What Intermediate Layers Know: Detecting Jailbreaks from Entropy Dynamics

• Prior internal-signal approaches suggest latent-space separability, but leave unclear which internal properties encode harmful intent across token positions and model depth [39] [11] [20].Source: §1 · p. 2
• Token-level analysis matters because localized token–state interactions can shift confidence progressively and be obscured by prompt-level averaging [20].The analysis treats entropy as a dynamic quantity to identify where jailbreak-relevant structure becomes most pronounced across network depth.Source: §1 · pp. 2–3
• Dynamic positional entropy features consistently separate jailbreak from benign prompts better than static aggregates, with the signal concentrated at intermediate layers and weaker at the final layer.Source: §1 · p. 3
• The training-free analysis examines intermediate-layer token-level predictive-entropy trajectories and evaluates Llama [15], Qwen, and Gemma [36] across AdvBench, HarmBench, and StrongREJECT.Source: §1 · pp. 2–3

Jailbreak defense in LLMs

• Existing jailbreak defenses use prompt filters, input classifiers [16], output detectors [21], perplexity [2] [17], perturbation, or first-token distributions, whereas our method scores intermediate entropy dynamics in one pass.Perplexity detection can produce high false positives on benign inputs, while perturbation defenses require multiple forward passes per prompt; our method uses a frozen model and requires no additional training.Source: §2 · pp. 3–4

Internal representations and safety-related signals

• Prior work finds safety- and jailbreak-relevant signals in internal representations [11] [20], including adversarial-benign separability [19] and a suppressible refusal direction, but leaves uncertainty dynamics and layer variation uncharacterized.This work identifies the discriminative signal as dynamic token-level predictive entropy evolution, concentrated in intermediate rather than final layers.Source: §2 · p. 4

Uncertainty-based analysis and transformer interpretability

• Using logit-lens probes [34] and entropy-based uncertainty analysis [26] [23] [24] [8] [41] [27], our work shows rank-based monotonic entropy trends transfer more stably than aggregate entropy magnitude for jailbreak detection.Unlike prior entropy-based work on hallucination detection [22], this approach analyzes token-level predictive-entropy trajectories across layers rather than interpreting individual predictions per sentence.Source: §2 · p. 4

3.1 Problem Formulation

• The framework uses frozen-model intermediate activations to score jailbreak versus benign prompts from entropy trajectories, requiring no training or parameter updates.Detection targets whether a prompt is a jailbreak attempt, not whether it actually elicits a policy-violating completion.Source: §3.1 · pp. 5–6

3.2 Intermediate-Layer Entropy via the Logit Lens

• The logit lens projects intermediate hidden states into vocabulary distributions, yielding token-level next-token entropy traces in a single forward pass.Each probe layer uses the final unembedding matrix; the authors describe the added computation as one projection per token, with cost scaling linearly with model size like a standard forward pass.Source: §3.2 · p. 6
• Rather than probe every layer, the method selects eight evenly spaced layers, including the first and last, to capture uncertainty at different depths.The specific probe layers for each evaluated model are reported in Table 1.Source: §3.2 · p. 7

3.3 Feature Extraction

• Static features summarize entropy magnitude, while dynamic features capture monotonic trends using Kendall’s τ, Spearman’s ρ, and the fraction of consecutive pairs following the trend.The authors characterize dynamic trend features as the approach’s central contribution; static features do not capture directional information.Source: §3.3 · p. 7
• The harmful trend direction is set per model from held-out data and held constant across experiments: downward for Llama and Qwen3, upward for Gemma.Source: §3.3 · p. 7

3.4 Scoring and Evaluation Protocol

• Each scalar feature is evaluated independently with directional AUROC, a threshold-free measure where 1.0 indicates perfect separation and 0.5 indicates chance.Evaluation uses each model’s natural harmful direction, avoiding post-hoc calibration or deployment-specific thresholds.Source: §3.4 · p. 8

Model selection

• The evaluation used three open-source LLMs: Llama 3 (Llama-3.1-8B) [15], Qwen 3 (Qwen3-8B), and Gemma (Gemma-7b) [36].Source: §4 · p. 8

Datasets

• Harmful sets were AdvBench, HarmBench, and StrongREJECT [35]; primary benign sets were UltraChat [13] and the benign subset of Wild-Jailbreak.JailbreakBench benign [9] was added as a hard-negative set because its prompts are closer in style to harmful requests.Source: §4 · p. 8
• The study forms six primary and nine total evaluation pairs, balancing each 1:1 by randomly subsampling the larger dataset to match the smaller one.The nine-pair total includes JailbreakBench benign.Source: §4 · p. 8

Compared methods

• Compared features span static entropy summaries—mean, median, max, min, and standard deviation—and dynamic trend features that capture uncertainty direction.The comparison varies both feature type and the layer at which entropy is read.Source: §4 · pp. 8–9

Layer ablation

• Each feature was evaluated independently at every probe layer to test whether its signal is specific to intermediate depth or distributed uniformly.Table 1 identifies the models and probe layers used in the experiments.Source: Table 1 · p. 8, §4 · p. 9

Evaluation metrics

• Directional AUROC measures ranking quality without a fixed threshold; harmful scores were oriented downward for Llama and Qwen3, upward for Gemma, with one direction fixed per model across pairs.Harmful prompts are the positive class.Source: §4 · p. 9

5.1 Main Results: Cross-Model Detection Performance

• Monotonicity mean AUROC was 0.941 on Llama-3.1-8B and Qwen3-8B but 0.759 on Gemma-7b, while rank-based trends remained informative across architectures.At approximately 69% depth, dynamic trends separated prompts across all six primary evaluation pairs without classifier training or threshold tuning; the entropy trend direction differed for Gemma.Source: §5.1 · pp. 9–10, Table 2 · p. 10

5.2 RQ1: Dynamic Features Outperform Static Aggregates

• Kendall τ and Spearman ρ yielded AUROCs of 0.793–0.826 and 0.796–0.838 across models (std ≈ 0.02), while mean entropy ranged from 0.617 to 0.889.Static aggregates measure overall uncertainty, which varies with architecture-specific entropy scales; rank-based features instead capture trajectory structure across token positions.Source: §5.2 · pp. 10–11, Table 3 · p. 11

5.3 RQ2: Discriminative Signal Peaks at Intermediate Depth

• Dynamic-feature AUROC peaks in a broad 50–85% depth band and drops at the final layer; Kendall τ falls 0.080 on Llama, 0.009 on Qwen3, and 0.338 on Gemma.Static mean entropy shows the opposite depth pattern, becoming strongest at the final layer; the intermediate-band finding spans models with 28, 32, and 36 layers, while generalization to larger or thinking models remains open.Source: §5.3 · pp. 11–12, Table 4 · p. 12

5.4 RQ3: Cross-Model and Cross-Benchmark Generalization

• Across six primary pairs, Kendall τ and Spearman ρ averaged 0.782 and 0.788 AUROC, with cross-model standard deviations of 0.021 and 0.018, respectively.Monotonicity averaged 0.941 on Llama and Qwen3 but 0.759 on Gemma (cross-model std 0.086), making rank-based measures more robust to architectural variation.Source: Table 5 · p. 13, §5.4 · p. 13

5.5 Adversarial Control: Sensitivity to Safe Set Distribution

• Replacing routine safe prompts with adversarially structured JailbreakBench benign prompts collapsed mean AUROC to 0.348, 0.347, and 0.436 for Llama, Qwen3, and Gemma, respectively.This is a diagnostic of structural overlap, not a typical-deployment false-positive result: the signal is comparative to its benign reference set, not an absolute detector of malicious intent.Source: §5.5 · pp. 13–14, Table 6 · p. 14

Conclusion

• Trajectory-based entropy features provide stronger and more consistent jailbreak–benign separation than static aggregates, with the signal concentrated in intermediate layers and degrading at the final layer.The framework is training-free and was evaluated across Llama, Qwen, Gemma, and multiple harmful-prompt benchmarks.Source: §6 · pp. 14–15

Limitations

• The detector requires intermediate activations, and its separation weakens when benign prompts structurally resemble harmful ones.Logit Lens projections can distort intermediate predictions; larger, thinking, or aligned models may also show different entropy patterns. The measured next-token entropy reflects predictive uncertainty, not claimed epistemic uncertainty.Source: §6 · p. 15
• Rank-based features τ and ρ are scale-invariant and more robust to fine-tuning shifts, but the harmful direction d may need periodic re-estimation in production.Entropy scales and d can shift under continued fine-tuning.Source: §6 · p. 15

Future work

• Future work includes combining entropy trends with other signals, tracking them during generation, evaluating aligned or thinking models, benchmarking against alternative detectors, aggregating intermediate-layer trends, and testing adaptive evasion.The proposed baselines include perplexity, lexical/length/topic features, hidden-state probes, refusal directions, and output distributions.Source: §6 · p. 15

Code and data availability

• Code, experiment configurations, and supplementary material are available in the project repository.https://github.com/ssophiee/entropy-jailbreak-detectionSource: §6 · p. 16

7.1 Why JailbreakBench Benign Reduces Separability

• At Llama-3.1-8B layer 22, UltraChat and AdvBench are well separated, but JailbreakBench-benign and AdvBench substantially overlap, supporting distributional overlap as the cause of reduced separability.JailbreakBench-benign prompts often use policy-sensitive or potentially harmful themes, shifting entropy-trend features toward the harmful distribution and reducing AUROC; UltraChat prompts are predominantly routine requests [13].Source: §7.1 · p. 19
• Prompt-level examples include benign-labeled requests resembling phishing, identity theft, illegal dumping, and visa non-compliance, illustrating how topic and framing can remain close to harmful prompts.Examples include a fictional identity-theft biography and hazardous-waste disposal; fiction framing did not remove harmful intent, while policy-sensitive wording increased similarity to non-compliant requests.Source: §7.1 · p. 19

7.2 Layer-Wise Directional AUROC Across Metrics

• Tables 7–9 report directional AUROC for all metrics across probe layers, averaged over six primary evaluation pairs for Qwen3-8B, Llama-3.1-8B, and Gemma-7b.The pairs combine UltraChat and WildJailbreak with AdvBench, HarmBench, and StrongREJECT; the focal layer is approximately 69% depth, and Gemma uses the upward direction while Qwen and Llama use downward direction.Source: §7.2 · p. 20, Table 7 · p. 21, Table 8 · p. 22