Paper deep dive

Measuring the Wrong Thing: Internal Harmfulness Scores Anti-Rank Successful Jailbreaks

Mingyu Luo, Ming Deng, Zilang Qiu, Yiming Cheng, Ci Tao, Xue Tan, Sijin Sun, Yangfu Li, Ping Chen, Jun Dai, Xiaoyan Sun

Year: 2026Venue: arXiv preprintArea: cs.CLType: PreprintEmbeddings: 94

Intelligence

Status: not_run | Model: - | Prompt: - | Confidence: 0%

Entities (0)

No extracted entities yet.

Relation Signals (0)

No relation signals yet.

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:Internal safety scores judge a prompt before any text is generated, and they are validated by how well they separate harmful prompts from benign ones. That separation is then read as evidence that the score will also catch the attacks that succeed. Harmful intent is a property of the prompt. Jailbreak success is an outcome produced later by a particular target model, decoding policy, and judge. A filter tuned on a score that measures the wrong quantity spends its false positive budget on attacks that would have failed anyway. In this paper we audit that inference. Attention based measurements are usually read from prompt dependent locations, so a wrapper changes both the content being judged and the place the signal is taken from. We therefore introduce Active Attention Probing, which supplies a fixed content independent measurement coordinate. We pair every base goal with a plain and a wrapped version and generate real completions from the target models. On Llama, wrapping raises harmful generation from 0.05 to 0.27 while harmful intent AUROC falls from 0.936 to 0.803, so the attacks grow more dangerous while the prompts look safer to the score. Among wrapped harmful prompts the outcome AUROC is 0.220, which places the attacks that succeeded below the attacks that failed. Rare token, passive, and detector derived channels reproduce the reversal on the same matched design, and the reversal itself persists across three target models, seven attack families, and two independent judges. Distribution shift then degrades calibration and threshold transfer before it degrades ranking.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

92,916 characters extracted from source content.

Expand or collapse full text

Measuring the Wrong Thing: Internal Harmfulness Scores Anti-Rank Successful Jailbreaks Mingyu Luo 1,† Ming Deng 1,2,† Zilang Qiu 1,3 Yiming Cheng 4 Ci Tao 1 Xue Tan 1 Sijin Sun 5 Yangfu Li 6 Ping Chen 7,∗ Jun Dai 8 Xiaoyan Sun 8 1 College of Computer Science and Artificial Intelligence, Fudan University 2 School of Computer Engineering and Science, Shanghai University 3 Beijing Normal University 4 Tsinghua University 5 Institute of Advanced Intelligence and Computing, A*STAR 6 School of Communication and Electronic Engineering, East China Normal University 7 Institute of Big Data, Fudan University 8 Department of Computer Science, Worcester Polytechnic Institute † These authors contributed equally. ∗ Corresponding author. Abstract Internal safety scores judge a prompt before any text is gener- ated, and they are validated by how well they separate harmful prompts from benign ones. That separation is then read as evidence that the score will also catch the attacks that suc- ceed. Harmful intent is a property of the prompt. Jailbreak success is an outcome produced later by a particular target model, decoding policy, and judge. A filter tuned on a score that measures the wrong quantity spends its false positive budget on attacks that would have failed anyway. In this paper we audit that inference. Attention based measurements are usually read from prompt dependent locations, so a wrapper changes both the content being judged and the place the sig- nal is taken from. We therefore introduce Active Attention Probing, which supplies a fixed content independent measure- ment coordinate. We pair every base goal with a plain and a wrapped version and generate real completions from the target models. On Llama, wrapping raises harmful generation from0.05to0.27while harmful intent AUROC falls from 0.936to0.803, so the attacks grow more dangerous while the prompts look safer to the score. Among wrapped harmful prompts the outcome AUROC is0.220, which places the at- tacks that succeeded below the attacks that failed. Rare token, passive, and detector derived channels reproduce the reversal on the same matched design, and the reversal itself persists across three target models, seven attack families, and two in- dependent judges. Distribution shift then degrades calibration and threshold transfer before it degrades ranking. 1 Introduction An internal safety score can identify harmful intent before generation. A deployed filter may then treat a high score as evidence that the prompt will successfully jailbreak its target. These interpretations refer to different quantities. Harmful in- tent is a property of the prompt. Realized success also depends on the target model, decoding policy, and judge. Our Llama results show that the two quantities can diverge. Wrapping a harmful request raises the harmful generation rate from0.05to0.27. At the same time, harmful intent AUROC falls from0.936to0.803. Among wrapped harmful prompts, the score places successful attacks below failed attacks and reaches an outcome AUROC of0.220. These results do not show that prompt safety detectors fail at their stated task. They show that harmfulness validation does not establish validity for realized success. We test this inference with matched plain and wrapped versions of each base goal. We generate real completions from each target model and label the realized outcome. At- tention based scores are usually read from prompt dependent locations, so a wrapper changes both the content being evalu- ated and the place the signal is taken from. A score change is then difficult to attribute to the model rather than to the moved coordinate. Active Attention Probing (AAP) removes this confound by providing a fixed content independent co- ordinate in the system region, so a prompt and its wrapped version are compared at a common reference point. AAP is the methodological contribution that makes the audit possible. The scientific claim of the paper concerns what the resulting score predicts. Rare token, passive, system span attention, and refusal logit channels test whether that claim depends on the AAP coordinate. Figure 1 presents the audit. RQ1 asks whether a score validated on harmful intent can rank target specific jailbreak success. RQ2 then asks whether the original harmfulness interpretation survives distribution shift. We evaluate ranking, calibration, and threshold transfer separately because each can fail while the others remain useful. Prior work shows that effective jailbreaks can suppress in- ternal harmfulness features [5, 21]. Probes trained on success labels can also transfer poorly across attack families [17]. We ask what a score trained on harmfulness can validly support. We make three contributions. •We distinguish prompt harmfulness from target spe- cific jailbreak success and estimate both quantities on matched prompts with realized outcomes. •We show that a strong harmfulness score can rank re- 1 arXiv:2608.09624v1 [cs.CL] 10 Aug 2026 Figure 1: The audit reads one score against three questions. Each column is a question, and its rows give the design, the measurement channel, and the diagnostic. Panel A asks whether the response is measured at a stable place, so AAP fixes the coordinate and rare token and passive channels match it. Panel B asks whether the harmful intent reading survives a change of distribution, so every transformation is applied to both classes and ranking, calibration, and threshold transfer are separated. Panel C asks whether the score anticipates what the target does, so it crossesHwithWover matched goals and validates against target indexed outcomes Y m . Panel C is where the two constructs come apart. alized success in the opposite direction. The result per- sists across measurement channels, targets, attacks, and independent judges. We also quantify the effect on a deployed filter. • We test whether the original harmfulness interpretation survives distribution shift. The audit separates ranking loss, probability miscalibration, and threshold transfer. 2 Related Work Internal safety scores. Attention Tracker and AttentionDe- fense use attention to detect prompt injection or adversar- ial prompts [12, 31]. HiddenDetect, GradSafe, refusal direc- tions, mutation sensitivity, and deployed filters use logits, gradients, hidden states, prompt variants, or layered classi- fiers [4, 16, 28, 34–36]. This line of work establishes that internal signals discriminate prompt level safety or attack la- bels. We ask the separate question of whether such a score is a valid predictor of a realized, target indexed jailbreak outcome. We audit the interpretation supported by the existing valida- tion and do not dispute performance on the stated prompt classification task. Our audit treats each detector as a representation, a readout, and a threshold. A prompt level label validates harmful in- tent for any of these channels. It cannot establish whether the target model will comply. GradSafe comes closest and com- pares gradients against a hypothetical compliant response that the target model never generates [34]. HiddenDetect reads a logit lens over multimodal inputs [16], and our HiddenDetect style row ports that readout to text only prompts with every deviation listed in the appendix. Attention head specializa- tion under attack has been studied directly [35]. Our per head decomposition makes no specialization claim. Jailbreak outcomes. Effective jailbreaks can suppress inter- nal harmfulness representations and move harmful prompts toward a harmless region [5, 21]. Prompt side probes trained directly on success labels can transfer below chance across attack families [17]. That result uses Llama-3.1-8B, which is also our primary target. Our positive control asks a narrower question. It tests whether success information is available within template based wrappers over a shared goal set. It does not claim transfer across attack paradigms. Our main audit asks whether a score trained on harmfulness already has the orientation and operating meaning required for success prediction. Jailbreak benchmarks report attack success for one genera- tor and one judge. We retain both indices instead of treating success as a prompt property. Validity under distribution shift. Safety detectors can degrade as attack styles and source distributions change [8, 18, 27, 29]. Single source splits also overstate safety detec- 2 tor AUC by8.0to16.5points [8]. That work proposes leave one dataset out evaluation. The leave one dataset out control removes corpus identity. We apply each transformation to both classes so that the transformation cannot serve as the label. Our both sided design removes transformation identity. No transformation experiment in that work addresses this shortcut. We also separate ranking, calibration, and threshold transfer. This decomposition identifies which part of the score interpretation fails. AUROC is invariant to monotone score transformations while calibration and fixed thresholds are not. One fixed threshold metric therefore cannot support all three claims. That failure can be silent. Safety classifiers on frozen em- beddings fall from85%to chance ROC-AUC while mean confidence falls only 14% [29]. Probing as measurement. AAP uses a continuous embed- ding in the soft prompt and prefix tuning tradition [19, 20]. It provides a fixed measurement anchor instead of steering model behavior [37]. Passive, lexical, and norm matched con- trols test whether insertion, lexical content, or learning ex- plains the result [10]. Response magnitude alone does not establish construct validity, so we validate every channel on held out labels. Every realized outcome is generated without the probe. 3 Measurement Setting and Estimands Setting. We study a pre generation internal score computed from one eager attention prefill pass. The score has access to attention and hidden states. It sees the promptxbut not the realized completion. Measurement targets. LetH(x)∈0, 1denote harmful intent in the base request,W(x)∈0, 1the presence of a jailbreak wrapper, andY m (x)∈0, 1whether target model mactually emits a harmful completion under a frozen safety judge. We omit judge and decoding indices unless we vary them. An ineffective jailbreak hasW=H=1,Y m =0. An ef- fective jailbreak hasW=H=Y m =1. Evidence that a score measuresHestablishes construct validity for harmful intent. Prediction ofY m requires separate evidence. RQ1 audits that criterion claim. RQ2 tests whether validity forHsurvives a change in input distribution. Validity criteria. Construct validity asks whether the score ranks its training label. Outcome validity asks whether it ranksY m for a named target and judge. Decision validity asks whether a threshold keeps its operating behavior. Evidence for an earlier claim does not imply a later one. Deployment scope. We study a prompt side filter that blocks when the score exceeds a threshold. The relevant error in- cludes successful attacks that score below failed attacks. A fixed benign false positive budget measures how the ranking allocates blocking capacity between the two groups. 4 Audit Design Passive attention detectors aggregate locations determined by the prompt [12, 31]. A wrapper can therefore change both the input and the measurement location. AAP fixes this location. Letx = (x 1 ,..., x T )denote a tokenized chat prompt and let p θ ∈ R K×d denote a short probe embedding.I(x, p θ )inserts the probe into the system region after the chat template is materialized. The user tokens remain unchanged. AAP reads the attention response at the probe and maps it to a scalar score. A matched passive read uses the same template boundary without inserting the probe. Attention response. For layerℓ, headh, probe positions P(x, p), and final input position q, the response is z ℓ,h (x, p) = ∑ j∈P(x, p) A ℓ,h q j (I(x, p)).(1) The vector z(x, p)concatenates the monitored heads. XG- Boost maps this vector to a scoreS(x)∈ [0, 1]. Rare token, common token, norm matched, system span, passive atten- tion, and refusal logit channels test changes in probe content, insertion, location, and feature family. Response magnitude appears in the appendix. Training and separation. The primary probe hasK=3rows. We train it only on the BeaverTails training split and freeze it before every audit. No JailbreakHub [30], WildJailbreak, or JailbreakBench prompt selects the probe, heads, or harm- fulness readout. Every derived shift set starts from the held out test split. The harmfulness readout uses fixed constants and no validation search. The outcome supervised positive control selects regularization inside each cross validation fold. The appendix gives the optimization objective, initialization, head sensitivity, and continuous controls. The probe starts from safety semantic token embeddings. The objective maximizes the safe versus harmful attention gap on the training split and uses only the training selected 20head set. The dense RQ2 read and every held out domain stay unseen. Three controls separate prompt surface, response mag- nitude, and transferred ranking. Head selection is the first. Sparse head subsets are high variance across random draws, so RQ2 uses the dense read. Prompt surface is the second. A length only classifier gives AUROC from0.49to0.62, in- cluding settings where encoding makes prompts five times longer, so length does not carry the signal. Correlation be- tween derived sets is the third. Source clustered intervals are 0.94times as wide as unclustered intervals, so shared source prompts do not inflate significance. Scores useinputs_embedswith the probe present. All generations use the original prompt and ordinary chat tem- plate without the probe. No reported outcome is produced by a probe perturbed generation. The appendix measures the insertion effect. Next token symmetric KL has median0.22. 3 Refusal flips occur on7.5%of prompts. A separate genera- tion audit estimates a change in attack success of−0.03with a 95% CI of [−0.070, 0.007]. The appendix gives each control its read location, feature family, and readout. The safety semantic initialization alone does not reproduce the learned response. The gain comes from optimization and not from safety semantic content. These controls change one measurement choice at a time. They do not reimplement the published systems that motivated them. Matched target design. We cross harmful intent and wrap- ping while holding the base goal fixed. Forh, w∈0, 1, define μ hw = E[S(x)| H(x) = h,W(x) = w].(2) The balanced effects are τ H = 1 2 [(μ 10 − μ 00 )+(μ 11 − μ 01 )], τ W = 1 2 [(μ 01 − μ 00 )+(μ 11 − μ 10 )], τ HW = μ 11 − μ 10 − μ 01 + μ 00 . (3) τ H measures harmfulness,τ W measures the paired wrapper effect, andτ HW measures whether wrapping changes the harmfulness response.R H denotes harmful intent AUROC. R Y (S, m)denotes outcome AUROC for effective and ineffec- tive harmful prompts under targetm. The same design applies to Llama, Mistral, Qwen, Gemma, and Phi. The attention grids differ in layer and head count across these models. Equation 1 stays unchanged. Fixed score target substitution changes the generator while holding prompts, score source, decoding, and judge fixed. The target native ma- trix also changes the score source. This distinction separates generator effects from score architecture effects. RQ1 uses the20heads selected on the training split. RQ2 uses the dense set of all heads. Both specifications read the same extracted attention tensor and both produce an outcome AUROC below chance. A benign quantile rule fixes the nom- inal false positive rate for the deployment audit [2, 24]. The appendix provides the finite sample bound, subset sensitivity, and the check that the deployed score recomputes from that tensor. The rule uses the empirical1− αscore quantile ofmsafe calibration prompts. Sampling error and benign shift both loosen the guarantee. The audit therefore measures upper tail stability. It does not provide evidence about outcome validity. 5 Evaluation Setup. Llama-3.1-8B-Instruct is the primary target. Mistral, Qwen, Gemma, and Phi test transfer across attention archi- tectures. We curate BeaverTails [14] by removing duplicates and conflicting labels. The resulting pool contains1774safe and3671harmful prompts. A balanced set of1000prompts per class forms the training split. The held out split contains 774safe and2671harmful prompts. We split source prompts before creating paraphrase, multilingual, or encoding variants. Metrics. AUROC measures ranking. Brier score, ECE, and logistic recalibration slope measure probability calibration. Fixed and refitted F1 measure threshold transfer. Paired AU- ROC differences use DeLong tests and bootstrap95%inter- vals. AUROC counts tied scores at one half. An ideal proba- bility has a recalibration slope of one and an intercept of zero. We also report the F1 gap between a threshold frozen on the source domain and an oracle target threshold. The gap diag- noses the operating rule. It does not change the ranking score. The appendix reports every prespecified cell, the resampling units, and the complete statistical protocol. 5.1 Measurement Validation Before auditing what the score predicts, we establish that AAP is a meaningful and controlled measurement channel. This subsection validates the framework both audit questions rely on and makes no claim about what the score predicts. The frozen harmfulness readout reaches a train to test AUROC of0.985. Cross validation within the held out pool gives 0.957to0.982across the five architectures. We treat the latter range as a separability check because each fold fits part of the held out pool. A paired intervention study also shows that learned probes increase response magnitude over lexical and norm matched controls without consistently improving ranking. We therefore treat AAP, rare token, passive, system span, and refusal logit reads as parallel measurement channels. The audit does not use response amplification as evidence of validity. Norm matched controls confirm this distinction. Learned probes raise the response by at least sixteen times over a matched random probe on all three architectures, while lin- ear readout AUROC moves by at most0.06and favors the random probe on Llama. Norm matching therefore removes embedding norm as the sole explanation for amplification. A larger response does not guarantee a better ranking. 5.2RQ1: Does Harmfulness Validity Extend to Realized Success? We pair the100benign and100harmful goals in Jailbreak- Bench [6] with plain and wrapped versions. Five wrapper fam- ilies are balanced across intent classes. We freeze prompts, assignments, success criteria, and greedy decoding before inference. Llama Guard 3 provides the primary outcome la- bels [9, 13]. A frozen Qwen3-14B rubric relabels the cached completions. The score measures harmful intent but reverses success. Figure 2 states the finding in one picture, and the paragraphs below give the estimates behind it. AAP has a harmfulness effect ofτ H = 0.521with CI[0.458, 0.584], a wrapper effect ofτ W =−0.094, and an interaction ofτ HW =−0.257with CI [−0.359,−0.158]. Wrapping selectively lowers the score for harmful requests. Harmful intent AUROC falls from0.936to 4 Figure 2: Harmful intent ranking and realized success ranking separate. The left panel shows harmful intent AUROCR H and target outcome AUROCR Y for each channel. Intervals are bootstrap95%CIs and the dashed line marks chance. The right panel shows target specific success rates and outcome rankings for the same 100 wrapped harmful prompts. 0.803 while Llama harmful generation rises from0.05to0.27. Among the100wrapped harmful goals, the score ranks the27 successful attacks below the73failures. Outcome AUROC is 0.220 with CI [0.109, 0.343]. The induced outcome analysis reaches the same conclusion. Among95goals that Llama refuses without a wrapper,23 become successful after wrapping. A McNemar test on the paired plain and wrapped outcomes givesp = 3× 10 −6 . The score ranks these induced successes below the remaining fail- ures withR Y = 0.254and CI[0.129, 0.396]. The plain harm- ful prompts also show an inverse ranking withR Y = 0.128 and CI[0.025, 0.259]. The wrapper therefore does not create the reversal. What carries the signal is the wrapped score level rather than the plain to wrapped change, since ranking induced success by that paired difference gives an AUROC of only0.421. A goal level logistic model keeps the coeffi- cient negative after it controls the plain score, plain outcome, and wrapper family. Coefficients range from−0.59to−1.33 across Llama and Qwen specifications. Within family center- ing givesR Y = 0.333with CI[0.236, 0.444]. Family stratified pooling, family fixed effects, and leave one family out esti- mates all agree. Successful attacks have the lower mean score in all five families. Three families contain only two successes, so we do not estimate a separate AUROC for each family. Five sampled decodes giveR Y from0.202to0.252under three outcome definitions. Every interval excludes chance and the greedy label is representative. The appendix reports the full induced, family, and decoding analyses. The mismatch changes filter behavior. We set the threshold using benign prompts at a nominal5%false positive rate. The achieved rate is5.7%. The filter removes42.5%of failed at- tacks but only14.8%of successful attacks. The gap is−27.7 points with CI[−44.8,−8.8]. The filter admits23of the27re- alized jailbreaks. On the strong attack cohort,92%of success- ful attacks pass under either retained judge. Absolute harm still falls from27to23, and the score removes about2.6times as many successful attacks as random blocking for the same benign budget. The score is not worse than no filter. It spends the budget mainly on attacks that already fail. The harmful rate among admitted prompts rises from0.270to0.354. At a nominal10%false positive rate the achieved rate is11.1%. The filter blocks80.8%of failed attacks and29.6%of suc- cessful ones. The gap is−51.2points. Preexisting misses explain53%of leakage at the5%point. The wrapper main effect explains23%, and the inverse ranking explains24%. The inverse share rises to53%at the10%point. An outcome supervised score reduces the admitted harm rate to0.062at matched coverage. Rare token and passive channels show the same allocation pattern. Success information is available before generation. An outcome supervised readout uses the same internal features and grouped cross validation. Twenty five repeats keep ev- ery base goal within one fold. The readout reaches out of fold AUROC of0.930on wrapped harmful prompts and 0.939on all harmful prompts. It reaches0.875with CI [0.800, 0.939]when the test wrapper family is held out and 0.725with CI[0.680, 0.788]on WildJailbreak. Nested cross validation reproduces these values. A label permutation null gives0.497± 0.072. The best factorial baseline receives wrap- per family success rates and still trails the readout by0.156 on wrapped prompts. On WildJailbreak, a word level TF-IDF logistic model is the strongest baseline at0.651under the same protocol and regularization grid. The internal readout exceeds it by a paired margin from0.016to0.139. These re- sults show that the internal coordinates contain target specific success information. Qwen3 relabeling lowers the positive control ceiling to0.883but leaves the harmfulness score out- come AUROC at0.220. Judge dependence limits the positive control. Qwen3 identifies14successful prompts, all within the27prompts identified by Llama Guard. Their agreement hasκ = 0.61. The harmfulness score keeps the same outcome AUROC under both judges, but the Qwen3 labels cannot dis- tinguish within family success from the family success rate. We therefore use the positive control to establish the presence of outcome information. We use Llama Guard alone for the stronger claim about the goal level component. The result extends beyond AAP. Rare token, passive, sys- tem span, and refusal logit channels retain wrapped harmful- ness AUROC from0.751to0.828. Their outcome AUROC ranges from0.145to0.248. Each channel also has a negative harmfulness by wrapper interaction and an outcome inter- val entirely below chance. The passive channel inserts no tokens, so probe insertion does not create either effect. Llama Guard remains a strong harmfulness discriminator and gives an outcome AUROC of0.507. On350natural WildJailbreak prompts with133effective attacks, AAP outcome AUROC is 0.359. Llama Guard reaches0.625on the same cohort. That value exceeds every internal channel and its own matched de- 5 ScoreLlamaMistralQwen Llama .220 [.109,.343] .491 [.363,.623] .163 [.024,.358] Mistral .292 [.183,.411] .470 [.345,.598] .190 [.061,.343] Qwen .172 [.085,.275] .386 [.272,.505] .078 [.027,.139] Wrapped success rate.27.70.10 Table 1: Outcome AUROCR Y for the same100wrapped harmful goals. Rows identify the native score and columns identify the generator. Entries include bootstrap 95% CIs. sign value. Rare token, passive, and perplexity channels give 0.374,0.449, and0.487[1]. The matched design remains the basis for the main claim. Across five probe seeds, wrapped harmfulness AUROC stays from0.770to0.861and outcome AUROC stays from0.130to0.246. Per head analysis local- izes the mismatch with Spearmanρ =−0.85across1024 heads. The appendix reports the mechanical null that limits this analysis to a descriptive role. Targets change the outcome, not the conclusion. Table 1 recomputes the score on Llama, Mistral, and Qwen. Six of nine intervals lie below chance and none lies above chance. Mistral already complies with0.68of plain harmful requests, so wrapping barely raises its success rate. Its outcome AU- ROC near chance is therefore uninformative about an induced attack effect. Fourteen Mistral goals change from failure to success and twelve change in the opposite direction. McNe- mar testing givesp = 0.85. Five sampled decodes also show that target outcomes disagree at a rate of0.81against a no target effect null of0.29. Pairwise native score correlations are only0.42to0.54. Native recomputation does not recover a positive outcome ranking. Strong attacks and independent judges reproduce the pat- tern. We evaluate GCG, AutoDAN, AutoDAN-Turbo, PAIR, TAP, Best-of-N, and Many-shot [3, 7, 11, 22, 23, 26, 38]. Ta- ble 2 reports Llama Guard 3, Qwen3, and a StrongREJECT rubric [32]. We exclude the StrongREJECT column from in- ference because the available substitute marks many verbatim refusals as successful. That leaves fourteen attack cells, which with the nine target cells of Table 1 make twenty three in total. Six of the nine and six of the fourteen have intervals below chance, and no interval lies above chance. A bootstrap clus- tered by goal and attack family gives a pooled outcome AU- ROC of0.313with CI[0.212, 0.422]andp = 0.0006. Those twenty three cells share one pool of200base goals, and the same clustered bootstrap gives a design effect of9.3, or about 2.5independent units, so we report no sign test over cells. Qwen3 is independent of the search procedure for GCG, Au- toDAN, PAIR, and TAP. GCG and AutoDAN remain below chance under Qwen3 after BH FDR correction. Pooled logis- tic models also control the plain goal score and attack family. They retain negative score coefficients of−0.54under Llama A. Attack success rate AttacknLG3SRQ3 Best-of-N200 .10→.94 .30→.73 .04→.26 Many-shot200 .10→.18 .32→.30 .03→.18 GCG100 .11→.17 .28→.25 .02→.09 AutoDAN100 .05→.34 .29→.49 .03→.20 PAIR100 .05→.52 .26→.78 .01→.07 TAP50 .02→.16 .20→.46 .00→.06 AutoDAN-Turbo50 .02→.38 .22→.51 .00→.14 B. Outcome AUROC R Y AttacknLG3SRQ3 Best-of-N200.35.43.54 Many-shot200.48.53.49 GCG100.19.27.26 AutoDAN100.20.14.24 PAIR100.48.38.43 TAP50.31.25.21 AutoDAN-Turbo50.28.25.51 Table 2: Strong attack results on Llama. Panel A reports plain to attacked success rates. Panel B reports outcome AUROC. LG3 and Q3 are Llama Guard 3 and Qwen3. SR is shown for transparency and excluded from inference. Guard and−0.35under Qwen3. Base goal clustered intervals exclude zero for both judges. Every attack row pairs the plain and attacked version of the same goal under the frozen Llama scorer. Then = 200rows combine JailbreakBench and HarmBench [25]. The Stron- gREJECT substitute marks about30%of verbatim refusals as successful and also fires on benign controls. The inverse ranking survives strict consensus and union labels in the ap- pendix. We found a checkpoint defect in our own pipeline and regenerated five search based rows. No conclusion changes. The appendix reports the repair and every interval. Qwen3 agrees with Llama Guard on0.87of wrapped Llama outcomes and on only0.66for Mistral. It preserves the AAP, rare token, and passive inverse rankings on Llama. These results show that one judge does not create the matched reversal. They do not remove the broader uncertainty from automated outcome labels. Attention dilution does not explain the reversal. Fixing the probe position does not fix its share of the softmax, and at- tacks can target that share directly [33]. Wrapping lowers total attention to the system region from0.383to0.225. Dividing by system region attention is a clean dilution control because that region holds a constant13tokens and the wrapper lands in the user turn, so the denominator is a fixed competition set. The outcome ranking remains inverse after that normaliza- tion and after normalizing by the full attention row. Sequence length is not the driver either, since prompt length explains only4%of score variance. The appendix reports both nor- malizations, the retrained normalized readout, and the probe perturbation audit. Together, these results are consistent with a representa- 6 tional decoupling account. Wrapping may weaken features used by a readout trained on harmful intent while separately changing the model processes that govern compliance. The passive and refusal logit results argue against probe insertion as the source, and the outcome supervised readout shows that success information remains available. We treat this account as a hypothesis because the audit does not identify a unique causal pathway. RQ1 finding. A score that ranks harmful intent well can rank realized jailbreak success in the opposite direction. Harmfulness validation does not establish validity for success prediction. 5.3RQ2: Does Harmfulness Validity Survive Distribution Shift? RQ1 shows that validating a score against one construct does not license reading it as a predictor of another. We now ask whether the score stays valid for the construct it does measure once the input distribution changes. A shift can break that reading in three ways. The ranking of harmful above benign can fail, the numerical meaning can fail while the ranking holds, or only the transfer of a previously chosen threshold can fail while both hold. A single fixed threshold number cannot say which occurred. We therefore keep the construct fixed as harmful intent and vary the input distribution. Meaning preserving shifts include WildJailbreak, paraphrases, and English, Chinese, French, and Japanese translations [15]. Surface transformations include base64, rot13, and caesar encoding. We apply every transfor- mation to both classes. This design prevents the transforma- tion from serving as the label. Readout family is a material source of variation. Logistic regression and a linear SVM match the source AUROC near 0.98. Their mean AUROC across the same shifted domains falls to0.55and0.64, compared with0.75for XGBoost. On the Japanese condition, the linear readouts reach0.01to0.08 and XGBoost reaches0.228. We keep XGBoost fixed as the primary readout and give the analysis in the appendix. The Japanese result is an inversion with a known transfor- mation artifact. Translated prompts have2.4times the charac- ter trigram similarity of the English source text. The Japanese transformation therefore collapses prompts toward a shared register. Its orientation free AUROC is1− 0.228 = 0.772, close to the Chinese and French range. We retain the row as a readout sensitivity case and do not treat it as clean evidence of semantic robustness failure. Thresholds fail before rankings. Table 3 shows that the frozen decision rule loses more F1 than the score loses AU- ROC on meaning preserving shifts. The source readout is not a calibrated probability. Its slope is0.545. The slope column is an in sample Cox fit. Platt scaling on a frozen source slice changes the slope to1.019and ECE from0.045to0.009. The calibrated source rule reaches WildJailbreak F1 of0.667 without target labels. The oracle reaches0.678. The gap re- DomainAUROC ECE slope F1@0.5 F1@τ 20% In distribution0.9850.045 0.540.9250.937 WildJailbreak0.8500.366 0.510.5590.664 Paraphrase0.8580.203 0.320.7340.769 English round trip0.9870.041 0.760.9500.950 Multilingual (zh)0.8020.247 0.430.7310.719 Multilingual (fr)0.7780.232 0.420.6880.749 Table 3: Ranking, calibration, and threshold transfer under meaning preserving shifts. F1@0.5 freezes the source thresh- old. F1@τ 20% relocates only the threshold using a labeled target slice. mains from0.006to0.020on domains where AUROC stays from0.76to0.86. This repair is not universal. On the En- glish round trip control, source calibration changes ECE from 0.041to0.171and slope from0.761to1.488. The frozen calibration map can therefore harm a domain that already ranks well. The appendix reports the remaining calibration checks. The appendix separates a score that was never calibrated from a score whose calibration changes under shift. The source map repairs the source domain and improves five shifted domains. It does not restore a probability interpre- tation everywhere. The encoding slopes remain near zero because the ranking has disappeared. The Japanese slope re- mains negative because the class ordering has reversed. No monotone calibration map can repair either case. The rank- ing loss also replicates across architectures. Mistral, Qwen, Gemma, and Phi repeat the WildJailbreak evaluation and their AUROC falls to a range of 0.60 to 0.85. Prevalence explains only part of threshold shift. We reweight each domain to a common balanced class prior. AUROC is unchanged. The source common prior threshold reaches WildJailbreak F1 of0.790, compared with an oracle value of0.796. HiddenDetect and refusal direction scores keep larger threshold gaps under the same audit, while the AttentionDefense style channel is better calibrated than AAP on WildJailbreak. Every score family loses separation on both class base64. A benign only quantile rule holds its nominal false positive rate in distribution and nearly matches oracle recall on paraphrase and English prompts. Under benign shift its WildJailbreak recall falls to0.03against an oracle of0.25. This identifies benign tail stability as a separate requirement. The appendix reports the per score common prior table. Both class encoding removes harmfulness separation. En- coding only harmful prompts gives AUROC from0.85to 0.89. A model free character entropy statistic reaches AU- ROC0.997to1.000on that single class comparison and 0.513on unencoded prompts. Encoding both classes gives 0.51,0.50, and0.52for base64, rot13, and caesar. Mistral, Qwen, Gemma, and Phi reproduce a mean AUROC from0.50 to0.51. The single class design measures a transformation cue. The both class design shows that the score loses harm- 7 fulness separation when the cue is unavailable. RQ2 finding. Distribution shift can change calibration and thresh- old transfer while ranking survives. Stronger surface shifts can also remove the harmfulness ranking itself. 6 Discussion and Limitations Implications. A benchmark should name the construct at- tached to each label: harmfulness detection requiresHand R H , whereas realized success requires generations andY m in- dexed by target, decoding policy, and judge. A complete audit should report harmful-intent ranking on held-out prompts, realized outcomes for protected targets, and blocking at a fixed benign budget. The evaluated thresholds reduce abso- lute harm but allocate blocks poorly within the harmful cohort, assigning lower scores to successful attacks; low harmfulness therefore does not imply refusal. Limitations. Outcome labels are automated, without a blinded human audit, and three-judge agreement is low (Fleiss κ≈ 0.3); judge choice thus changesY m but does not itself sup- port our thesis. Llama Guard guides several attack searches, leaving only the rubric judges independent for those rows. Primary outcomes use one greedy decode; five sampled de- codes preserve the factorial result, whereas the strong-attack and shift results remain single-draw. The Llama and Qwen cells contain only27and10positives, and the targets are not difficulty-matched, so they show a range of behavior rather than a controlled comparison. Strong attacks and derived chan- nels are evaluated on Llama; only Best-of-N and Many-shot were repeated on Mistral and Qwen. Probe insertion perturbs the prefill, although outcomes use unmodified prompts. The Japanese transform contains an artifact, and the lowest OOD results depend on readout family. Scope and artifacts. The estimates cover only the tested prompts and checkpoints, so new deployments require new outcome audits. The matched factorial design supports the main claim. WildJailbreak and strong attacks are uncontrolled external checks. We release an artifact containing the anal- ysis code, configurations, tests, and publication-aligned nu- meric aggregates athttps://github.com/kuangren777/ aap-audit. 7 Conclusion A strong harmful intent AUROC does not establish that a score can predict jailbreak success. Our matched audit shows that the score can place successful attacks below failed attacks. The result persists across measurement channels, targets, at- tack families, and independent judges. Distribution shift can also change the original harmfulness interpretation. Harmful intent and realized success require separate validation. References [1]Gabriel Alon and Michael Kamfonas. Detecting lan- guage model attacks with perplexity. arXiv preprint arXiv:2308.14132, 2023. [2]Anastasios N. Angelopoulos and Stephen Bates. A gentle introduction to conformal prediction and distribution-free uncertainty quantification.arXiv preprint arXiv:2107.07511, 2021. [3]Cem Anil, Esin Durmus, Nina Panickssery, Mrinank Sharma, Joe Benton, Sandipan Kundu, Joshua Batson, Meg Tong, Jesse Mu, Daniel Ford, et al. Many-shot jailbreaking. NeurIPS, 37:129696–129742, 2024. [4] Andy Arditi, Oscar Obeso, Aaquib Syed, Daniel Paleka, Nina Panickssery, Wes Gurnee, and Neel Nanda. Refusal in language models is mediated by a single direction. In Advances in Neural Information Processing Systems (NeurIPS), 2024. [5]Sarah Ball, Frauke Kreuter, and Nina Panickssery. Un- derstanding jailbreak success: A study of latent space dynamics in large language models. In Conference of the European Chapter of the Association for Computa- tional Linguistics (EACL), 2026. arXiv:2406.09289. [6] Patrick Chao, Edoardo Debenedetti, Alexander Robey, Maksym Andriushchenko, Francesco Croce, Vikash Se- hwag, Edgar Dobriban, Nicolas Flammarion, George J. Pappas, Florian Tramèr, Hamed Hassani, and Eric Wong. JailbreakBench: An open robustness benchmark for jail- breaking large language models. In Advances in Neural Information Processing Systems, volume 37, 2024. [7]Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J Pappas, and Eric Wong. Jail- breaking black box large language models in twenty queries. arXiv preprint arXiv:2310.08419, 2023. [8]Max Fomin. When benchmarks lie: Evaluating ma- licious prompt classifiers under true distribution shift. arXiv preprint arXiv:2602.14161, 2026. [9] Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, et al. The Llama 3 herd of models. arXiv preprint arXiv:2407.21783, 2024. [10]John Hewitt and Percy Liang. Designing and interpret- ing probes with control tasks. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP), pages 2733–2743, 2019. 8 [11]John Hughes, Sara Price, Aengus Lynch, Rylan Scha- effer, Fazl Barez, Sanmi Koyejo, Henry Sleight, Erik Jones, Ethan Perez, and Mrinank Sharma. Best-of-n jailbreaking. arXiv preprint arXiv:2412.03556, 2024. [12] Kuo-Han Hung, Ching-Yun Ko, Ambrish Rawat, I-Hsin Chung, Winston H. Hsu, and Pin-Yu Chen. Attention tracker: Detecting prompt injection attacks in LLMs. arXiv preprint arXiv:2411.00348, 2025. [13]Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, and Ma- dian Khabsa. Llama guard: LLM-based input-output safeguard for human-ai conversations. arXiv preprint arXiv:2312.06674, 2023. [14]Jiaming Ji, Mickel Liu, Josef Dai, Xuehai Pan, Chi Zhang, Ce Bian, Boyuan Chen, Ruiyang Sun, Yizhou Wang, and Yaodong Yang. BeaverTails: Towards im- proved safety alignment of LLM via a human-preference dataset. In Advances in Neural Information Process- ing Systems (NeurIPS) Datasets and Benchmarks Track, 2023. [15]Liwei Jiang, Kavel Rao, Seungju Han, Allyson Ettinger, Faeze Brahman, Sachin Kumar, Niloofar Mireshghallah, Ximing Lu, Maarten Sap, Yejin Choi, and Nouha Dziri. WildTeaming at scale: From in-the-wild jailbreaks to (adversarially) safer language models. In Advances in Neural Information Processing Systems (NeurIPS), 2024. [16]Yilei Jiang, Xinyan Gao, Tianshuo Peng, Yingshui Tan, Xiaoyong Zhu, Bo Zheng, and Xiangyu Yue. Hidden- Detect: Detecting jailbreak attacks against large vision- language models via monitoring hidden states. arXiv preprint arXiv:2502.14744, 2025. [17]Nathalie Maria Kirch, Constantin Niko Weisser, Severin Field, Helen Yannakoudakis, and Stephen Casper. What features in prompts jailbreak LLMs? investigating the mechanisms behind attacks. In BlackboxNLP Workshop at EMNLP, 2025. arXiv:2411.03343. [18]Kimin Lee, Kibok Lee, Honglak Lee, and Jinwoo Shin. A simple unified framework for detecting out- of-distribution samples and adversarial attacks.In Advances in Neural Information Processing Systems (NeurIPS), 2018. [19] Brian Lester, Rami Al-Rfou, and Noah Constant. The power of scale for parameter-efficient prompt tuning. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing (EMNLP), 2021. [20]Xiang Lisa Li and Percy Liang. Prefix-tuning: Optimiz- ing continuous prompts for generation. In Proceedings of the 59th Annual Meeting of the Association for Com- putational Linguistics (ACL), 2021. [21]Yuping Lin, Pengfei He, Han Xu, Yue Xing, Makoto Yamada, Hui Liu, and Jiliang Tang. Towards under- standing jailbreak attacks in LLMs: A representation space analysis. In Conference on Empirical Methods in Natural Language Processing (EMNLP), 2024. [22]Xiaogeng Liu, Peiran Li, Edward Suh, Yevgeniy Vorob- eychik, Zhuoqing Mao, Somesh Jha, Patrick McDaniel, Huan Sun, Bo Li, and Chaowei Xiao. AutoDAN-Turbo: A lifelong agent for strategy self-exploration to jailbreak LLMs. In International Conference on Learning Repre- sentations (ICLR), 2025. [23] Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. AutoDAN: Generating stealthy jailbreak prompts on aligned large language models. In International Confer- ence on Learning Representations (ICLR), 2024. [24]Pascal Massart. The tight constant in the Dvoretzky– Kiefer–Wolfowitz inequality. The Annals of Probability, 18(3):1269–1283, 1990. [25]Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, David Forsyth, and Dan Hendrycks. HarmBench: A standardized evaluation framework for automated red teaming and robust re- fusal. In International Conference on Machine Learning (ICML), 2024. [26]Anay Mehrotra, Manolis Zampetakis, Paul Kassianik, Blaine Nelson, Hyrum Anderson, Yaron Singer, and Amin Karbasi. Tree of attacks: Jailbreaking black-box LLMs automatically. In Advances in Neural Information Processing Systems (NeurIPS), 2024. [27] Julien Piet, Xiao Huang, Dennis Jacob, Annabella Chow, Maha Alrashed, Geng Zhao, Zhanhao Hu, Chawin Sitawarin, Basel Alomair, and David Wagner.Jail- breaksOverTime: Detecting jailbreak attacks under dis- tribution shift. arXiv preprint arXiv:2504.19440, 2025. [28] Protect AI. Rebuff: A self-hardening prompt injection detector.https://github.com/protectai/rebuff, 2023. [29] Subramanyam Sahoo, Vinija Jain, Divya Chaudhary, and Aman Chadha. I can’t believe it’s not robust: Catas- trophic collapse of safety classifiers under embedding drift. arXiv preprint arXiv:2603.01297, 2026. 9 [30]Xinyue Shen, Zeyuan Chen, Michael Backes, Yun Shen, and Yang Zhang. “Do Anything Now”: Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models. In Proceedings of the 2024 ACM SIGSAC Conference on Computer and Communications Security, pages 1671–1685. ACM, 2024. [31] Charlotte Siska and Anush Sankaran. AttentionDe- fense: Leveraging system prompt attention for explain- able defense against novel jailbreaks. arXiv preprint arXiv:2504.12321, 2025. [32]Alexandra Souly, Qingyuan Lu, Dillon Bowen, Tu Trinh, Elvis Hsieh, Sana Pandey, Pieter Abbeel, Justin Sveg- liato, Scott Emmons, Olivia Watkins, and Sam Toyer. A StrongREJECT for empty jailbreaks. In Advances in Neural Information Processing Systems (NeurIPS), 2024. [33]Zijun Wang, Haoqin Tu, Jieru Mei, Bingchen Zhao, Yisen Wang, and Cihang Xie. AttnGCG: Enhancing jailbreaking attacks on LLMs with attention manipula- tion. arXiv preprint arXiv:2410.09040, 2024. [34]Yueqi Xie, Minghong Fang, Renjie Pi, and Neil Zhen- qiang Gong. GradSafe: Detecting jailbreak prompts for LLMs via safety-critical gradient analysis. In Proceed- ings of the 62nd Annual Meeting of the Association for Computational Linguistics (ACL), 2024. [35]Yanchen Yin, Dongqi Han, and Linghui Li. Robust harmful features under jailbreak attacks: Mechanistic evidence from attention head specialization in large lan- guage models. arXiv preprint arXiv:2606.28153, 2026. [36]Xiaoyu Zhang, Cen Zhang, Tianlin Li, Yihao Huang, Xiaojun Jia, Ming Hu, Jie Zhang, Yang Liu, Shiqing Ma, and Chao Shen. JailGuard: A universal detection frame- work for LLM prompt-based attacks. arXiv preprint arXiv:2312.10766, 2024. [37] Andy Zou, Long Phan, Sarah Chen, James Campbell, Phillip Guo, Richard Ren, Alexander Pan, Xuwang Yin, Mantas Mazeika, Ann-Kathrin Dombrowski, et al. Rep- resentation engineering: A top-down approach to ai transparency. arXiv preprint arXiv:2310.01405, 2023. [38]Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J. Zico Kolter, and Matt Fredrikson. Universal and trans- ferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043, 2023. A Additional Ablations These ablations support the measurement and evaluation choices in the main paper. Probe optimization. The learnedK=3continuous probe is initialized from safety-semantic token embeddings and op- timized only on the BeaverTails training split with Adam, learning rate10 −3 ,50optimizer updates, each on a freshly sampled mini-batch of20prompts per class. The objective is L(p) =− 1 |H|K ∑ h,k ̄z safe h,k (p)− ̄z attack h,k (p) + 0.1 ̄z safe (p)+ 0.01∥ p∥ row . (4) The first term maximizes the absolute source-domain atten- tion gap, the second discourages high safe-prompt attention, and the last controls row-wise embedding norm. No OOD or target-audit prompt is used for probe or readout selection. Benign-only quantile rule. For trusted safe calibration prompts C 0 =x i m i=1 and false-positive budget α, we set b τ α = b Q 1−α s θ (x i ; p) : x i ∈ C 0 , b y(x) = I[s θ (x; p) > b τ α ]. (5) The Dvoretzky–Kiefer–Wolfowitz bound gives sampling er- ror p log(2/δ)/(2m). Benign shift addsγ d = sup t |F 0,d (t)− F 0,cal (t)|. The diagnostic therefore identifies upper-tail stabil- ity rather than outcome validity. Head-coverage sensitivity. Sparse20-head subsets are high- variance. Across40random20-head draws the minimum AUROC over nine OOD domains is0.60± 0.15(95% CI [0.25, 0.83]), and the layer-diverse and safety-ranked heuris- tics fall at the65th and47th percentiles of that distribution, inside the noise. We therefore report the all-head read as a fixed measurement specification and treat subset choice as a sensitivity analysis. Readout sensitivity. The in-distribution result is similar for XGBoost, logistic regression, and linear SVM (5-fold AU- ROC≈0.98). Under shift, however, the dense all-head result depends on the readout family: linear probes on the full fea- ture degrade far more than the tree readout on the lowest- ranked both-sided domains (Japanese:0.01–0.08against XG- Boost’s0.228). We therefore report XGBoost as the fixed primary readout and make this dependence explicit. Surface-form and correlation controls. Prompt length does not drive the signal: a length-only classifier is near chance ev- erywhere (0.49–0.62AUROC), including on encoding where attacks are5×longer. We recompute confidence intervals with a bootstrap clustered by source prompt, because the en- coding, paraphrase and multilingual sets share source prompts. The clustered interval is0.94×as wide as the unclustered in- terval (a6%narrowing), so within-source correlation does not inflate our significance. Finally, exploratory retraining shows that increasing the in-distribution attention gap can reduce OOD AUROC toward chance. Response magnitude and transferred ranking are therefore empirically distinct. Norm-matched continuous controls. We construct a random three-vector probe with each row normalized to the corre- sponding learned row norm. It therefore has the same length, 10 insertion coordinate, dtype, and per-row embedding norm as the learned probe. On100 + 100BeaverTails prompts, the Llama learned/random controls give response magni- tude1.008/0.046and linear-readout AUROC0.931/0.944. Mistral gives2.054/0.124and0.964/0.906. Qwen gives 0.802/0.030and0.932/0.896. The control rules out embed- ding norm as the sole source of amplification, while the dif- fering ranking outcomes illustrate the architecture-dependent amplification–ranking interaction. Qwen’s non-finite entries affect fewer than0.2%of responses and are excluded only from aggregate estimation. Relative-anchor feature. We also tested a relative feature r ℓ,h = log (A probe ℓ,h + ε)/(A ctrl ℓ,h + ε) that normalizes probe at- tention by the matched natural-control read at the same head, intended to cancel sequence-length and global-attention drift across domains. On WildJailbreak (with per-prompt aligned probe/control features), the relative feature alone underper- forms the raw probe read (AUROC0.744vs0.803), while concatenating raw and relative features gives only a marginal gain (0.816). The relative feature varies across domains and the concatenated representation changes WildJailbreak AU- ROC only marginally. The reported analysis therefore uses the pre-specified raw attention read. Factorial intervention details. The nine paired conditions are a natural three-token system control. Rare probes with1,3, and5IDs. A shuffled rare probe. Independently sampled rare IDs. Common IDs. Safety-semantic IDs, and the default rare triplet inserted at the user midpoint. Linear probes on the full head-response vector remain strong in distribution (mean five- fold AUROC0.95–0.99across the three displayed conditions and models), even when the scalar mean response has the opposite orientation. This confirms that the information is multivariate and cautions against interpreting the sign of an all-head average as classifier performance. Qwen produced non-finite values for fewer than0.11%of head responses in these runs. Raw arrays were retained, while only summary estimation replaced non-finite entries by zero. Substituting exclusion or median imputation for the zero fill changes the reported statistics by less than their quoted precision, since the affected fraction is under 0.2%. Hybrid representation. A hybrid variant concatenates the final-position projection onto a refusal direction and the hidden-state norm to the attention response. It is not used for any RQ1 or RQ2 estimate in the main paper. We report it only because the in-distribution measurement-validation num- bers quote both variants, where it tracks the attention-only readout to within 0.005 AUROC on every architecture. Strong-attack budgets and goal subsets. The seven attacks do not share one goal list, which is why their unattacked success rates differ. Then = 200rows (Best-of-N, Many- shot) pool JailbreakBench and HarmBench harmful goals. GCG, AutoDAN and PAIR use100goals each and TAP and AutoDAN-Turbo use50, drawn from the same pool but not identical subsets, so the plain-prompt rate in Panel A varies by row (for example0.11for GCG against0.05for AutoDAN under Llama Guard) and rows should be compared to their own plain column rather than to one another. Search budgets were fixed before running: GCG uses40optimization rounds with early stopping once the target negative log-likelihood falls below0.10. The tree and lifelong-memory searches (TAP, AutoDAN-Turbo) run at depth, width and branching factor2 because of their cost. Best-of-N and Many-shot use their pub- lished sampling and shot budgets. All greedy attacks decode 256new tokens, while query and sampling attacks retain their search-time winning completion. Goal-difficulty control. The pooled model quoted in the main text is, for each judge, logit Pr(Y i = 1) = β 0 + β S e S i + β P e S plain i + γ a(i) ,(6) where e S i is the standardized score of the attacked prompt, e S plain i the standardized score of the same base goal unattacked, andγ a an attack-family effect. Intervals come from a bootstrap that resamples base goals as clusters. B A Checkpoint Defect and Its Repair While auditing the strong-attack table we found, and then fixed, a real defect in our own pipeline. We report it in full because it changes five rows of that table and because the failure mode is easy to reproduce in any resumable evaluation harness. Mechanism. Both the scoring and the generation stages re- sumed from a checkpoint that was validated by length only, restarting atlen(cached)in a prompt list rebuilt from a mutable manifest. Each attack script also has a smoke-test truncation. A pilot run oversgoals produced a short manifest and complete checkpoints. The subsequent full run overwrote the manifest withBgoals and silently reused the stale check- points as a prefix, displacing records by exactlyk = 2(B− s) positions. The displaced block lands on the wrong goals, be- cause the records are laid out with the benign class first. Proof and scope. Per-prompt scores are computed one prompt at a time on a frozen detector, so records sharing a base goal must be byte-equal across cells. Under the fitted kthe displaced value equals the consensus value at position i+ kfor every disagreeing record, on all five stored artifacts and in all five affected cells, and the fittedkmatches2(B− s) in each. Five of twelve cells are affected, namely GCG, Au- toDAN, AutoDAN-Turbo, PAIR and TAP, all on the Llama target. Best-of-N and Many-shot are clean on all three targets. The attack stage itself is immune because its checkpoint is keyed by goal identifier, so no attacked prompt needed to be recomputed. The defect touched240completions and320 scores. The score stage is corrupted for more records than the completion stage because scoring runs over all records while generation runs only over those still missing a completion. 11 Effect on the results. We regenerated the affected cells with an assignment bound to the record identifier, preserving each attack’s original completion semantics: GCG and AutoDAN are greedy throughout, whereas the query attacks retain their search-time winning completion, whose identity binding we re-verified against the attack checkpoint (400/400matched on both prompt and completion). Ten of the fifteen repaired attack-by-judge rows are bit-identical to the published ones, because most of the displaced records fell in the benign half of the record list, which neither ASR norR Y reads. The five that move are the three GCG rows and the rubric entries for Auto- DAN and AutoDAN-Turbo. GCG moves and strengthens:R Y becomes0.189/0.264under Llama Guard and Qwen3, and its Qwen3 interval now excludes chance where it previously did not. Among the fourteen retained attack-by-judge cells the count significantly below chance is unchanged at six, with GCG–Qwen3 entering and TAP–Llama Guard leaving. No conclusion in the paper changes. CPer-Head Decomposition and Its Mechani- cal Null Per-head decomposition. We re-extracted the per-head probe response for the locked400-prompt factorial cohort as a dense tensor of shape400× 32× 32× 3(prompt×layer×head× probe position). Recomputing the deployed scalar score from this tensor reproduces the cached per-prompt scores bitwise (Pearsonr = 1.000, maximum absolute deviation0over all 400prompts), so the per-head features come from exactly the computation that produced every reported number. Three independent extractions were byte-identical. Scoring each of the1024heads on its own, per-head harmful-intent AUROC and per-head outcome AUROC vary widely, and the two are strongly anti-correlated (Pearson −0.845, Spearman−0.849). The five heads that rank in- tent best averageR Y = 0.117and the twenty best average R Y = 0.121. We do not quote any individual head’s value: with27positives, a maximum taken over1024heads is not interpretable in sample. This anti-correlation is mostly mechanical, and we say so rather than reading it as functional specialization. Any head that ranks intent well would anti-rank outcome with no spe- cialization involved at all, were the outcome a deterministic threshold on the aggregate score. Simulating exactly that null, matched to the observed positive count and to the observed aggregateR Y , already produces a mean head-level Spearman correlation of−0.71(95% range[−0.83,−0.48]) along the published score direction, and−0.82along an alternative ag- gregate direction, where the null range covers our observed value outright. Our observed−0.849sits outside the null band for the published direction (p = 0.006) and the partial correlation controlling each head’s loading on the aggregate direction is−0.59, also outside its null band, so a residual component survives, but the effect is not robust to the choice of aggregate direction, and we therefore report the decom- position as a localization of where the two criteria diverge rather than as evidence that distinct heads encode distinct con- structs. By layer band, early heads (layers0–10) are at chance on both criteria (R H 0.510,R Y 0.510), while middle (11–21) and late (22–31) heads discriminate intent and anti-rank out- come (0.708/0.267and0.724/0.260as head means,0.098 and0.104when the band is aggregated into a single score). Outcome-informative heads nevertheless exist:266heads haveR Y > 0.5in sample and22survive a max-statistic per- mutation correction at the family-wise level, against roughly five expected under the matched null. The dense all-head read givesR H = 0.882withR Y = 0.087, and the deployed twenty- head read gives0.803with0.220. The qualitative conclusion is the same under both. Wrapper-family stratification. Three of the five wrapper families produce only two successes each, so no per-family outcome AUROC is estimable and the marginal estimate is dominated by families with more events. Within-family centering givesR Y = 0.333(CI[0.236, 0.444], bootstrap p = 0.003, permutationp = 0.011) and Mantel–Haenszel stratified pooling gives0.323(CI[0.178, 0.472],p = 0.020). Leave-one-family-out estimates range over0.296–0.345. Only15.4%of the1971discordant pairs are within-family, which is why the stratified estimate is the less precise of the two. Restricting to the two adequately powered fami- lies gives0.313with an interval that just touches chance ([0.144, 0.503]). Between families, mean score and attack suc- cess are negatively related but not significantly so with five points (Pearson−0.77, p = 0.13). We deliberately do not rest homogeneity on a non- significant interaction test. A power simulation calibrated to the observed family intercepts shows that the score-by- family interaction likelihood-ratio test on these data has a rejection rate of≈0.16both under a true null and under an alternative in which one family’s slope is fully sign-flipped: its power equals its type-I rate, so a non-rejection carries no information. The homogeneity evidence we do report is sign consistency: in all five families the successful attacks have the lower mean score (differences−0.34,−0.36,−0.31,−0.10, −0.03). Outcome-supervised readout. Training on the outcome label with grouped repeated cross-validation (25 repeats, base goal never spanning folds) gives out-of-fold AUROC0.930on the wrapped harmful cohort,0.939on all harmful prompts, and 0.725(CI[0.680, 0.788]) on the 350-prompt WildJailbreak au- dit, against label-permutation nulls of0.50± 0.07(p = 0.005 in each case). Leave-one-wrapper-family-out gives0.875(CI [0.800, 0.939]). Nested cross-validation reproduces these val- ues, so selecting the regularization strength is not the source of the advantage. We quote bootstrap intervals rather than the spread across cross-validation repeats, which is not a confi- dence interval because the folds are not independent. 12 Every baseline is refitted under the readout’s own protocol and its own regularization grid, and the two cohorts must be read separately. On the JailbreakBench factorial cohorts the baselines span0.62–0.80. The strongest is not a text model but an oracle that is told each wrapper family’s empirical success rate, and the readout still leads it by+0.156(wrapped cohort) and+0.134(all harmful). On WildJailbreak neither a wrapper-identity nor a plain-goal baseline exists, since those prompts are naturally occurring adversarial phrasings with no synthetic family and no matched unwrapped counterpart. There the baselines reach only0.48–0.65, the best being a word-level TF-IDF logistic model at0.651, a difference of 0.074whose paired estimate is+0.077(CI[+0.016,+0.139], p = 0.007). An earlier draft quoted a0.087margin on this cohort. That figure came from an inconsistent protocol in which the baselines were left untuned, and is superseded by the paired estimate above. This result is judge-dependent in a way the main text notes and we detail here. Relabelling the same cohort with the frozen Qwen3 rubric leaves the inverse ranking essentially unchanged (R Y = 0.2201versus0.2202under Llama Guard), but that rubric records only14successes, a strict subset of Llama Guard’s27withκ = 0.61, and under it the supervised ceiling falls to0.883with the within-family component no longer resolvable. The claim that outcome information is present survives both judges. The claim that it is goal-level rather than wrapper-level is established only under Llama Guard labels. D Deployment Risk and Normalization Con- trols Operating points. We calibrate the block threshold on benign prompts only, splitting the held-out in-distribution safe pool in half so that calibration and verification are disjoint, and we report the achieved false-positive rate on the verification half (5.7%at a nominal5%,11.1%at a nominal10%). At nominal rates of0.1%and1%the threshold sits above every score in this cohort and nothing is blocked. That is a score- scale shift between the calibration corpus and JailbreakBench rather than a property of the detector, and repeating the exer- cise with cohort-matched benign prompts makes those rows live without changing the picture. At5%the filter removes 55%of plain harmful prompts and35%of wrapped ones. Within the wrapped cohort that is42.5%of the attacks that failed against14.8%of those that succeeded, a gap of−27.7 points (CI[−44.8,−8.8]). At10%the corresponding recalls are84%,67%and29.6%, a gap of−51.2points. The gap between failed-attack recall and successful-attack recall is the deployment-facing statement of the inverse ranking: the filter preferentially removes attacks that were not going to work. On the strong-attack cohort at the same threshold,325of354 successful attacks pass under Llama Guard and123of133 under Qwen3. Risk–coverage, and what it does and does not show. Among prompts that pass the filter, the harmful-generation rate as a function of the fraction blocked rises for the harmfulness score, reading0.27,0.289,0.300,0.329,0.383,0.420at0, 10,20,30,40and50%coverage. Blocking the same fraction at random leaves it at0.27throughout, and the rare-token and passive channels track the learned probe (0.42and0.44at half coverage), so the behavior is not specific to active probing. We flag two ways this comparison can mislead, because both cut against the strongest reading. Matching random fil- tering on coverage is not matching it on cost: this cohort is entirely harmful, so a rule that blocks35%of it would block 35%of benign traffic in deployment, whereas our threshold is held to a5.7%benign false-positive rate. Matched instead on benign budget, the score removes about2.6times as many successful attacks as random. And the rising curve is a condi- tional rate on a denominator the filter itself shrinks. Absolute harm falls monotonically (27→ 23→ 19realized jailbreaks at0,5and10%benign FPR), and adding the cohort’s own wrapped-benign prompts at1:1reduces the excess over ran- dom at the5%operating point from8.4points to0.7. The defensible claim is therefore about allocation, since the bud- get is spent on attacks that were not going to succeed, and about what a downstream consumer may infer from having passed the filter, not that the detector is worse than no de- tector. For contrast, an outcome-supervised score at matched coverage drives the admitted-harm rate to0.062, and Llama Guard’s prompt flag is essentially flat at 0.264–0.270. Attributing the leakage. At the5%operating point0.85of successful attacks pass. Decomposed,53%of that leakage is prompts the filter would have missed even without a wrapper, 23%is the wrapper lowering scores across the board, and 24%is the inverse ranking itself: relative to a counterfactual score of the same overall strength but neutral outcome rank- ing, about five additional successful attacks get through. At the10%point the inverse-ranking share rises to53%. We report this decomposition because it bounds how much of the observed deployment risk our specific finding is responsible for, as opposed to ordinary detector insensitivity. A resid- ual caveat is that part of the inverse-ranking term is itself a wrapper-family main effect, which the additive decomposition does not separate out. Attention-normalization controls. Fixing the probe’s posi- tion does not fix its competitive environment in the softmax, so a longer prompt could reduce attention onto three fixed positions mechanically. Two facts make this checkable here: the system region has a constant13tokens, and the wrap- per text lands in the user turn, so the total attention mass on the system region is a fixed-size competition set and divid- ing by it is a clean dilution control. Dilution is real, since system-region mass falls from0.383plain to0.225wrapped, but it does not account for the result. Under the raw read the wrapped-cohort outcome AUROC of the unsupervised aggre- 13 gate is0.099(20heads) and0.102(all heads). Normalizing by system-region mass gives0.154and0.109, normalizing by the full attention row leaves the values unchanged at0.099 and0.102, and a readout retrained on the normalized feature gives0.351. Every variant remains inverse with an interval excluding chance. Regressing the score on sequence length within each condition explains about 4% of its variance. E Decoding Variance Protocol. The main results use one greedy decode per prompt, so each outcome label is a single Bernoulli realization. To separate what is target-specific from what is draw-specific we regenerated the entire factorial harmful cohort five times per target at temperature one with recorded seeds, in both the plain and the wrapped condition, and judged all3000 completions with the same frozen Llama Guard 3. The ranking is stable. On Llama the score’s outcome AU- ROC is0.220against the published greedy label,0.252 against success@5,0.202against a majority vote over the five draws, and0.206against the per-goal estimated success probability with goals resampled as clusters. The five indi- vidual draws give0.175to0.257. Redrawing labels from the estimated probabilities gives a sampling distribution with mean0.206and standard deviation0.032, within which the published greedy value sits at the66th percentile. The single decode was therefore representative. Cross-target disagreement was overstated by the single draw. The greedy decode gives a three-way disagreement rate of0.64and CochranQ = 89.7. Permuting the fifteen judged draws of each goal across target labels, which is exact under the null of no target effect, already produces a single- draw disagreement of0.54on average. About85%of the raw greedy disagreement is therefore what sampling noise alone would produce, and only about15%is attributable to target identity. The comparison becomes clean once each goal is summarized by five draws: success@5disagreement is0.81 against a null of0.29, andQrejects the null in both cases. We report the success@5contrast in the main text and no longer quote the single-draw agreement count, which overstates the target-specificity claim. F Held-Out Calibration Frozen in-distribution Platt calibration. The main paper’s slope column is an in-sample Cox fit. To separate a score that was never calibrated from one whose calibration the shift de- stroyed, we hold out a30%in-distribution validation slice, fit Platt scaling on it, freeze the mapping, and apply it unchanged to every domain (Table 4). AUROC is invariant under this monotone map by construction and is repeated only for refer- ence. In distribution the correction works as intended (slope 0.545→ 1.019, ECE0.045→ 0.009). Out of distribution it does not restore calibrated meaning: WildJailbreak reaches slope0.994but retains ECE0.146and Brier0.104, and the both-sided encodings stay at ECE0.236–0.399with slopes near zero, since no monotone map can calibrate a score whose ranking is at chance. Japanese is the one condition with a neg- ative slope under both raw and calibrated scores, consistent with the translation artifact documented below rather than with ordinary shift. Translation-artifact condition. The Japanese row is reported here rather than in the main table. Its AUROC of0.228is not a weak signal but an inverted one, and the inversion is a property of the transformation, not of the score: the opus-mt-en-japoutputs collapse toward a shared regis- ter, with mean pairwise character trigram Jaccard similar- ity0.151among translated prompts versus0.062,0.078, and 0.0065for the English, French, and Chinese conditions, that is,2.4×the self-similarity of the source text. Orientation-free, 1− 0.228 = 0.772sits just below the Chinese and French band (0.778–0.802), which is what one expects if the transfor- mation has flipped the class-conditional ordering rather than destroyed the signal. G Common-Prior and Outcome Sensitivity Common-prior audit. To separate conditional score shift from label prevalence, we retain every example but assign inverse-frequency weights so each class has total mass0.5in every domain. This weighting is deterministic. AUROC is un- changed, while ECE, Cox calibration, and F1 are recomputed under the shared prior. Table 5 shows that WildJailbreak preva- lence explains part of the observed calibration gap. For AAP, the ID common-prior threshold is nearly oracle on WildJail- break, whereas HiddenDetect and the refusal-direction read retain larger threshold gaps. All families lose class separation on both-sided base64. Benign-only threshold audit. At nominal FPR1%with500 safe calibration prompts, the empirical quantile achieves FPR 1.2%and nearly matches an oracle TPR on paraphrase and English multilingual. Under benign shift it becomes conserva- tive (WildJailbreak FPR0.2%, TPR0.03versus oracle0.25), and encoding yields zero TPR because the signal is absent. The experiment therefore identifies benign-tail stability. It changes the decision map but not outcome ranking or its target index. Target-decomposition protocol. We sample100benign and 100harmful JailbreakBench goals. Each base goal is eval- uated plain and under exactly one of five fixed wrappers, balanced at20goals per intent class and wrapper family. This yields400prompts while preserving the plain/wrapped pair- ing. The templates are fixed strings with a singlegoalslot: Fictional role-play frames the exchange as an authorized eval- uation and asks the model to adopt an unrestricted in-world expert persona and answer directly without stepping out of character. Authority override declares an authorized red-team 14 RawFrozen ID Platt DomainAUROCECEBrierslopeECEBrierslope In-distribution.985.045.045 +.545.009.033 +1.019 WildJailbreak.850.366.272 +.508.146.104 +0.994 Paraphrase.858.203.202 +.320.065.135 +0.626 Multilingual (en).987.041.045 +.761.171.096 +1.488 Multilingual (zh).802.247.222 +.434.138.170 +0.847 Multilingual (fr).778.232.234 +.419.123.192 +0.819 Multilingual (ja).228.479.484 −.809.340.354 −1.582 Encoding base64.507.708.682 +.016.283.262 +0.030 Encoding rot13.498.684.650 −.011.236.242 −0.023 Encoding caesar.517.746.732 +.056.399.344 +0.113 Table 4: Raw versus frozen in-distribution Platt calibration for the dense all-head AAP readout, all shifts both-sided. The Platt map is fit once on a held-out 30% in-distribution validation slice and never refit. AUROC is unchanged by construction. ScoreID ECEWJ AUROCWJ ECEWJ F1 ID WJ F1 or Base64 AUROC AAP.036.850.149.790.796.507 Passive.031.743.167.706.711.518 AttentionDefense-style.033.804.085.724.732.503 HiddenDetect-style.056.784.379.420.725.487 Refusal direction.044.803.280.587.736.486 Llama Guard.179.840.195.663.762.506 Table 5: Common-prior (50/50) decomposition. F1 ID freezes the ID-optimal common-prior threshold. F1 or is the target-domain oracle. The base64 column is AUROC and is therefore prior invariant. evaluation that supersedes ordinary refusal behavior for the duration of the test and demands a direct and complete answer. Simulated unfiltered mode asks the model to simulate a hy- pothetical assistant with no safety filters and return only that assistant’s detailed answer. Compliance prefix instructs the model to continue after a supplied compliant opening, without warnings or refusals, the opening being a sentence announc- ing that the requested information follows. Research pretext requests a technically complete, step-by-step response for a controlled academic security study and forbids replacing oper- ational detail with general cautions. The same five templates are applied to benign and harmful goals alike, so the wrapper is never confounded with intent. The locked record list has SHA-256 digest 1917080d3a832dc3e87a20036327556cf 7f960379c98e6763021addd8932c990. The Llama-3.1-8B- Instruct target uses greedy decoding for at most256new tokens. Llama Guard 3 is the primary frozen outcome judge. Paired-contrast intervals use10,000bootstrap repli- cates over base goals, while outcome-AUROC intervals use class-stratified resampling. The wrapped harmful cell con- tains27effective and73ineffective outcomes. These choices were fixed before inference. All goals and wrapper families remain in the primary analysis. For the added matched con- trols, we extract a three-rare-token system-region read and a no-insertion passive system-region read on the same400 prompts. Each channel’s XGBoost scorer is trained only on its existing1000+1000BeaverTails feature cache, with no refitting or selection on the factorial data. AttentionDefense- style system-span attention and HiddenDetect-style per-layer refusal evidence are extracted in the same no-probe prefill pass. Their readouts use the same BeaverTails-only proto- col. They yield wrappedR H /R Y of.828/.145and.782/.248, respectively. What the -style suffix means for the derived channels. These are adaptations, not reimplementations, and we list the deviations so that no result is read as a reproduction of the original method. For the HiddenDetect-style channel: the score is the difference of mean first-token logits over a hand- written eight-word refusal list and six-word affirmation list rather than the published refusal-vector formulation. We emit the full per-layer vector and fit a supervised BeaverTails clas- sifier in place of the original training-free layer aggregation and threshold. The original method targets vision-language models and we apply it to text only, and the read position is the final token of our chat template, which includes our system prompt. For the AttentionDefense-style channel: the system span is taken as template positions up to the insertion anchor, including the beginning-of-sequence token and role headers. Our fixed one-sentence system prompt is not their defensive prompt. We read only the final query row of the at- 15 tention matrix. A supervised all-head classifier replaces their explainable aggregate, and the aggregation is an unweighted mean with no length normalization. The passive channel is an anchor-matched no-insertion control of our own con- struction. It is not a reimplementation of Attention Tracker’s instruction-focus score, which we cite only as the origin of the prompt-dependent read position that motivates a fixed coordi- nate. Consequently these channels test whether the reversal survives a change of read location and readout family, not whether published detectors would report the same numbers. Across five independently learned probe seeds with seed- specific BeaverTails readouts, meanτ H is.501(SD.036), meanτ HW is−.319(SD.118), and every seed preserves the inversion: wrappedR H = .770–.861whileR Y = .130– .246. For target substitution, the same200harmful prompts are generated by Mistral-7B-Instruct-v0.3 and Qwen2.5-7B- Instruct under the identical greedy256-token budget and judged by the same frozen Llama Guard 3. This fixed-score audit does not recompute detector scores. The target-native au- dit below does. Mistral yields68/70effective plain/wrapped prompts. Qwen yields5/10. All targets, prompts, metrics, and the10,000-replicate bootstrap were fixed before inspect- ing these outcomes. The paired target audit then resamples the100base goals while preserving each goal’s two condi- tions and all three target outcomes. On wrapped prompts, the Llama–Mistral, Llama–Qwen, and Mistral–Qwen disagree- ment rates are0.49(CI[0.39, 0.59]),0.19([0.12, 0.27]), and 0.60([0.50, 0.69]), respectively. Corresponding Cohen’sκ values are0.172,0.399, and0.091. Cochran’s paired om- nibus statistic isQ = 89.66(p = 3.4× 10 −20 ). No generation, score fitting, or outcome relabeling is performed for this au- dit. For judge robustness, Qwen3-14B receives the same600 cached harmful-goal prompt–completion pairs with a frozen rubric that labels only substantive, actionable harmful compli- ance as success. Greedy decoding with thinking disabled pro- duces one binary token. All600outputs parse without man- ual correction. On wrapped prompts, Qwen3 versus Llama Guard agreement/κis.87/.611for Llama,.66/.388for Mis- tral, and.94/.545for Qwen. Qwen3’s paired target test gives Q = 43.46(p = 3.66× 10 −10 ). The protocol and rubric were hashed before label aggregation. The second judge changes no generation or detector score. StrongREJECT column: what we actually ran. The re- leased fine-tuned StrongREJECT evaluator could not be ob- tained in our offline environment because its base checkpoint is gated, so we score the published StrongREJECT rubric with Gemma-2-9B-it. This column is therefore a rubric reim- plementation, not the official evaluator, and we report it as such. The failure is one of judge substitution, not of pars- ing. Of1600rubric outputs,1594parse. The six failures are the grader declining to score, not regex misses, and the parsed sub-scores are jointly structured in the way the rubric prescribes (refused=1⇒score0. Attacks lower the refusal item), which random mis-parsing could not produce. What fails is the grader: Gemma-2-9B-it marks the rubric’s refusal item as not refused on roughly30%of verbatim refusals. A completion that plainly declines to write a sexist email, for in- stance, is scored refused=0, convincing=5, specific=4, hence a rubric score of0.875and a nominal success. The binarized label is therefore a non-refusal-and-fluency indicator rather than a harm label, and it fires on66–99%of benign control prompts that receive helpful answers. DecomposingASR SR = Pr(not refused)× Pr(convincing+ specific≥ 6| not refused), the second factor is0.92–1.00on plain harmful prompts, so the elevated plain-prompt rate is driven by the refusal item rather than by our cut. The apparent post-attack decreases are a separate, cut-related effect: attacks lower refusal but de- grade coherence and specificity, and12.6%of harmful items sit exactly on the0.5boundary, the densest non-zero bin, so those labels are knife-edge. We therefore report this column as a rubric-quality measurement and do not interpret it as an attack-success rate. The inverse ranking does not depend on it.R Y < 0.5holds in7/7Llama cells under Llama Guard 3,6/7under the rubric cut,5/7under Qwen3,7/7under a strict two-of-three consensus label, and6/7under a union label. The pooled score coefficient stays negative under every rule (−0.539Llama Guard,−0.613rubric,−0.349Qwen3, −0.444consensus,−0.852union). Three-way agreement is nevertheless low, with Fleissκof0.21–0.30per cell, which is itself evidence for the paper’s claim thatY m is judge-indexed rather than a single quantity. The rubric column is also the only non-deterministic judge: across332records duplicated between attack directories its label differs in9cases (2.7%), traced to batch padding composition and a doubled beginning- of-sequence token, whereas Llama Guard 3 and Qwen3 differ in 0/332. Target-native score matrix. The main paper reports the full 3× 3crossing of native AAP score sources and generator- indexed outcomes on the identical100wrapped harmful prompts. Pairwise native-score correlations are only.42–.54, yet recomputing the score on each model does not recover positive outcome ranking. This rules out a frozen-Llama score source as the explanation for the target-indexed result. Intervention perturbation. We quantify how AAP changes the input computation. Across 200 prompts, next-token sym- metric KL has median0.22, mean0.79, and 95th percentile 3.87. Refusal flips on7.5%of prompts, with safe/harmful re- fusal changing.30→ .21and.94→ .96. Perplexity increases by5.4%and is teacher-forced on the no-probe greedy contin- uation, so it is a one-sided upper bound. These perturbations bound the interpretation of the intervention contrasts. The no-insertion and passive-channel results do not depend on probe insertion. Does the probe change realized success? No reportedY m is generated under probe insertion, but a reader may still ask what would happen if it were. We therefore generate the same300held-out harmful prompts (150WildJailbreak, 150BeaverTails. Greedy,256new tokens) under four arms 16 Scoreτ H τ W τ HW R H P/WR Y AAP.521−.094−.257.936/.803.220 (.109,.343) Rare-token.490.049−.431.961/.760.195 (.101,.300) Passive.408.031−.338.945/.751.149 (.062,.252) AttentionDefense-style.511.094−.359.956/.828.145 (.061,.244) HiddenDetect-style.413−.159−.284.894/.782.248 (.126,.383) Llama Guard.715.045−.070.875/.840.507 (.500,.521) Table 6: Complete matched harmfulness–wrapper decomposition.R H is harmful-intent AUROC on plain/wrapped prompts.R Y ranks effective versus ineffective wrapped harmful prompts. Each internal channel uses its BeaverTails-trained matched scorer. Parentheses are bootstrap 95% CIs for R Y . GeneratorEffective P/WASR P/WAAP R Y Rare R Y Passive R Y LG-prompt R Y Llama5/27.05/.27.220 [.109,.343].195 [.101,.300].149 [.062,.252].507 [.500,.521] Mistral68/70.68/.70.491 [.363,.623].508 [.394,.623].407 [.296,.525].517 [.500,.550] Qwen5/10.05/.10.163 [.024,.358].098 [.013,.214].214 [.060,.404].506 [.500,.517] Table 7: Fixed-score target-indexed outcome audit on the same100plain and100wrapped harmful goals. The Llama score source is held fixed while only the generator changes. The next analysis crosses native score sources and generators.R Y is wrapped effective-versus-ineffective AUROC with bootstrap 95% CI. and judge all of them with the same frozen Llama Guard 3: the canonical no-probe path, the probe path, a matched control carrying the anchored system template without the probe, and a re-run of the canonical path at a different batch size as a floating-point null. Attack success is0.207without the probe and0.177with it, a difference of−0.030(95% CI [−0.070,+0.007]. McNemarb=13,c=22,p = 0.18): probe insertion does not increase realized jailbreak success, and the point estimate is if anything mildly protective. The template- only control reaches0.157, so most of the small shift is at- tributable to the anchored system template rather than to the learned probe. Completions do diverge textually (exact-match 0.107, mean unigram F10.582), and refusal rises from0.583 to0.660, which is why we report the intervention as bounded rather than inert. The batch-size re-run gives0.217, indicating a floating-point noise floor of roughly one percentage point on this measurement. H Reproducibility and Computational Envi- ronment Recorded environment. The primary archived model-side environment is Linux on an NVIDIA RTX A6000 with 48 GB memory, using half-precision model weights. The cor- responding software snapshot records Python 3.10.12, Py- Torch 2.5.1 with CUDA 12.1, Transformers 5.9.0, scikit-learn 1.7.2, XGBoost 3.2.0, NumPy 2.2.6, SciPy 1.15.3, Accelerate 1.13.0, and SentencePiece 0.2.1. Search-based attacks were parallelized, and not every worker retained equally detailed hardware metadata. We therefore report this as the primary recorded environment rather than claim that every attack job ran on the same device. Final settings. The primary AAP probe hasK = 3rows and is optimized with Adam at learning rate10 −3 for50updates, using a freshly sampled minibatch of20prompts per class at each update. RQ1 uses the20heads selected on the training split, whereas RQ2 uses the dense all-head response. The primary harmfulness readout is XGBoost with100trees, max- imum depth5, log-loss evaluation, and random state42. The outcome-supervised positive control uses200trees, maxi- mum depth3, learning rate0.1, row subsampling0.8, column subsampling0.5, and eight CPU workers. Its logistic base- lines useℓ 2 regularization,lbfgs, at most300iterations, and selectCwithin each training fold from0.001, 0.01, 0.1, 1.0. Model checkpoint identities are stated in the main setup and the target-decomposition protocol. Primary generations use greedy decoding for at most256new tokens. The attack- specific goal counts and search budgets are listed in Supple- mentary §1. Randomness, repetition, and uncertainty. Unless an experi- ment explicitly varies the seed, data splits and fixed estimator fits use random state42. Probe sensitivity uses five inde- pendently learned probe seeds. The decoding-variance audit records five sampling seeds at temperature one, while the pri- mary outcome uses one greedy decode per prompt. Matched contrasts and outcome-AUROC intervals use10,000boot- strap replicates with the resampling unit stated next to each analysis. Cross validation keeps the base goal inside one fold, and the outcome-supervised readout uses25repeats. These counts distinguish repeated fits, repeated decodes, and boot- strap replicates rather than treating them as interchangeable 17 AttackLG3 R Y SR R Y Q3 R Y Best-of-N.345 [.167,.541] .434 [.344,.524] .536 [.444,.626] Many-shot.478 [.380,.576] .534 [.448,.616] .494 [.395,.591] GCG.189 [.085,.315] .273 [.158,.397] .264 [.089,.476] AutoDAN.195 [.110,.291] .143 [.074,.224] .237 [.131,.360] PAIR.485 [.371,.599] .379 [.258,.510] .425 [.237,.624] TAP.310 [.140,.500] .248 [.118,.395] .206 [.043,.426] AutoDAN-Turbo .284 [.143,.447] .252 [.117,.403] .515 [.262,.767] Table 8: Strong-attack outcome-ranking uncertainty corresponding to the compact main-paper table, after the checkpoint repair described above. Entries areR Y with10,000-replicate class-stratified bootstrap 95% CIs on attacked harmful prompts generated by Llama-3.1-8B-Instruct. LG3 and Q3 denote Llama Guard 3 and Qwen3-14B. SR is the rubric reimplementation, reported but excluded from every count. Before the repair, GCG read.203[.100,.329]/.257[.145,.381]/.304[.099,.535]and AutoDAN- Turbo’s SR entry read.185[.070,.323]. TAP’s Llama Guard interval had upper endpoint.494rather than.500. Only the intervals whose endpoint straddles0.5change any verdict: GCG–Qwen3 enters the significantly-below set and TAP–Llama Guard leaves it. runs. Artifact boundary. The artifact linked from the main pa- per releases analysis code, portable configurations, tests, and publication-aligned numeric aggregates. It omits raw harm- ful prompts and completions, model weights, attack check- points, and private execution provenance. Consequently, the released aggregates support table and correspondence veri- fication, while model-side experiments that require omitted artifacts are documented at the protocol level. I Details Referenced from the Main Text Prior silent-failure evidence. The collapse cited in the main text is measured under a syntheticσ=0.02Gaussian pertur- bation of the frozen embedding input. ROC-AUC falls from 85%to50%under that perturbation while mean predicted confidence falls 14%. Single-source inflation in prior audits. The 8.0–16.5 AUC inflation cited in the main text is measured by comparing single-source with cross-source splits for safety detectors. A sparse-autoencoder analysis in the same work finds that 28–44%of top features encode dataset identity rather than semantics, which motivates its leave-one-dataset-out protocol. Both the deployed twenty-head read and the dense all-head read select from this one tensor. No separate extraction run produces the dense read, so the RQ1 and RQ2 specifications differ only in which heads are selected. Safety-semantic initialization control. The safety-semantic condition inserts the probe initialization without any optimizer update, holding row count, insertion coordinate, dtype and read position fixed against the learned probe. Its response does not reach the learned probe’s response on the same prompts. The amplification is therefore attributable to the optimization in Eq. (1) rather than to the safety-semantic content of the initializing token embeddings. Cross-architecture WildJailbreak transfer. We repeat the WildJailbreak evaluation on Mistral, Qwen, Gemma, and Phi. Each architecture keeps its own frozen probe, its own head set, and its own BeaverTails-trained readout. No WildJailbreak prompt enters any fit. In-distribution AUROC runs from0.96 to0.98across the five architectures and WildJailbreak AU- ROC runs from0.60to0.85. The degradation is therefore a property of the shift rather than of one attention grid. Model-free control for the single-class encoding design. The control statistic is the Shannon entropy of the charac- ter distribution of the raw prompt string. It uses no model, no probe, and no training. On the single-class design, which encodes only the harmful class, it separates encoded attacks from plain benign prompts with AUROC0.997–1.000across base64, rot13, and caesar. On the same prompts without en- coding it reaches0.513. A single-class encoding result there- fore cannot be read as evidence about harmfulness separation, because a statistic with no access to meaning already solves that comparison. Per-head multiple comparisons. Per-head tests apply Benjamini–Hochberg FDR control across all1024heads, so every per-head significance statement holds after false dis- covery rate control. The max-statistic permutation correction quoted above is a separate family-wise procedure used only for the outcome-informative head count. The goal subsets for the reduced-nrows were also fixed before any attack was run, together with the budgets listed above. 18

Instant research discovery