Technical Summary: Detecting Jailbreaks from Entropy Dynamics in Intermediate Layers

1. Problem Statement

Jailbreak attacks exploit Large Language Models (LLMs) to circumvent safety training, eliciting policy-violating responses despite alignment efforts. While existing defenses operate at the prompt level (filters), output level (response inspection), or via supervised classifiers, the internal encoding of harmful intent remains poorly understood. Specifically, it is unclear how adversarial intent is represented within the model's latent space, how this signal evolves across token positions, and at which depth within the transformer architecture this information is most distinguishable from benign inputs.

Current methods relying on static aggregate statistics (e.g., mean perplexity or entropy) often fail to capture the nuanced, localized interactions between tokens and the model's internal state that characterize jailbreak attempts. This paper posits that jailbreak behavior is not merely a shift in overall uncertainty levels but induces structured dynamics in how predictive entropy evolves as a prompt unfolds.

2. Methodology

The authors propose a training-free framework that analyzes token-level predictive entropy trajectories within the intermediate layers of a frozen LLM. The approach relies on the following components:

2.1 Intermediate-Layer Entropy Extraction (Logit Lens)

Instead of waiting for the final output, the method projects intermediate hidden states ($h_t^{(\ell)}$) at specific layers $\ell$ directly into the vocabulary space using the model's final unembedding matrix ($W_U$). This "logit lens" technique generates a probability distribution $p^{(\ell)}(\cdot | x_{<t})$ for the next token at each intermediate step.
The Shannon entropy $H_t^{(\ell)}$ is then computed for each token position $t$ at these probe layers, creating an entropy trajectory $H^{(\ell)} = (H_1^{(\ell)}, \dots, H_{T-1}^{(\ell)})$.

2.2 Feature Construction

The framework distinguishes between two families of features derived from these trajectories:

• Static (Level) Features: Aggregate statistics summarizing the magnitude of uncertainty across the prompt, such as mean, max, standard deviation, and min.
• Dynamic (Trend) Features: Metrics capturing the directional evolution of uncertainty across token positions. Key features include:
  • Kendall's $\tau$: Rank correlation between entropy values and token positions.
  • Spearman's $\rho$: Pearson correlation of rank-transformed entropy and token positions.
  • Monotonicity: The fraction of consecutive token pairs where entropy moves in a specific "harmful" direction ($d$), which is empirically determined per model (e.g., downward for Llama/Qwen, upward for Gemma).

2.3 Evaluation Protocol

The study evaluates these features on a frozen model using a single forward pass. Detection performance is measured via directional Area Under the ROC Curve (AUROC), computed in the model's natural harmful direction. The evaluation spans three open-source models (Llama-3.1-8B, Qwen3-8B, Gemma-7b) and multiple adversarial benchmarks (AdvBench, HarmBench, StrongREJECT) against benign datasets (UltraChat, WildJailbreak, JailbreakBench).

3. Key Contributions

The paper makes three primary contributions:

1. Training-Free Analysis: Introduces a method to detect jailbreak signals using only intermediate-layer activations without fine-tuning classifiers or analyzing generated outputs.
2. Dynamic vs. Static Signal: Demonstrates that discriminative power lies primarily in dynamic trajectory features (monotonicity, rank-based trends) rather than static aggregate entropy statistics.
3. Depth-Dependent Localization: Identifies that the jailbreak signal is concentrated in intermediate layers (roughly 50–85% of network depth) and degrades significantly at the final layer, suggesting that harmful intent is encoded in mid-network semantic representations before being transformed by output-specific processing.

4. Empirical Results

4.1 Dynamic Features Outperform Static Aggregates

Across all models, dynamic trend features consistently separated jailbreak prompts from benign ones, whereas static features (mean, max entropy) showed high variance and poor cross-model generalization.

• Monotonicity achieved the highest mean AUROC on Llama (0.941) and Qwen (0.941).
• Kendall's $\tau$ and Spearman's $\rho$ provided robust, architecture-consistent separation (mean AUROC $\approx$ 0.78–0.80) with near-zero cross-model variance, indicating that the structure of entropy evolution is a transferable signal regardless of absolute entropy scale.

4.2 Signal Concentration in Intermediate Layers

The discriminative signal is not uniform across depth.

• Intermediate Peak: Features like monotonicity and Kendall's $\tau$ peaked at intermediate layers (e.g., Layer 22 of 32 for Llama, Layer 25 of 36 for Qwen).
• Final Layer Degradation: Performance dropped sharply at the final layer. For Gemma, Kendall's $\tau$ dropped from 0.796 at the intermediate layer to 0.458 at the final layer. This suggests that the final layer actively suppresses or reorganizes the adversarial structure present in earlier representations.
• Contrast with Static Features: Static features (like mean entropy) showed the opposite trend, often performing best at the final layer, confirming they capture different computational properties than dynamic trends.

4.3 Generalization and Adversarial Controls

• Cross-Model Consistency: Rank-based features generalized well across Llama, Qwen, and Gemma, despite differences in training pipelines and layer counts.
• Adversarial Control (JailbreakBench Benign): When the benign set consisted of "JailbreakBench benign" prompts (intentionally crafted to mimic the structure of harmful requests without harmful intent), the AUROC collapsed (dropping to ~0.35). This indicates the signal detects structural prompt composition rather than semantic harmfulness. When benign inputs structurally resemble jailbreaks, the internal dynamics become indistinguishable.

5. Significance and Claims

The paper claims that jailbreak behavior in aligned LLMs is reflected in structured intermediate uncertainty dynamics. Specifically:

• Interpretability: The findings clarify where (intermediate layers) and how (monotonic entropy trends) harmful intent is encoded, offering a diagnostic lens into model internals.
• Architecture Consistency: The signal is an emergent property of mid-network representations that persists across different model families (Llama, Qwen, Gemma) without additional training.
• Limitations and Scope: The authors modestly frame this as a diagnostic characterization rather than a finished deployment-ready detector. They acknowledge that the method requires white-box access to intermediate activations and that its effectiveness depends on the distribution of benign prompts. If benign prompts structurally mimic jailbreaks, the signal degrades. Furthermore, the method relies on logit lens projections, which may introduce distortions due to representation misalignment.

In conclusion, the study establishes that monitoring the evolution of token-level predictive entropy in intermediate layers provides a robust, training-free signal for identifying the structural patterns associated with jailbreak attempts, distinct from the static uncertainty levels used in traditional perplexity-based detection.