What Intermediate Layers Know: Detecting Jailbreaks from Entropy Dynamics

Researchers have discovered that jailbreak attacks on large language models leave detectable traces in the entropy patterns of intermediate network layers rather than at output or prompt levels. Using entropy dynamics analysis across multiple models, they achieved consistent jailbreak detection without additional training, revealing that harmful intent manifests most clearly in mid-network representations rather than final outputs.

This research addresses a critical vulnerability in aligned language models: the ability to bypass safety measures through carefully crafted prompts. Rather than focusing on traditional defense mechanisms at the input or output stage, the study examines the internal computational dynamics that encode harmful intent. By analyzing how predictive entropy evolves across token positions using logit lens techniques, the researchers discovered that static entropy statistics provide minimal discriminative value, while features tracking entropy evolution patterns—particularly monotonic rank-based trends—offer substantial detection capability.

The finding that jailbreak signals concentrate in intermediate layers rather than at the output head challenges conventional assumptions about where model safety mechanisms operate. This discovery suggests that safety mechanisms may not be uniformly distributed across network depth, and harmful intent becomes obscured or transformed by the time information reaches the final layer. The consistency of these entropy dynamics across diverse architectures (Llama, Qwen, Gemma) indicates the signal is fundamental to how models process adversarial prompts rather than artifact-specific.

For AI safety researchers and developers, these findings offer a new detection pathway that requires no model retraining, reducing implementation barriers. The intermediate-layer concentration suggests future defenses could target specific network depths rather than applying blanket approaches. However, as adversarial techniques evolve, attackers may develop entropy-aware prompting strategies to evade this detection method. The research establishes important empirical constraints on jailbreak mechanisms but leaves open questions about whether entropy dynamics represent necessary or merely correlated features of harmful intent generation.

• →Jailbreak attacks encode harmful intent in intermediate layer entropy patterns rather than final outputs, enabling detection without retraining
• →Static entropy statistics fail to distinguish jailbreaks, while dynamic features tracking entropy evolution across tokens provide strong discriminative signals
• →The jailbreak-relevant signal concentrates in mid-network representations and degrades approaching the output layer, suggesting non-uniform safety encoding
• →Entropy dynamics detection works consistently across multiple model architectures without model-specific tuning
• →Future defenses could exploit intermediate-layer vulnerabilities, though adversaries may develop entropy-aware attack strategies to circumvent detection