falls from 0.996-0.999 on the broad source task to 0.701-0.860. Pair ranking remains 0.829-0.929, but the transferred thresholds detect 0.943-1.000 of harmful requests while falsely blocking 0.686-0.986 of matched harmless requests. False blocking remains low on XSTest. Even with thresholds refitted within pair-grouped cross-validation, balanced threshold error is 0.229-0.329. Alternative source-trained logistic, radial-basis, and shallow multilayer probes reduce false blocking but detect only 0.200-0.671 of harmful requests at their transferred thresholds. Three primary readouts meet all prespecified Wall criteria, while two yield mixed evidence. Matched-label training recovers the distinction for the three checkpoints tested, and lexical controls also exhibit transfer loss. An automated post-freeze audit finds little numerical sensitivity to arm-label disagreement. The evaluated source operating points fail to combine strong harmful-request detection with access for legitimate same-topic work. This gap between risk ranking and a usable decision boundary is the security concern captured by the Entanglement Wall.

Key facts. Cited by 2 papers in the map (data through 7 Oct 2026). Placed in Safety alignment, refusal and guardrails, one of 12 directions in LLM safety and security. Builds on 44 of its 62 references that are in the map. First posted on arXiv 12 Jul 2026.

Builds on

44 of 62 references.

Closest ancestors · 11

Same direction, newest first

  1. 2026The Geometry of Harmful Intent: Training-Free Anomaly Detection via Angular Deviation in LLM Residual Streams28 Mar
  2. 2026On the Failure of Topic-Matched Contrast Baselines in Multi-Directional Refusal Abliteration23 Mar
  3. 2025SOM Directions are Better than One: Multi-Directional Refusal Suppression in Language Models11 Nov
  4. 2025Read the Scene, Not the Script: Outcome-Aware Safety for LLMs5 Oct
  5. 2025LLMs Encode Harmfulness and Refusal Separately16 Jul
  6. 2025The Geometry of Refusal in Large Language Models: Concept Cones and Representational Independence24 Feb
  7. 2024On Calibration of LLM-based Guard Models for Reliable Content Moderation14 Oct
  8. 2024Automatic Pseudo-Harmful Prompt Generation for Evaluating False Refusals in Large Language Models1 Sep
  9. 2024WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMs26 Jun
  10. 2024Refusal in Language Models Is Mediated by a Single Direction17 Jun
  11. 2024OR-Bench: An Over-Refusal Benchmark for Large Language Models31 May

Other references · 33

  1. 2024The Llama 3 Herd of Modelscited by 14,192
  2. 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,393
  3. 2024Qwen2.5 Technical Reportcited by 4,713
  4. 2023Mistral 7Bcited by 3,065
  5. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  6. 2020MiniLM: Deep Self-Attention Distillation for Task-Agnostic Compression of Pre-Trained Transformerscited by 1,414
  7. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,339
  8. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
  9. 2023Representation Engineering: A Top-Down Approach to AI Transparencycited by 1,239
  10. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,124
  11. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Modelscited by 494
  12. 2023XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Modelscited by 477
21 more
  1. 2019Learning the Difference that Makes a Difference with Counterfactually-Augmented Datacited by 428
  2. 2024A StrongREJECT for Empty Jailbreakscited by 352
  3. 2025Defeating Prompt Injections by Designcited by 256
  4. 2024ShieldGemma: Generative AI Content Moderation Based on Gemmacited by 224
  5. 2024WildTeaming at Scale: From In-the-Wild Jailbreaks to (Adversarially) Safer Language Modelscited by 206
  6. 2020With Little Power Comes Great Responsibilitycited by 138
  7. 2021An Interpretability Illusion for BERTcited by 94
  8. 2025Detecting High-Stakes Interactions with Activation Probescited by 45
  9. 2022Probing Classifiers are Unreliable for Concept Removal and Detectioncited by 40
  10. 2026Building Production-Ready Probes For Geminicited by 38
  11. 2026There Is More to Refusal in Large Language Models than a Single Directioncited by 22
  12. 2025False Sense of Security: Why Probing-based Malicious Input Detection Fails to Generalizecited by 15
  13. 2026When Benchmarks Lie: Evaluating Malicious Prompt Classifiers Under True Distribution Shiftcited by 8
  14. 2025The Geometry of Harmfulness in LLMs through Subconcept Probingcited by 7
  15. 2026Linear Probes Detect Task Format, Not Reasoning Mode in Language Model Hidden Statescited by 7
  16. 2025When Style Breaks Safety: Defending LLMs Against Superficial Style Alignmentcited by 6
  17. 2025LPASS: Linear Probes as Stepping Stones for vulnerability detection using compressed LLMscited by 4
  18. 2026Harmful Intent as a Geometrically Recoverable Feature of LLM Residual Streamscited by 4
  19. 2026Segment-Level Coherence for Robust Harmful Intent Probing in LLMscited by 3
  20. 2026RASET: Router-Agnostic Safety-Critical Expert Tuning Exposes Localized Safety Enforcement Failures in Mixture-of-Experts LLMscited by 2
  21. 2026OpenSafeIntent: Evaluating Intent-Calibrated Safe Completion Across Dual-Use Prompt Setscited by 2

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 2.

2 papers.

  1. 2026What Do Compliance Detectors Read? An Audit of Activation Probes and Guard Modelscited by 1
  2. 2026Hard Negatives Reveal What Easy Negatives Hide: Cross-Lingual Harmfulness Representations Degrade with Resource Tier Under Hard Negativescited by 0