Paper deep dive
The Geometry of Harmful Intent: Training-Free Anomaly Detection via Angular Deviation in LLM Residual Streams
Isaac Llorente-Saguer
Intelligence
Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 95%
Last extracted: 3/31/2026, 2:04:28 AM
Summary
LatentBiopsy is a training-free, zero-shot anomaly detection method for LLMs that identifies harmful prompts by measuring the angular deviation of residual-stream activations from a normative reference direction (the leading principal component of safe prompts). The method demonstrates that harmful intent is encoded as a distinct geometric structure that persists even after refusal-direction ablation, and it identifies a family-dependent ring orientation (inner vs. outer) that necessitates a direction-agnostic scoring rule.
Entities (5)
Relation Signals (4)
LatentBiopsy → detects → Harmful Intent
confidence 95% · LatentBiopsy detects harmful intent even in abliterated models
Abliteration → preserves → Harmful Intent Geometry
confidence 95% · geometry survives refusal ablation
Qwen3.5-0.8B → exhibits → Outer Ring Orientation
confidence 90% · harmful prompts occupy the outer ring in Qwen3.5-0.8B
Qwen2.5-0.5B → exhibits → Inner Ring Orientation
confidence 90% · harmful prompts occupy the inner ring in Qwen2.5-0.5B
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:We present LatentBiopsy, a training-free method for detecting harmful prompts by analysing the geometry of residual-stream activations in large language models. Given 200 safe normative prompts, LatentBiopsy computes the leading principal component of their activations at a target layer and characterises new prompts by their radial deviation angle $\theta$ from this reference direction. The anomaly score is the negative log-likelihood of $\theta$ under a Gaussian fit to the normative distribution, flagging deviations symmetrically regardless of orientation. No harmful examples are required for training. We evaluate two complete model triplets from the Qwen3.5-0.8B and Qwen2.5-0.5B families: base, instruction-tuned, and \emph{abliterated} (refusal direction surgically removed via orthogonalisation). Across all six variants, LatentBiopsy achieves AUROC $\geq$0.937 for harmful-vs-normative detection and AUROC = 1.000 for discriminating harmful from benign-aggressive prompts (XSTest), with sub-millisecond per-query overhead. Three empirical findings emerge. First, geometry survives refusal ablation: both abliterated variants achieve AUROC at most 0.015 below their instruction-tuned counterparts, establishing a geometric dissociation between harmful-intent representation and the downstream generative refusal mechanism. Second, harmful prompts exhibit a near-degenerate angular distribution ($\sigma_\theta \approx 0.03$ rad), an order of magnitude tighter than the normative distribution ($\sigma_\theta \approx 0.27$ rad), preserved across all alignment stages including abliteration. Third, the two families exhibit opposite ring orientations at the same depth: harmful prompts occupy the outer ring in Qwen3.5-0.8B but the inner ring in Qwen2.5-0.5B, directly motivating the direction-agnostic scoring rule.
Tags
Links
- Source: https://arxiv.org/abs/2603.27412v1
- Canonical: https://arxiv.org/abs/2603.27412v1
Trouble viewing inline? Open PDF directly →
Full Text
48,002 characters extracted from source content.
Expand or collapse full text
The Geometry of Harmful Intent: Training-Free Anomaly Detection via Angular Deviation in LLM Residual Streams Isaac Llorente-Saguer Independent Researcher illorentes@proton.me Abstract We present LatentBiopsy, a training-free method for detecting harmful prompts by analysing the geometry of residual-stream activations in large language models. Given 200 safe normative prompts, LatentBiopsy computes the leading principal component of their activations at a target layer and characterises new prompts by their radial deviation angle θ from this reference direction. The anomaly score is the negative log-likelihood of θ under a Gaussian fit to the normative distribution, flagging deviations symmetrically regardless of orientation. No harmful examples are required for training. We evaluate two complete model triplets from the Qwen3.5-0.8B and Qwen2.5-0.5B families: base, instruction-tuned, and abliterated (refusal direction surgically removed via orthogonalisation). Across all six variants, LatentBiopsy achieves AUROC ≥ 0.937 for harmful-vs-normative detection and AUROC ==1.000 for discriminating harmful from benign-aggressive prompts (XSTest), with sub-millisecond per-query overhead. Three empirical findings emerge. First, geometry survives refusal ablation: both abliterated variants achieve AUROC at most 0.015 below their instruction-tuned counterparts, establishing a geometric dissociation between harmful-intent representation and the downstream generative refusal mechanism. Second, harmful prompts exhibit a near-degenerate angular distribution (σθ≈0.03 _θ≈ 0.03 rad), an order of magnitude tighter than the normative distribution (σθ≈0.27 _θ≈ 0.27 rad), preserved across all alignment stages including abliteration. Third, the two families exhibit opposite ring orientations at the same depth: harmful prompts occupy the outer ring in Qwen3.5-0.8B but the inner ring in Qwen2.5-0.5B, directly motivating the direction-agnostic scoring rule. 1 Introduction Detecting harmful prompts before model response generation is a prerequisite for safe deployment of large language models. Existing methods divide into two broad families. Input-space filters based on perplexity (Jain et al., 2023; Alon and Kamfonas, 2023) are effective against adversarial suffix attacks but fail on semantically fluent jailbreaks. Supervised safety classifiers such as Llama Guard (Inan et al., 2023) achieve strong performance but require large curated datasets of harmful and harmless pairs, and per-model retraining whenever the target model changes. A parallel body of work in representation engineering has established that residual streams encode semantic content as geometric structure (Zou et al., 2023a). Linear directions for safety concepts have been extracted from contrastive safe/harmful pairs (Zou et al., 2023a; Li et al., 2023), and PCA of hidden states has been shown to separate harmful from harmless queries when safety-prompt manipulations define the reference (Zheng et al., 2024). Crucially, Arditi et al. (2024) demonstrated that refusal behaviour in aligned models is mediated by a single linear direction in the residual stream, and that orthogonalising this direction renders the model unable to refuse. These methods share a common dependency: they require harmful examples or deliberate safety-prompt manipulations to define the reference geometry. We ask whether the safe distribution alone defines a reference geometry from which harmful prompts deviate detectably. We answer affirmatively, and report a finding that sharpens the safety implications: LatentBiopsy detects harmful intent even in abliterated models that are constitutionally incapable of producing refusals. The model’s internal encoding of harmful semantic intent is geometrically distinct from the circuits that generate refusal text. Harm recognition and refusal generation are separable mechanisms. The practical consequence is direct: stripping a model’s refusal behaviour does not erase the latent signal available to an external detector. A secondary finding concerns the structure of the deviation itself. The two tested model families exhibit opposite ring orientations at the same residual-stream depth; harmful prompts are more angular from PC1 in Qwen3.5-0.8B and more aligned with PC1 in Qwen2.5-0.5B. This family-level reversal, together with known layer-level reversal within each model, establishes that a fixed directional threshold on θ is architecturally unreliable and motivates the symmetric anomaly score. Contributions. 1. Training-free angular anomaly detector. LatentBiopsy builds a normative reference exclusively from 200 safe activations and scores every prompt by the negative log-likelihood of its angular deviation θ from the leading normative principal component. The score is symmetric around the normative mean, requiring no knowledge of the ring direction and no harmful data. 2. Geometry survives refusal ablation in both tested model families. Abliterated variants of both Qwen3.5-0.8B and Qwen2.5-0.5B achieve AUROC h/b =1.000=1.000 and AUROC h/n within 0.015 of their instruction-tuned counterparts, establishing a geometric dissociation between harmful-intent representation and the refusal mechanism across two independent model families. 3. Opposite ring orientations across families. At layer 20, Qwen3.5-0.8B places harmful prompts at mean θ≈1.80θ≈ 1.80 rad vs. normative μ0≈1.17 _0≈ 1.17 rad (outer ring), while Qwen2.5-0.5B places harmful prompts at mean θ≈1.34θ≈ 1.34 rad vs. normative μ0≈1.82 _0≈ 1.82 rad (inner ring). The anomaly score s(x)s(x) correctly identifies both configurations without architectural knowledge. 4. Near-degenerate harmful compactness and K=1K=1 sufficiency. Harmful prompts occupy a near-degenerate angular cluster (σθharm≈0.03 _θ^harm≈ 0.03–0.050.05 rad, one order of magnitude tighter than σθnorm _θ^norm), and a single reference direction (K=1K=1) dominates multi-directional baselines at every layer in every model. 2 Related Work Input-space defences. Perplexity-based filters (Jain et al., 2023; Alon and Kamfonas, 2023) are computationally cheap and effective against adversarial suffix attacks, but rely on surface-form anomaly and cannot detect semantically fluent jailbreaks that score normally under any language model. Supervised safety classifiers. Llama Guard (Inan et al., 2023) and its successors fine-tune a language model on large labelled datasets of safe and harmful pairs, achieving strong per-category precision. The approach requires curated harmful data and per-model retraining, making it expensive to adapt to new architectures or harm taxonomies. Representation engineering and linear probes. Zou et al. (2023a) extract linear control directions from contrastive safe/harmful pairs and demonstrate that semantic intent is encoded as rich geometric structure in the residual stream. Li et al. (2023) fit linear probes on labelled activation data and intervene at inference time. Zheng et al. (2024) use optimised safety-prompt manipulations to visualise hidden-state separation and shift representations along a refusal direction. All three approaches require either labelled harmful examples or deliberate safety-prompt manipulations to define the reference; LatentBiopsy removes that dependency entirely. Refusal as a single linear direction. Arditi et al. (2024) show that refusal behaviour in aligned models is mediated by a single linear direction in the residual stream. LatentBiopsy provides independent quantitative support for the near-one-dimensional geometry (K=1K=1 dominance) while extending the picture: the safety representation that LatentBiopsy exploits is not the refusal direction itself, since it survives abliteration. Angular biomarkers. The theta biomarker concept was introduced for medical diagnostics to flag anomalous patient profiles via angular deviation in a clinical feature space (Llorente-Saguer et al., 2025). LatentBiopsy translates this geometric principle to LLM residual streams, adapting it to the direction-agnostic scoring requirement imposed by layer- and family-dependent ring orientation. 3 Preliminaries: Geometry of the Residual Stream Modern causal language models process tokens through a sequence of transformer blocks communicating via a central residual stream. Let fℓ(x)∈ℝDf_ (x) ^D denote the activation vector of the residual stream at layer ℓ for the final token of an input prompt x. The Linear Representation Hypothesis (Park et al., 2023) posits that neural networks encode high-level concepts as spatial directions within this D-dimensional space. Under this view, semantic identity is defined by orientation, while concept intensity correlates with magnitude along that direction. Euclidean distance conflates semantic identity with concept intensity. Furthermore, in standard Pre-LayerNorm transformer architectures, the residual stream accumulates un-normalised outputs from consecutive layers, causing the ℓ2 _2 norm to grow monotonically with depth (Xiong et al., 2020). Angular distance isolates semantic direction from both intensity and architectural norm growth, providing a more faithful measure of semantic divergence, and is the foundation of the LatentBiopsy scoring function. 4 Method LatentBiopsy is a training-free, zero-shot anomaly detector that identifies harmful prompts by measuring the directional deviation of the last-token residual-stream activation from a reference subspace constructed exclusively from safe data. 4.1 Notation and activation extraction Let fℓ(x)∈ℝDf_ (x) ^D denote the last-token residual-stream activation at transformer layer ℓ for prompt x, extracted from a pretrained causal language model. All subsequent computations are performed independently at each layer ℓ . 4.2 Normative reference direction (PC1) Given a normative fit set 0=x1,…,xNX_0=\x_1,…,x_N\ of N safe prompts, we compute the leading principal component of the corresponding activations: =PC1[fℓ(xi)]i=1N∈ℝD,‖=1.c=PC_1 [f_ (x_i) ]_i=1^N ^D, \|c\|=1. (1) The vector c defines the direction of maximum variance within the safe distribution and serves as the sole reference direction for K=1K=1. For completeness we also examine K=2,3,4K=2,3,4 by taking the top-K principal components, but the primary detector uses K=1K=1. 4.3 Angular deviation theta The directional deviation of a test activation fℓ(x)f_ (x) from the reference is the angle θ(x)=arccos(fℓ(x)⋅‖fℓ(x)‖)∈[0,π].θ(x)= \! ( f_ (x)·c\|f_ (x)\| )∈[0,π]. (2) This purely angular metric isolates semantic orientation from both concept intensity and the monotonic norm growth induced by Pre-LayerNorm accumulation. A value θ≈0θ≈ 0 indicates strong alignment with the normative reference; θ≈πθ≈π indicates near-antiparallel orientation. 4.4 Anomaly scoring We fit a univariate Gaussian (μ0,σ02)N( _0, _0^2) to the empirical distribution θ(xi)i=1N\θ(x_i)\_i=1^N from the normative fit set. The anomaly score for any prompt x is the negative log-likelihood under this distribution: s(x)=−logp(θ(x)|μ0,σ02).s(x)=- p\! (θ(x)\, |\, _0, _0^2 ). (3) Because s(x)s(x) is symmetric around μ0 _0, it flags deviations in either direction without prior knowledge of whether harmful prompts lie inside or outside the normative ring (section˜6.1). The score is monotonically equivalent to the squared z-score of θ up to additive constants, yielding values suitable for cross-layer and cross-model comparison. Although a multivariate Gaussian Mixture Model can be fit to the stacked vector of angles to the top-K principal components for K>1K>1, the primary LatentBiopsy detector employs the univariate K=1K=1 formulation. 4.5 Phi: azimuthal visualisation coordinate To enable geometric visualisation we project the component of fℓ(x)f_ (x) orthogonal to c: f⟂(x)=fℓ(x)−(fℓ(x)⋅).f (x)=f_ (x)- (f_ (x)·c )\,c. A 2-D PCA basis (1,2)(v_1,v_2) is fit exclusively on f⟂(xi)i=1N\f (x_i)\_i=1^N from the normative fit set. The azimuthal coordinate is then ϕ(x)=atan2(f⟂(x)⋅2,f⟂(x)⋅1)∈[−π,π].φ(x)=atan2\! (f (x)·v_2,\;f (x)·v_1 )∈[-π,π]. Each prompt maps to the polar point (θ(x)cosϕ(x),θ(x)sinϕ(x))(θ(x) φ(x),\,θ(x) φ(x)) in the theta-phi projection. The coordinate ϕφ is used solely for visualisation; detection relies on s(x)s(x). 4.6 Baselines For comparison, we include four additional scorers: (1) absolute deviation |θ(x)−μ0||θ(x)- _0| (monotonically equivalent to s(x)s(x) for K=1K=1); (2) bivariate Gaussian negative log-likelihood under a 2-D fit to the joint (θ,ϕ)(θ,φ) distribution; (3) cosine-to-centroid scos(x)=1−fℓ(x)⋅f¯0/‖fℓ(x)‖‖f¯0‖s_cos(x)=1-f_ (x)· f_0/\|f_ (x)\|\| f_0\|; and (4) Euclidean deviation ‖fℓ(x)−f¯0‖2\|f_ (x)- f_0\|_2. 4.7 Experimental protocol and data splits Datasets. We use three public corpora: Alpaca-Cleaned (Taori et al., 2023) (normative safe prompts); AdvBench (Zou et al., 2023b) (520 harmful prompts); XSTest (Röttger et al., 2023) (250 benign-aggressive prompts, evaluation only). Split design. We fix the normative fit set at N=200N=200 prompts, drawn from Alpaca-Cleaned, and retain a disjoint held-out normative evaluation set of 520 prompts. All 520 harmful and 250 benign-aggressive prompts are reserved for evaluation; none enter the fit stage. Layer selection. The operating layer is selected by argmax of K=1K=1 harmful-detection AUROC over all layers, evaluated on the held-out set, a standard model-selection step that uses no harmful data for fitting. The harmful eval set is used solely to identify the most informative layer, not to fit any parameters of the detector. The selection optimism is bounded by the plateau width: per-layer AUROC varies by fewer than 0.08 units across all 24 layers in every model (figs.˜2 and 3), so no layer is meaningfully preferred over its neighbours. For all models except Qwen2.5-0.5B-Abliterated (best layer 10), the argmax is layer 20. For Qwen2.5-0.5B-Abliterated, we report metrics at the best layer (10) and note that AUROC at layer 20 falls within 0.004 of the reported value (fig.˜8, bottom row). Evaluation. We report per-layer area under the ROC curve (AUROC) and area under the precision–recall curve (AUPRC) for three binary tasks: (i) harmful vs. normative (h/n); (i) harmful vs. benign-aggressive (h/b); and (i) harmful vs. rest, i.e. normative ∪ benign-aggressive (h/r). Pairwise differences between groups are assessed using the Mann–Whitney U test. 5 Experiments 5.1 Models We evaluate six model variants comprising two complete triplets. Qwen3.5-0.8B (D=1024D=1024, 24 layers). Three variants are evaluated: Base, the raw pretrained model before any alignment fine-tuning; Chat, the instruction-tuned model; and Abliterated, the Chat model with the refusal direction removed from all weight matrices via orthogonalisation (Arditi et al., 2024), rendering it unable to produce refusals. Both non-base variants employ a hybrid linear-attention architecture; activations were extracted using a standard PyTorch implementation.111The flash-linear-attention fast path was unavailable at the time of testing; results reflect geometric-signal robustness across attention implementations. Qwen2.5-0.5B (D=896D=896, 24 layers). The same three variants (Base, Instruct, and Abliterated) are evaluated for this family, with the abliterated variant produced by orthogonalising the refusal direction from the Instruct checkpoint. 5.2 Detection performance Table˜1 summarises detection performance across all six variants. Three findings hold without exception. Harmful intent and benign-aggressive phrasing (XSTest) are perfectly separable across all six models, including the abliterated variants: AUROC h/b =1.000=1.000 universally. The h/n task is strongly solved as well, with AUROC ranging from 0.9374 (Qwen2.5-0.5B-Abliterated) to 0.9642 (Qwen3.5-0.8B-Base) and AUPRC h/n ≥ 0.898 throughout. Most importantly for our central claim, the abliterated models are essentially indistinguishable from their instruction-tuned counterparts in detection performance: the abliterated variant falls within 0.002 AUROC h/n of the Chat model for Qwen3.5-0.8B and within 0.005 for Qwen2.5-0.5B. These margins are smaller than the gap between base and instruction-tuned variants within either family. All pairwise comparisons achieve p<10−45p<10^-45 under the Mann–Whitney U test (harmful vs. normative/rest); normative-vs-benign-agg p-values range from 10−510^-5 to 10−2210^-22. Table 1: Detection performance (normative-reference strategy, K=1K=1, held-out evaluation sets, Nfit=200N_fit=200 for all models). nharm=520n_harm=520, nnorm,eval=520n_norm,eval=520, nbenign=250n_benign=250 for all models. h/n: harmful vs. normative; h/b: harmful vs. benign-aggressive; h/r: harmful vs. rest (norm ∪ benign). rb/nr_b/n: rank-biserial correlation for normative-vs-benign-agg (negative means benign-agg is less anomalous than normative, which is the desired direction for a harm detector). Prec@90: precision at 90% recall on the h/n task. †Best layer for this model is 10; AUROC at layer 20 differs by <0.004<0.004. Model Type Layer AUROC AUPRC h/r rb/nr_b/n Prec@90 h/n h/b h/n h/b Qwen3.5-0.8B (D=1024D=1024) Base Base 20 0.9642 1.000 0.9373 1.000 0.9758 −0.384∗∗-0.384^*** 0.928 Chat Instruct 20 0.9497 1.000 0.9117 1.000 0.9661 −0.434∗∗-0.434^*** 0.899 Abliterated Abliterated 20 0.9517 1.000 0.9165 1.000 0.9674 −0.427∗∗-0.427^*** 0.899 Qwen2.5-0.5B (D=896D=896) Base Base 20 0.9585 1.000 0.9373 1.000 0.9720 +0.149∗+0.149^** 0.902 Instruct Instruct 20 0.9420 1.000 0.9129 1.000 0.9609 +0.219∗∗+0.219^*** 0.875 Abliterated† Abliterated 10 0.9374 1.000 0.8978 1.000 0.9577 −0.179∗-0.179^** 0.882 ∗: p<10−4p<10^-4. ∗: p<10−18p<10^-18. All h/n, h/b, h/r comparisons: p<10−45p<10^-45. Benign-agg in Qwen2.5-0.5B-Base and Qwen2.5-0.5B-Instruct scores slightly above normative (rb/n>0r_b/n>0) but far below harmful (AUROC h/b =1.000=1.000). Benign-aggressive placement is family-dependent but never a problem for discrimination. In Qwen3.5-0.8B, XSTest prompts score significantly below normative (rb/n≈−0.43r_b/n≈-0.43 for Chat and Abliterated, −0.38-0.38 for Base), occupying the innermost region of the normative ring. In Qwen2.5-0.5B-Base and Instruct, they sit slightly above normative (rb/n=+0.15r_b/n=+0.15 and +0.22+0.22); in Qwen2.5-0.5B-Abliterated, they shift back below (rb/n=−0.18r_b/n=-0.18). In every configuration, harmful prompts are far more anomalous than benign-aggressive ones, achieving AUROC h/b =1.000=1.000 throughout. The full precision-recall profiles are shown in fig.˜1 for the base variants and in fig.˜9 for all six models. (a) Qwen3.5-0.8B-Base (b) Qwen2.5-0.5B-Base Figure 1: Precision-recall curves at the operating layer (K=1K=1) for the two base variants; remaining models are in fig.˜9. Dotted horizontal lines indicate chance precision per task. The harmful-vs-normative curve (red) maintains precision >0.92>0.92 up to 90% recall for Qwen3.5-0.8B-Base (Prec@90 =0.928=0.928) and >0.90>0.90 for Qwen2.5-0.5B-Base (Prec@90 =0.902=0.902). The harmful-vs-benign-agg curve is flat at 1.000 precision across all recall levels. The normative-vs-benign-agg curve (green) lies below chance in Qwen3.5-0.8B (AUPRC =0.232=0.232), confirming that benign-agg prompts are scored as less anomalous than normative, consistent with rb/n=−0.384r_b/n=-0.384. 5.3 Comparison across model variants Within each family, base models match or slightly exceed their instruction-tuned counterparts in harmful detection: the gap is 0.015 AUROC h/n for Qwen3.5-0.8B and 0.017 for Qwen2.5-0.5B, with base scoring higher in both cases. This is a consistent if modest observation, and points to safety geometry being present before alignment fine-tuning. The abliterated models tell the more striking story. In Qwen3.5-0.8B, the abliterated model (AUROC h/n =0.9517=0.9517) lies 0.002 above the chat model (0.94970.9497), well within any plausible noise floor. In Qwen2.5-0.5B, the gap is 0.005 (best layer 10 vs. 20), a margin smaller than the base-to-instruct difference within the same family. A model that cannot refuse harmful requests is, by this measure, an equally capable harm detector. Per-layer profile. Figures˜2 and 3 show per-layer AUROC for both families. K=1K=1 is uniformly superior to K>1K>1 baselines across all 24 layers in every variant. The broad plateau at K=1K=1 bounds layer-selection optimism tightly: best layer exceeds worst by fewer than 0.08 AUROC units, with all layers above 0.88. (a) Qwen3.5-0.8B-Base (b) Qwen3.5-0.8B-Chat (c) Qwen3.5-0.8B-Abliterated Figure 2: Per-layer AUROC for the Qwen3.5-0.8B family. Each panel shows AUROC h/n (left) and AUROC h/b (right) vs. layer index. K=1K=1 (solid blue) strictly dominates K>1K>1 (orange/green/red) at every layer. The cosine-centroid baseline (purple dashed) consistently underperforms K=1K=1. AUROC h/b =1.000=1.000 is maintained at every layer regardless of alignment stage. The three panels are nearly indistinguishable in their h/b profile. (a) Qwen2.5-0.5B-Base (b) Qwen2.5-0.5B-Instruct (c) Qwen2.5-0.5B-Abliterated Figure 3: Per-layer AUROC for the Qwen2.5-0.5B family. K=1K=1 (solid blue) remains the dominant scorer throughout. In the Instruct and Abliterated variants, the cosine-centroid and L2-norm baselines reach near-parity with K=1K=1, reflecting the specific geometry of this family, but do not surpass it. The broad performance plateau across layers 5–23 bounds layer-selection optimism to <0.08<0.08 AUROC units. 5.4 Computational cost We evaluated the latency overhead of LatentBiopsy on an NVIDIA GeForce RTX 3070 Laptop GPU (8 GB VRAM), reporting mean and standard deviation over 100 trials after GPU warm-up, using Alpaca prompts to reflect realistic sequence lengths. We report mean (standard deviation): A baseline Qwen2.5-0.5B forward pass takes 20.7 (2.7) ms; residual-stream extraction adds negligible overhead (0.0 ms); and anomaly scoring (dot product plus scalar Gaussian NLL) executes in 0.43 (0.08) ms. End-to-end, the pipeline completes in 22.6 (2.1) ms per query. Normative reference fitting is performed once offline: for N=200N=200 prompts, activation extraction takes <<3 s and PCA completes in <<0.2 s on CPU. LatentBiopsy therefore adds less than 0.5 ms of method-specific overhead (anomaly scoring) relative to a standard forward pass. 6 Geometric Analysis: The Two-Ring Structure (a) Qwen3.5-0.8B-Base (L20) (b) Qwen2.5-0.5B-Base (L20) (c) Qwen3.5-0.8B-Chat (L20) (d) Qwen2.5-0.5B-Instruct (L20) (e) Qwen3.5-0.8B-Abliterated (L20) (f) Qwen2.5-0.5B-Abliterated (L10) Figure 4: Theta-phi projections at the operating layer. Harmful (red) and safe (blue/green) prompts form distinct concentric radial zones across all variants. In the Qwen3.5-0.8B family (left column), harmful intent occupies the outer ring; in Qwen2.5-0.5B (right column), it occupies the inner ring. The visual invariance across rows demonstrates that safety geometry is established during pretraining and remains intact even after the mathematical erasure of refusal mechanisms. All panels achieve AUROC h/b = 1.000. 6.1 Opposite ring orientations across families Figure˜4 plots the theta-phi projection for all six variants at their respective operating layers. A concentric two-ring structure separating harmful and normative activations is present in every panel, and the two families occupy opposite positions. In all three Qwen3.5-0.8B variants, harmful prompts occupy the outer ring (θ¯harm≈1.80 θ_harm≈ 1.80 rad vs. μ0≈1.17 _0≈ 1.17 rad; table˜2): they deviate more strongly from PC1 than normative prompts. In all three Qwen2.5-0.5B variants, harmful prompts occupy the inner ring (θ¯harm≈1.32 θ_harm≈ 1.32–1.361.36 rad vs. μ0≈1.76 _0≈ 1.76–1.901.90 rad): they are more tightly aligned with PC1 than normative prompts. This family-level reversal cannot be reconciled by any fixed directional threshold on θ. The anomaly score s(x)s(x) resolves it correctly in all cases: both θ=μ0+kσ0θ= _0+k _0 and θ=μ0−kσ0θ= _0-k _0 receive the same score for any k, regardless of ring direction. The same argument applies to layer-level reversals within each model, visible in figs.˜2 and 3 through the changing sign of the L2-norm baseline across layers. 6.2 Benign-aggressive placement The XSTest prompts occupy a consistent position relative to the harmful cluster in each family, reinforcing the interpretation of the two-ring geometry. In all three Qwen3.5-0.8B variants, they cluster at the smallest radii, below the normative mean (rb/n≈−0.43r_b/n≈-0.43), and are geometrically separated from harmful prompts in the opposite direction. In Qwen2.5-0.5B-Base and Instruct, they sit near or slightly above normative (rb/n=+0.15r_b/n=+0.15, +0.22+0.22), while in Qwen2.5-0.5B-Abliterated they shift slightly below (rb/n=−0.18r_b/n=-0.18). In every case, perfect harmful-vs-benign-aggressive separation (AUROC h/b =1.000=1.000) holds, confirming that the theta score cleanly discriminates harmful intent from aggressive but benign phrasing regardless of where benign-aggressive prompts sit relative to the normative mean. 6.3 Angular deviation statistics Table˜2 reports the raw angular deviation statistics at the operating layer for each model, and fig.˜5 shows the corresponding anomaly score distributions. Three patterns hold universally. The harmful cluster is extraordinarily compact. σθharm _θ^harm is 0.030–0.052 rad: one order of magnitude smaller than σθnorm _θ^norm (0.183–0.272 rad), and this near-degeneracy is preserved across base, instruction-tuned, and abliterated variants alike. Normative train and test are statistically indistinguishable (|θ¯norm,train−θ¯norm,test|≤0.01| θ_norm,train- θ_norm,test|≤ 0.01 rad in every model), confirming that N=200N=200 defines a stable reference distribution. Finally, benign-aggressive prompts cluster near the normative mean in all Qwen3.5-0.8B variants (smaller θ than normative, tighter alignment with PC1), while in Qwen2.5-0.5B their θ nearly coincides with the normative μ0 _0, leaving harmful as the angular outlier in both cases. Table 2: Raw angular deviation θ statistics at the operating layer (normative-ref, K=1K=1). μ0=θ¯norm,test _0= θ_norm,test: mean normative angle (radians). σnorm _norm: normative test standard deviation. θ¯harm θ_harm: harmful mean. Δθ=θ¯harm−μ0 θ= θ_harm- _0: signed angular separation (positive == outer ring, negative == inner ring). θ¯benign θ_benign: benign-aggressive mean. σharm _harm: harmful standard deviation. All h/n comparisons: p<10−45p<10^-45. †Layer 10 for this model. Model Type μ0 _0 σnorm _norm θ¯harm θ_harm Δθ θ θ¯benign θ_benign σharm _harm Qwen3.5-0.8B Base Base 1.161 0.272 1.811 +0.650+0.650 1.094 0.034 Chat Instruct 1.178 0.267 1.801 +0.623+0.623 1.104 0.030 Abliterated Abliterated 1.175 0.267 1.802 +0.627+0.627 1.104 0.031 Qwen2.5-0.5B Base Base 1.819 0.188 1.357 −0.462-0.462 1.821 0.034 Instruct Instruct 1.764 0.183 1.316 −0.448-0.448 1.777 0.035 Abliterated† Abliterated 1.904 0.250 1.301 −0.603-0.603 1.962 0.052 Δθ>0 θ>0: harmful is outer ring (more deviated from PC1); Δθ<0 θ<0: harmful is inner ring (more aligned with PC1). Both configurations are correctly flagged by the symmetric score s(x)s(x). (a) Qwen3.5-0.8B-Base (b) Qwen2.5-0.5B-Base (c) Qwen3.5-0.8B-Chat (d) Qwen2.5-0.5B-Instruct (e) Qwen3.5-0.8B-Abliterated (f) Qwen2.5-0.5B-Abliterated Figure 5: Anomaly score distributions at the operating layer for all six variants. Each violin shows the marginal distribution of s(x)=−logp(θ∣μ0,σ02)s(x)=- p(θ _0, _0^2) for normative eval (blue), harmful (red), benign-aggressive (green), and normative ∪ benign (purple). White circles denote medians; bars denote IQRs. In every panel, harmful prompts occupy a narrow, elevated band (σθharm _θ^harm is 5–9× smaller than σθnorm _θ^norm; table˜2). In the Qwen3.5-0.8B family (left column), benign-aggressive scores fall below the normative distribution; in the Qwen2.5-0.5B family (right column), they overlap with it. The three panels within each column are nearly identical, illustrating that abliteration leaves the score landscape intact. 7 Robustness and Sensitivity Analysis 7.1 Safety signal dimensionality (K-ablation) The per-layer AUROC plots already show that K=1K=1 strictly outperforms multi-directional baselines at every layer and model. Table˜3 quantifies this at the operating layer. Increasing from K=1K=1 to the best K>1K>1 reduces AUROC by 0.033–0.063 across models, a consistent and meaningful penalty for adding directions. The cosine-centroid baseline matches or slightly exceeds K=1K=1 for the two Qwen2.5-0.5B non-abliterated variants (Δcos=+0.009 _cos=+0.009 and +0.004+0.004), suggesting that for this family the mean normative activation is a good proxy for PC1. The PC1 formulation is nonetheless preferred on theoretical grounds: it maximises captured normative variance, remains interpretable through the theta-phi projection, and performs at least as well as the centroid in four of six models. Table 3: K-ablation at the operating layer. ΔK _K: AUROC h/n change from K=1K=1 to best K>1K>1 (negative = K=1K=1 better). Δcos _cos: AUROC h/n change from K=1K=1 to cosine-centroid baseline (negative = K=1K=1 better). †Layer 10. Model Type K=1K=1 AUROC ΔK _K Δcos _cos Qwen3.5-0.8B-Base Base 0.9642 −0.033-0.033 −0.050-0.050 Qwen3.5-0.8B-Chat Instruct 0.9497 −0.049-0.049 −0.031-0.031 Qwen3.5-0.8B-Abliterated Abliterated 0.9517 −0.045-0.045 −0.035-0.035 Qwen2.5-0.5B-Base Base 0.9585 −0.041-0.041 −0.008-0.008 Qwen2.5-0.5B-Instruct Instruct 0.9420 −0.063-0.063 +0.009+0.009 Qwen2.5-0.5B-Abliterated† Abliterated 0.9374 −0.037-0.037 +0.004+0.004 7.2 Safety signal sparsity (dimension ablation) Figure˜6 shows AUROC as a function of the number of principal dimensions retained (by descending normative variance), for K=2K=2 at the operating layer, for the two base variants. The full six-model ablation is in fig.˜10. In every model, retaining just the top-10 dimensions (≈1%≈1\% of D=1024D=1024 or 1.1%1.1\% of D=896D=896) simultaneously maximises both h/n and h/b AUROC; additional dimensions monotonically dilute performance. The safety signal is thus concentrated in a compact subspace. This result is consistent with the near-one-dimensional geometry reported by Arditi et al. (2024) and reinforced here across six model variants. (a) Qwen3.5-0.8B-Base (b) Qwen2.5-0.5B-Base Figure 6: Dimension-pruning ablation at the operating layer (K=2K=2) for the two base variants; all six models are shown in fig.˜10. AUROC h/n (red) and AUROC h/b (green) vs. number of principal dimensions retained by descending normative variance. Both tasks are maximised at the top-10 dimensions (≈1%≈1\% of D) and degrade monotonically thereafter. This pattern indicates that retaining additional components does not improve performance under this setup. 7.3 Normative set stability Figure˜7 and fig.˜8 plot AUROC as a function of normative fit-set size N for all variants of the Qwen3.5-0.8B and Qwen2.5-0.5B families, respectively. Performance saturates remarkably early. Across all models and nearly all layers, AUROCh/n_h/n already exceeds 0.90 once N≳100N 100, with many layers reaching this threshold throughout most layers. Even with extremely small normative sets (N=10N=10–20), late-layer performance remains strong (typically >0.85>0.85). The harmful-versus-benign-aggressive separation reaches and remains perfectly flat at AUROC=h/b1.000_h/b=1.000 from the smallest tested values of N. The right sub-panels confirm near-perfect invariance to the ordering of the normative set: forward (solid) and reverse (dashed) curves overlap almost completely after N≈30N≈ 30. This rules out sample-ordering artefacts and shows that the leading principal component rapidly converges to a stable reference direction. Notably, the stability profiles are qualitatively consistent across Base, Chat, and Abliterated variants within each family. This provides further evidence that the harmful-intent geometry exploited by LatentBiopsy is formed during pretraining and remains largely unaffected by later instruction tuning or refusal ablation. Several adjacent late layers also show nearly identical curves, indicating that the relevant structure isn’t limited to a single layer but is distributed across a small range of layers. The immediate perfect separability of harmful versus benign-aggressive prompts across all N further suggests that these categories occupy well-separated regions of representation space, independent of the normative reference. Taken together, these results demonstrate that LatentBiopsy is highly data-efficient: a few dozen safe prompts suffice to construct a high-quality reference direction, and N=200N=200 lies comfortably in the saturated regime. (a) Qwen3.5-0.8B-Base (b) Qwen3.5-0.8B-Chat (c) Qwen3.5-0.8B-Abliterated Figure 7: AUROC vs. normative fit-set size N for the Qwen3.5-0.8B family. Left sub-panels: AUROC h/n vs. N for representative layers (forward ordering), showing stabilisation well before N=200N=200 at every layer. Right sub-panels: AUROC vs. N at a fixed late layer, comparing forward (solid) and reverse (dashed) ordering for AUROC h/n (red) and AUROC h/b (green). Green curves are flat at 1.000 throughout; red curves are stable above 0.90 at all N≥30N≥30 and invariant to ordering, ruling out sample-ordering artefacts. (a) Qwen2.5-0.5B-Base (b) Qwen2.5-0.5B-Instruct (c) Qwen2.5-0.5B-Abliterated Figure 8: AUROC vs. normative fit-set size N for the Qwen2.5-0.5B family. Similar to the 0.8B architecture, performance stabilises well before N=200N=200 (left panels) and exhibits strict ordering invariance (right panels). The abliterated variant (panel c) shows the same robust stability pattern at its operating layer (layer 10) as at other layers, confirming data-size requirements are unaffected by the ablation of refusal directions. 8 Discussion The abliteration result and its safety implications. The abliterated variants apply targeted removal of the learned refusal direction, aiming to eliminate refusal-style behaviour. Yet LatentBiopsy achieves AUROC h/b =1.000=1.000 and AUROC h/n within 0.005 of the corresponding instruction-tuned models in both families. This establishes a geometric dissociation: harmful semantic intent is represented in the residual stream independently of the downstream mechanism that acts on it. Recent safety approaches such as Zheng et al. (2024) target the refusal direction to strengthen model behaviour. Our findings suggest that such interventions address the generative mechanism without altering the representational geometry; the latent signal persists even when the direction has been mathematically erased. This is consequential for both offensive and defensive AI safety: a model that cannot refuse retains an intact, exploitable signal for an external detector, and an adversary who abliterates a model to bypass its safeguards does not thereby erase the geometric evidence of harmful intent. Why do the two families have opposite ring orientations? At layer 20, Qwen3.5-0.8B harmful prompts are more angular from PC1 than normative prompts (Δθ=+0.62 θ=+0.62–+0.65+0.65 rad), while Qwen2.5-0.5B harmful prompts are more aligned (Δθ=−0.45 θ=-0.45–−0.60-0.60 rad). This family-level difference likely reflects how safety-relevant representations are encoded relative to the dominant normative variance direction in each architecture, a quantity that depends on pretraining data mixture, model width, and architectural details simultaneously. We do not have a mechanistic account and regard the cause as an open question. What the result does establish is that no single ring orientation can be assumed a priori across architectures, making direction-agnostic scoring a structural requirement rather than a design choice. The near-degenerate harmful compactness. Across all six models, σθharm≈0.03 _θ^harm≈ 0.03–0.050.05 rad, one order of magnitude smaller than σθnorm _θ^norm. This compactness survives abliteration, ruling out the refusal direction as its source. The most parsimonious explanation is that AdvBench prompts share a narrow syntactic template producing near-identical last-token activations. Evaluation on structurally diverse datasets such as JailbreakBench (Chao et al., 2024) is the key open experiment to determine whether this compactness is a surface-form artefact or a genuine semantic regularity. This question is the primary empirical limitation of the present work. Does safety geometry precede alignment? Base models achieve at least equal harmful-detection AUROC as their instruction-tuned counterparts in both families, and the two-ring structure is qualitatively identical across base, instruct, and abliterated variants. This is consistent with the hypothesis that harmful-intent geometry is established during pretraining and is not a product of alignment fine-tuning. However, the observation is currently limited to two model families from a single vendor, and Qwen-specific data mixture effects cannot be ruled out. Extending to at least one non-Qwen family is the highest-priority next experiment. Limitations and open directions. Cross-architecture validation is the most critical gap: the geometry-precedes-alignment and geometry-survives-ablation findings must be replicated in at least one non-Qwen family before they can be treated as general results. Dataset diversity: evaluation on JailbreakBench will determine whether harmful compactness generalises beyond the lexically homogeneous AdvBench. Adversarial robustness: prompts crafted to minimise |s(x)||s(x)| while preserving harmful intent are the natural white-box attack on LatentBiopsy; their effect is entirely untested and constitutes the most important open safety question. Layer selection: a dedicated layer-selection split would eliminate the one level of selection bias and yield strictly unbiased AUROC estimates. Calibrated thresholding: deployment requires a principled approach to threshold selection given the variability of benign-aggressive placement across families. 9 Conclusion LatentBiopsy demonstrates that a direction-agnostic angular anomaly detector, built exclusively from 200 safe activations, robustly identifies harmful prompts across base, instruction-tuned, and abliterated variants of two model families. The method achieves harmful versus normative AUROC ≥ 0.937 and harmful versus benign-aggressive AUROC =1.000=1.000 across all six tested variants, with sub-millisecond per-query overhead and no harmful training data. The central finding is a geometric dissociation: removing the refusal mechanism from a model in both a 0.8B and a 0.5B architecture leaves harmful-intent geometry intact. A model that cannot refuse retains the latent signal exploitable by an external detector, and an adversary who abliterates refusal does not thereby erase the evidence. Combined with the observation that base models match instruction-tuned ones on all detection metrics, the evidence is consistent with harmful-intent geometry being established during pretraining, independently of the alignment process in both its presence and its absence. An unexpected empirical pattern (though not extensively tested) is the opposite ring orientation across families: harmful prompts are the most angular group in Qwen3.5-0.8B and the most aligned group in Qwen2.5-0.5B. The anomaly score handles both without modification. Explaining this architectural difference mechanistically, and confirming whether the pattern generalises beyond the Qwen family, is the natural next step of this research programme. 10 Ethical Considerations and Broader Impact LatentBiopsy provides a diagnostic capability to identify harmful instructions at inference time. While the primary objective is to enhance safety, we acknowledge the inherent dual-use potential of interpretability tools. Responsible Research Practice. We have utilized only publicly available datasets (AdvBench, XSTest, Alpaca) that are standard within the AI safety literature. We do not provide, encourage, or facilitate the generation of new harmful content. We strictly adhere to the AI safety community’s norms of responsible disclosure and advocate for the use of latent analysis solely to improve model robustness, interpretability, and safety alignment. We believe that democratising the ability to "read" harmful intent is a net positive for safety, as it reduces the reliance on "black-box" proprietary safety filters and enables transparent, model-agnostic verification of safety alignment. Code and Data Availability. All code is available at https://github.com/isaac-6/geometric-latent-biopsy. A Zenodo archive is at https://doi.org/10.5281/zenodo.19294977. Datasets: Alpaca-Cleaned (Taori et al., 2023), AdvBench (Zou et al., 2023b), XSTest (Röttger et al., 2023). Models used in this work: Qwen/Qwen3.5-0.8B-Base, Qwen/Qwen3.5-0.8B, prithivMLmods/Gliese-Qwen3.5-0.8B-Abliterated-Caption, Qwen/Qwen2.5-0.5B, Qwen/Qwen2.5-0.5B-Instruct, huihui-ai/Qwen2.5-0.5B-Instruct-abliterated. References G. Alon and M. Kamfonas (2023) Detecting language model attacks with perplexity. Note: arXiv preprint arXiv:2308.14132 Cited by: §1, §2. A. Arditi, O. Obeso, A. Syed, H. Cunningham, D. Filan, F. Colognese, M. Wattenberg, and F. Viégas (2024) Refusal in language models is mediated by a single direction. Note: arXiv preprint arXiv:2406.11717 Cited by: §1, §2, §5.1, §7.2. P. Chao, E. Debenedetti, A. Robey, M. Andriushchenko, F. Croce, V. Sehwag, E. Dobriban, N. Flammarion, G. J. Pappas, F. Tramer, et al. (2024) JailbreakBench: an open robustness benchmark for jailbreaking large language models. arXiv preprint arXiv:2404.01318. Cited by: §8. H. Inan, K. Upasani, J. Chi, R. Rungta, K. Iyer, Y. Mao, M. Tontchev, Q. Hu, B. Fuller, D. Testuggine, and M. Khabsa (2023) Llama guard: LLM-based input-output safeguard for human-AI conversations. Note: arXiv preprint arXiv:2312.06674 Cited by: §1, §2. N. Jain, A. Schwarzschild, Y. Wen, G. Somepalli, J. Kirchenbauer, P. Chiang, M. Goldblum, T. Goldstein, et al. (2023) Baseline defenses for adversarial attacks against aligned language models. Note: arXiv preprint arXiv:2309.00614 Cited by: §1, §2. K. Li, O. Patel, F. Viégas, H. Pfister, and M. Wattenberg (2023) Inference-time intervention: eliciting truthful answers from a language model. In Advances in Neural Information Processing Systems, Vol. 36. Cited by: §1, §2. I. Llorente-Saguer, C. Arber, and N. P. Oxtoby (2025) Theta, a multidimensional ratio biomarker applied to five amyloid beta peptides for investigations in familial Alzheimer’s disease. medRxiv. Note: Preprint. https://doi.org/10.1101/2025.08.06.25333131 Cited by: §2. K. Park, Y. J. Choe, and V. Veitch (2023) The linear representation hypothesis and the geometry of large language models. arXiv preprint arXiv:2311.03658. Cited by: §3. P. Röttger, H. R. Kirk, B. Vidgen, G. Attanasio, F. Bianchi, and D. Hovy (2023) XSTest: a test suite for identifying exaggerated safety behaviours in large language models. Note: arXiv preprint arXiv:2308.01263 Cited by: §10, §4.7. R. Taori, I. Gulrajani, T. Zhang, Y. Dubois, X. Li, C. Guestrin, P. Liang, and T. B. Hashimoto (2023) Stanford alpaca: an instruction-following LLaMA model. Note: https://github.com/tatsu-lab/stanford_alpaca Cited by: §10, §4.7. R. Xiong, Y. Yang, D. He, K. Zheng, S. Zheng, C. Xing, H. Zhang, Y. Lan, L. Wang, and T. Liu (2020) On layer normalization in the transformer architecture. In International conference on machine learning, p. 10524–10533. Cited by: §3. C. Zheng, L. Fan, H. Chen, Y. Liu, and M. Huang (2024) On prompt-driven safeguarding for large language models. In Proceedings of the 41st International Conference on Machine Learning, Note: arXiv preprint arXiv:2401.18018 Cited by: §1, §2, §8. A. Zou, L. Phan, S. Chen, J. Campbell, P. Guo, R. Ren, A. Pan, X. Yin, M. Mazeika, A. Dombrowski, et al. (2023a) Representation engineering: a top-down approach to AI transparency. Note: arXiv preprint arXiv:2310.01405 Cited by: §1, §2. A. Zou, Z. Wang, J. Z. Kolter, and M. Fredrikson (2023b) Universal and transferable adversarial attacks on aligned language models. Note: arXiv preprint arXiv:2307.15043 Cited by: §10, §4.7. Appendix A Harmful-Reference Strategy A supervised variant (harmful-ref) fits the biomarker on harmful examples instead of normative ones, achieving comparable detection performance (AUROC 0.9450.945–0.9530.953 on harmful-vs-normative) but requiring harmful data at fit time. All harmful-ref scores require auto-orientation (sign flip) at every layer and model, because the harmful distribution is so diffuse that held-out harmful prompts score as more anomalous under their own Gaussian fit than normative prompts do. This confirms the compact/diffuse asymmetry at the distributional level: the harmful manifold has no compact geometric centre that generalises across samples. Full harmful-ref figures and statistics are available in the project repository. Appendix B Precision-Recall Curves: All Models (a) Qwen3.5-0.8B-Chat (b) Qwen2.5-0.5B-Instruct (c) Qwen3.5-0.8B-Abliterated (d) Qwen2.5-0.5B-Abliterated Figure 9: Precision-recall curves for all six models; see fig.˜1 for a detailed description, and the base models’ curves. In the Qwen3.5-0.8B family (left column), the normative-vs-benign-agg curve (green) lies below chance, confirming that benign-agg prompts are scored as less anomalous. In the Qwen2.5-0.5B family (right column), the same curve sits near or slightly above chance, reflecting rb/n≈+0.15r_b/n≈+0.15 to +0.22+0.22. In all panels, the harmful-vs-benign-agg curve is flat at precision =1.000=1.000. Appendix C Dimension Ablation: All Models (a) Qwen3.5-0.8B-Base (b) Qwen2.5-0.5B-Base (c) Qwen3.5-0.8B-Chat (d) Qwen2.5-0.5B-Instruct (e) Qwen3.5-0.8B-Abliterated (f) Qwen2.5-0.5B-Abliterated Figure 10: Dimension-pruning ablation (K=2K=2) for all six models; see fig.˜6 for a detailed description. In every panel, performance is maximised at top-10 dimensions and monotonically decreases thereafter, confirming that the safety signal is concentrated in <1.2%<1.2\% of all residual-stream dimensions across both model families.