# The Entanglement Wall: Activation-Space Probes as Risk Detectors, Not Context Adjudicators arXiv: https://arxiv.org/abs/2607.13075 ยท HTML: https://mlsanity.com/paper/2607.13075/ ## Key facts - Cited by 2 papers in the map (data through 14 Oct 2026). - Placed in Safety alignment, refusal and guardrails, one of 12 directions in LLM safety and security. - Builds on 44 of its 62 references that are in the map. - First posted on arXiv 12 Jul 2026. ## Placed in - LLM safety and security / [Safety alignment, refusal and guardrails](https://mlsanity.com/safety/safety-alignment-refusal-and-guardrails/) ## Builds on (most cited first, 30 of 44) - [The Llama 3 Herd of Models](https://mlsanity.com/paper/2407.21783/) (2024) - [Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena](https://mlsanity.com/paper/2306.05685/) (2023) - [Qwen2.5 Technical Report](https://mlsanity.com/paper/2412.15115/) (2024) - [Mistral 7B](https://mlsanity.com/paper/2310.06825/) (2023) - [Universal and Transferable Adversarial Attacks on Aligned Language Models](https://mlsanity.com/paper/2307.15043/) (2023) - [MiniLM: Deep Self-Attention Distillation for Task-Agnostic Compression of Pre-Trained Transformers](https://mlsanity.com/paper/2002.10957/) (2020) - [Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection](https://mlsanity.com/paper/2302.12173/) (2023) - [HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal](https://mlsanity.com/paper/2402.04249/) (2024) - [Representation Engineering: A Top-Down Approach to AI Transparency](https://mlsanity.com/paper/2310.01405/) (2023) - [Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations](https://mlsanity.com/paper/2312.06674/) (2023) - [Refusal in Language Models Is Mediated by a Single Direction](https://mlsanity.com/paper/2406.11717/) (2024) - [JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models](https://mlsanity.com/paper/2404.01318/) (2024) - [XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Models](https://mlsanity.com/paper/2308.01263/) (2023) - [WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMs](https://mlsanity.com/paper/2406.18495/) (2024) - [Learning the Difference that Makes a Difference with Counterfactually-Augmented Data](https://mlsanity.com/paper/1909.12434/) (2019) - [A StrongREJECT for Empty Jailbreaks](https://mlsanity.com/paper/2402.10260/) (2024) - [Defeating Prompt Injections by Design](https://mlsanity.com/paper/2503.18813/) (2025) - [OR-Bench: An Over-Refusal Benchmark for Large Language Models](https://mlsanity.com/paper/2405.20947/) (2024) - [ShieldGemma: Generative AI Content Moderation Based on Gemma](https://mlsanity.com/paper/2407.21772/) (2024) - [WildTeaming at Scale: From In-the-Wild Jailbreaks to (Adversarially) Safer Language Models](https://mlsanity.com/paper/2406.18510/) (2024) - [With Little Power Comes Great Responsibility](https://mlsanity.com/paper/2010.06595/) (2020) - [The Geometry of Refusal in Large Language Models: Concept Cones and Representational Independence](https://mlsanity.com/paper/2502.17420/) (2025) - [An Interpretability Illusion for BERT](https://mlsanity.com/paper/2104.07143/) (2021) - [LLMs Encode Harmfulness and Refusal Separately](https://mlsanity.com/paper/2507.11878/) (2025) - [Detecting High-Stakes Interactions with Activation Probes](https://mlsanity.com/paper/2506.10805/) (2025) - [Building Production-Ready Probes For Gemini](https://mlsanity.com/paper/2601.11516/) (2026) - [Probing Classifiers are Unreliable for Concept Removal and Detection](https://mlsanity.com/paper/2207.04153/) (2022) - [Automatic Pseudo-Harmful Prompt Generation for Evaluating False Refusals in Large Language Models](https://mlsanity.com/paper/2409.00598/) (2024) - [There Is More to Refusal in Large Language Models than a Single Direction](https://mlsanity.com/paper/2602.02132/) (2026) - [On Calibration of LLM-based Guard Models for Reliable Content Moderation](https://mlsanity.com/paper/2410.10414/) (2024) ## Built on by (most cited first, 2 of 2) - [What Do Compliance Detectors Read? An Audit of Activation Probes and Guard Models](https://mlsanity.com/paper/2608.16852/) (2026) - [Hard Negatives Reveal What Easy Negatives Hide: Cross-Lingual Harmfulness Representations Degrade with Resource Tier Under Hard Negatives](https://mlsanity.com/paper/2609.27758/) (2026) ## Abstract (arXiv) An activation-based safety gate must distinguish harmful assistance from legitimate work on the same topic. We test whether probes trained on broad harmful-versus-harmless data provide this decision boundary. Five checkpoint-specific readouts and their source-derived thresholds are transferred unchanged to four matched-pair cohorts containing 450 pairs, manually reviewed for topic and request-frame similarity. On Twin-70, the primary cohort of 70 pairs, central harmful and harmless score intervals overlap. Area under the receiver operating characteristic curve (AUROC) falls from 0.996-0.999 on the broad source task to 0.701-0.860. Pair ranking remains 0.829-0.929, but the transferred thresholds detect 0.943-1.000 of harmful requests while falsely blocking 0.686-0.986 of matched harmless requests. False blocking remains low on XSTest. Even with thresholds refitted within pair-grouped cross-validation, balanced threshold error is 0.229-0.329. Alternative source-trained logistic, radial-basis, and shallow multilayer probes reduce false blocking but detect only 0.200-0.671 of harmful requests at their transferred thresholds. Three primary readouts meet all prespecified Wall criteria, while two yield mixed evidence. Matched-label training recovers the distinction for the three checkpoints tested, and lexical controls also exhibit transfer loss. An automated post-freeze audit finds little numerical sensitivity to arm-label disagreement. The evaluated source operating points fail to combine strong harmful-request detection with access for legitimate same-topic work. This gap between risk ranking and a usable decision boundary is the security concern captured by the Entanglement Wall.