中间层所知道的内容：从熵动力学中检测出“ jailbreak”现象
What Intermediate Layers Know: Detecting Jailbreaks from Entropy Dynamics
摘要
越狱攻击揭示了对齐后的大型语言模型中的一个持续存在的弱点：即使经过安全训练，精心设计的提示仍可能引发违反政策的响应。虽然大多数防御措施都集中在提示或输出层面，但模型的内部表示中如何体现有害意图却仍不清楚。我们通过使用logit方法分析冻结后的LLM各层中的标记级预测熵变化规律来研究这个问题。我们发现，提示层面的熵的静态汇总统计值（如均值、方差）几乎没有区分意义，而能够反映熵在不同标记位置上的变化情况的特征则具有更重要的信息价值。重要的是，这种信号并非在模型的不同层次上均匀分布：它主要集中在中间层，而在最终层则逐渐减弱，这表明与越狱相关的结构更明显地体现在网络的中间层，而非输出层。在多个模型（Llama、Qwen、Gemma）和对抗性测试环境中，这些熵变化规律能够在不进行额外训练的情况下实现与架构一致的区分。总的来说，我们的研究结果表明，越狱行为体现在有结构的中间不确定性变化中，从而明确了哪些基于熵的特征能反映有害意图，以及这种信号在网络中的具体位置。
English Abstract
Jailbreak attacks reveal a persistent weakness in aligned Large Language Models: carefully crafted prompts can elicit policy-violating responses despite safety training. While most defenses operate at the prompt or output level, it remains unclear how harmful intent is encoded within the model's internal representations. We investigate this question by analyzing token-level predictive entropy trajectories across layers of a frozen LLM using the logit lens. We find that static aggregate statistics of prompt-level entropy (e.g., mean, variance) carry little discriminative signal, whereas features capturing how entropy evolves across token positions, such as monotonic rank-based trend scores, are substantially more informative. Importantly, this signal is not uniform across model depth: it is concentrated in intermediate layers and degrades at the final layer, indicating that jailbreak-relevant structure is most pronounced in mid-network representations rather than at the output head. Across multiple models (Llama, Qwen, Gemma) and adversarial benchmarks, these entropy dynamics provide architecture-consistent separation without additional training. Together, our findings show that jailbreak behavior is reflected in structured intermediate uncertainty dynamics, clarifying both which entropy-derived features encode harmful intent and where in the network that signal is most pronounced.