What Intermediate Layers Know: Detecting Jailbreaks from Entropy Dynamics

Sofiia Nikolenko; Michele Papucci; Mina Rezaei; Shireen Kudukkil Manchingal

Source-linked AI summary

What Intermediate Layers Know: Detecting Jailbreaks from Entropy Dynamics

Sofiia Nikolenko, Michele Papucci, Mina Rezaei, Shireen Kudukkil Manchingal

arXiv:2606.25182v1Jun 23, 2026cs.CLcs.AIcs.LG

TL;DR

Jailbreak detection still lacks clear evidence about which internal dynamics encode harmful intent and how that signal changes across layers. This paper analyzes token-level entropy trajectories from intermediate representations and finds that dynamic trends consistently separate jailbreak from benign prompts, especially at intermediate depths rather than the final layer.

Problem
It remains unclear which internal dynamics encode harmful intent and how jailbreak-related signals evolve across model layers.
Method
The paper uses a training-free logit-lens analysis of token-level predictive entropy trajectories from intermediate activations, comparing static and dynamic feature families.
Results
Across Llama, Qwen, and Gemma, dynamic trend features consistently separate jailbreak from benign prompts, with signal concentrated in intermediate layers and degrading at the final layer.
Takeaways & Limitations
Intermediate-layer entropy dynamics provide a promising, interpretable signal for analyzing jailbreak behavior across architectures without additional classifier training.
Takeaways & Limitations
The signal depends on benign-prompt distribution and may degrade when benign prompts structurally resemble harmful ones.

Abstract

from arXiv · show

Jailbreak attacks reveal a persistent weakness in aligned Large Language Models: carefully crafted prompts can elicit policy-violating responses despite safety training. While most defenses operate at the prompt or output level, it remains unclear how harmful intent is encoded within the model's internal representations. We investigate this question by analyzing token-level predictive entropy trajectories across layers of a frozen LLM using the logit lens. We find that static aggregate statistics of prompt-level entropy (e.g., mean, variance) carry little discriminative signal, whereas features capturing how entropy evolves across token positions, such as monotonic rank-based trend scores, are substantially more informative. Importantly, this signal is not uniform across model depth: it is concentrated in intermediate layers and degrades at the final layer, indicating that jailbreak-relevant structure is most pronounced in mid-network representations rather than at the output head. Across multiple models (Llama, Qwen, Gemma) and adversarial benchmarks, these entropy dynamics provide architecture-consistent separation without additional training. Together, our findings show that jailbreak behavior is reflected in structured intermediate uncertainty dynamics, clarifying both which entropy-derived features encode harmful intent and where in the network that signal is most pronounced.

1 Introduction

The paper presents a training-free method for detecting jailbreaks from token-level predictive entropy dynamics in intermediate LLM layers. It finds that positional entropy trends distinguish jailbreak prompts better than static aggregates, with the strongest signal at intermediate depth and degradation at the final layer.

Motivation: Jailbreaks can cause unsafe outputs, data leakage, and misuse of connected tools, making reliable detection essential for safe LLM deployment.The introduction describes jailbreaks as prompts that circumvent safety mechanisms through instruction manipulation, role-play, or hidden malicious intent.
Illustration: At representative Llama-3.1-8B layer L22, safe and jailbreak prompts have comparable aggregate entropy, but jailbreak entropy shows a pronounced monotonic token-position trend.This trajectory-level contrast motivates features based on entropy evolution rather than aggregate levels.
Method: The study analyzes intermediate-layer, token-level predictive entropy trajectories without training, instead of relying solely on input text, generated outputs, or fine-tuned classifiers.The trajectories track how uncertainty evolves across token positions and model depth.
Findings: Dynamic features capturing positional entropy evolution, including monotonicity and rank-based trends, separate jailbreak from benign prompts more consistently than static aggregate entropy statistics.Prompt-level averaging can obscure localized token interactions and progressive confidence shifts as prompts develop.
Findings: The jailbreak-relevant entropy signal concentrates at intermediate layers and degrades at the final layer, indicating that it emerges in mid-network semantic representations.The introduction attributes the final-layer degradation to partial transformation by the output process.

2 Related Work

Prior jailbreak defenses primarily analyze prompts, generated responses, or external classifiers, with perplexity and perturbation methods offering training-free or robust alternatives but notable limitations. This work is motivated by evidence that jailbreak-relevant information is more separable in internal representations and can be studied through intermediate-state logit-lens entropy analysis.

Jailbreak defense in LLMs: Prior jailbreak defenses use prompt-level filters, supervised input classifiers, anomaly detection, or response-based detectors.These approaches differ in whether they analyze prompt text, model outputs, or external classifiers.
Jailbreak defense in LLMs: Perplexity-based detection is training-free but can produce high false positives on benign inputs, while perturbation-based defenses require multiple forward passes per prompt.SmoothLLM is given as an example of a robust perturbation-based defense.
Internal representations and safety-related signals: Recent studies indicate that safety- and jailbreak-relevant signals are encoded in internal model structure, with adversarial and benign prompts more separable internally than in surface text.This observation motivates focusing on intermediate-layer dynamics.
Uncertainty-based analysis and transformer interpretability: The logit lens projects intermediate hidden states into vocabulary space, enabling analysis of intermediate token predictions and entropy-based uncertainty.Related uncertainty work has applied entropy-based analysis to hallucination detection.

3 Methodology: A Framework for Detecting Jailbreak Prompts via Intermediate-Layer Entropy Dynamics

The methodology detects jailbreak prompts without training by extracting token-level entropy trajectories from frozen-model intermediate layers via the logit lens. It converts these traces into static and dynamic functionals, emphasizing monotonic trends and evaluating their threshold-free separation of harmful and benign prompts.

3.1 Problem Formulation: It tests whether entropy trajectory dynamics, rather than prompt-level aggregate uncertainty, provide discriminative signal and identifies the model depths where that signal is strongest.The framework also examines consistency across model architectures and adversarial benchmarks.
3.1 Problem Formulation: The framework maps a prompt to a scalar score from frozen-model intermediate activations in one forward pass, distinguishing jailbreak attempts from benign instructions.Jailbreak-success detection—whether a prompt elicits a policy-violating completion—is explicitly out of scope.
3.2 Intermediate-Layer Entropy via the Logit Lens: The logit lens projects each intermediate hidden state into vocabulary space with the final unembedding matrix, yielding a next-token distribution and token-level predictive entropy trace.This distribution represents the model’s intermediate belief about the next token before processing is complete.
3.2 Intermediate-Layer Entropy via the Logit Lens: K = 8 evenly spaced probe layers, including the first and last layers, produce one entropy trace per selected depth.Selecting probe layers avoids the computational cost and redundancy of extracting entropy at every layer.
3.3 Feature Extraction: Feature extraction uses static level summaries and dynamic trend features that capture the monotonic direction of uncertainty across token positions.The dynamic family is the central contribution and includes Kendall’s τ, Spearman’s ρ, and monotonicity.
3.3 Feature Extraction: The harmful direction is fixed per model from held-out data: downward for Llama and Qwen3, and upward for Gemma.Across K = 8 probe layers and approximately five features per layer, the procedure yields roughly 40 scalar features per prompt.
3.4 Scoring and Evaluation Protocol: Each feature is evaluated directly as a continuous score using directional AUROC, where 1.0 denotes perfect separation and 0.5 denotes chance.The threshold-free protocol measures intrinsic separability without post-hoc calibration or deployment-specific threshold selection.

4 Experimental Settings

The experiments evaluate entropy-based jailbreak detection across three open-source LLMs and balanced harmful–benign dataset pairs. They compare static versus dynamic entropy features across probe layers using direction-aware AUROC.

Model selection: Experiments use Llama 3.1-8B, Qwen3-8B, and Gemma-7b as the evaluated open-source LLMs.The runs use the Hugging Face handles meta-llama/Llama-3.1-8B, Qwen/Qwen3-8B, and google/gemma-7b.
Datasets: The evaluation combines AdvBench, HarmBench, and StrongREJECT harmful prompts with UltraChat, benign WildJailbreak, and JailbreakBench benign prompts.JailbreakBench benign prompts provide hard negatives because they are intentionally closer in style to harmful requests.
Datasets: The datasets form 9 total harmful–benign evaluation pairs, with each pair enforced at a 1:1 class balance by subsampling the larger set.The six primary pairs come from two primary benign sets and three harmful sets; adding JailbreakBench benign yields nine pairs.
Compared methods: Compared features span static entropy levels versus dynamic trends, while layer ablation evaluates every feature independently at each probe layer.Static features include mean, median, max, min, and standard deviation; dynamic features capture the direction of uncertainty change.
Evaluation metrics: Each feature is scored with directional AUROC, using a fixed harmful direction per model because entropy dynamics differ across architectures.Harmful entropy trends are downward for Llama/Qwen3 and upward for Gemma; AUROC measures ranking quality independently of a fixed threshold.

5 Results

Results show that rank-based entropy dynamics, rather than static entropy aggregates, provide the most consistent jailbreak-relevant signal. This signal concentrates in intermediate layers, generalizes across architectures, and weakens substantially when benign prompts mimic jailbreak structure.

Primary evaluation results: At approximately 69% depth, monotonicity achieves mean AUROC 0.941 on both Llama-3.1-8B and Qwen3-8B, with peaks of 0.999 and 1.000.Qwen3 reaches 1.000 on both WildJailbreak × AdvBench and WildJailbreak × HarmBench; Llama peaks at 0.999 on WildJailbreak × AdvBench.
Dynamic versus static features: Dynamic rank-based features consistently outperform static aggregates, whose AUROC varies by architecture and reflects entropy-scale differences rather than prompt semantics.Mean entropy reaches 0.889 on Qwen3 but only 0.617 on Gemma and 0.669 on Llama.
Layer-depth analysis: The discriminative signal spans roughly 50–85% depth and degrades sharply at the final layer across Llama, Qwen3, and Gemma.For Kendall τ, focal-to-final AUROC drops are 0.080 on Llama, 0.009 on Qwen3, and 0.338 on Gemma.
Cross-model generalization: Kendall τ and Spearman ρ generalize most consistently across models, with cross-model standard deviations of 0.021 and 0.018 and means of 0.782 and 0.788.No model-specific tuning is applied; monotonicity instead falls from 0.941 on Llama and Qwen3 to 0.759 on Gemma.
Robustness boundary: Using JailbreakBench benign prompts collapses mean AUROC to 0.348, 0.347, and 0.436 for Llama, Qwen3, and Gemma, respectively.These values compare with 0.941, 0.941, and 0.759 on the primary safe sets, indicating structural overlap rather than a general detection failure.
Robustness boundary: The signal is therefore a comparative score relative to a chosen benign reference set, not an absolute detector of malicious content.Benign prompts that mimic jailbreak structure can induce entropy dynamics similar to genuinely harmful inputs.

6 Conclusion

The paper introduces a training-free framework showing that intermediate-layer entropy dynamics provide a stronger, interpretable jailbreak signal than static prompt-level entropy statistics across several architectures and benchmarks. Its limitations include dependence on intermediate activations and benign-prompt distributions.

Conclusion: The framework analyzes jailbreak-relevant signals through intermediate-layer, token-level predictive entropy dynamics without additional training.It is evaluated across Llama, Qwen, Gemma, and multiple harmful-prompt benchmarks.
Conclusion: Dynamic trajectory features, including monotonicity and rank-based trends, are more discriminative than static prompt-level aggregate entropy statistics.The conclusion characterizes the discriminative signal as primarily dynamic rather than static.
Conclusion: Intermediate-layer entropy dynamics offer a promising and interpretable signal for analyzing jailbreak behavior in large language models.The signal is described as arising from middle activations and applying across different architectures.
Limitations: The approach requires access to intermediate activations, which may be unavailable in strictly black-box deployment.This is identified as a study limitation.
Limitations: Separability degrades when benign prompts have structural similarity to harmful prompts.The entropy-dynamics signal depends on the distribution of benign prompts.

7 Appendix

Appendix analyses attribute reduced entropy-trajectory separability with JailbreakBench-benign prompts primarily to distributional overlap with harmful prompts. Prompt-level examples show that policy-sensitive wording and fictional framing can preserve harmful-intent representations at the L22 focal layer.

Distributional overlap: At L22, UltraChat versus AdvBench is well separated, whereas JailbreakBench-benign versus AdvBench substantially overlaps for Llama-3.1-8B.This contrast supports distributional overlap between safe and harmful prompt representations as the primary explanation for the performance drop.
Prompt-level diagnostics: JailbreakBench-benign examples receive strongly negative trend scores for phishing, identity theft, illegal dumping, and expired-visa prompts.Reported values include mono = 0.297, τ = −0.673, ρ = −0.827 for phishing; τ = −0.689, ρ = −0.830 for identity theft; τ = −0.667, ρ = −0.800 for illegal dumping; and τ = −0.636, ρ = −0.762 for expired visas.
Prompt-level diagnostics: Fiction framing does not remove harmful intent, while policy-sensitive and regulatory-noncompliance wording keeps benign prompts close to harmful samples.The examples interpret identity-theft fiction framing, hazardous-waste language, and visa-overstay wording as preserving similarity to harmful or non-compliant prompts.
Distributional overlap: UltraChat prompts are predominantly routine assistant-use requests and induce trajectory distributions farther from harmful prompts than many policy-sensitive JailbreakBench-benign prompts.JailbreakBench-benign prompts may involve potentially harmful themes even without explicitly requesting forbidden actions.
Appendix evaluation: Tables 7–9 report directional AUROC across all probe layers, averaged over six primary evaluation pairs, while Table 10 distinguishes static from dynamic entropy-trace features.The focal layer is approximately 69% depth, and mono, τ, and ρ are reported across all layers.