The Entanglement Wall: Activation-Space Probes as Risk Detectors, Not Context Adjudicators

Abstract: Context can change whether a request is harmful without changing its topic or surface form. We ask whether residual-stream probes distinguish harmful requests from surface-matched benign controls at a useful operating point. Across three 7-8B model families, an activation sensor blocks 95.5-97.7 percent of judge-classified compliant attacks in a taxonomy-selected set. It also blocks 59.6-68.4 percent of XSTest prompts. A fully disjoint audit reconstructs near-ceiling source-contrast AUROC (0.996-0.999), but fixed transfer to matched pairs is weaker: 0.656-0.819 on the guard-selected Twin-n70 subset and 0.590-0.690 on the full Twin-n163 cohort. We test ten axes on the reference family and seven across all families with leakage, hold-out, and permutation controls. On Twin-n163, no axis evaluated without direct pair-boundary fitting reaches the specified numerical threshold. Requiring persistence on that full cohort was added at analysis time. A separately specified 24B/32B extension gives the same result. Pair-trained classifiers weaken under category and generation-batch hold-out and false-block 79.6-100 percent of XSTest at 95 percent in-corpus TPR. At the tested read points, these activation scores behave as broad-risk detectors rather than standalone context adjudicators.

• The paper demonstrates that activation-space probes effectively capture broad-risk signals in LLM models but fall short in distinguishing context-sensitive intent in surface-matched pairs.
• The paper employs cosine-based medoid zone comparators at designated post-attention layers and rigorously evaluates performance across multiple model families, highlighting strong broad-risk coverage.
• The paper identifies an 'entanglement wall' where high benign block rates occur due to insufficient context sensitivity, underscoring the need for additional safety layers.

Activation-Space Probes and the Limits of Context Sensitivity in LLM Safety

Motivation and Problem

Activation-space probes are increasingly proposed for LLM safety—specifically, for detecting malicious prompts in the residual stream by identifying "harmful directions" in hidden state geometry. The practical distinction is between broad-risk detectors, which assess general proximity to harmful intent, and context adjudicators, which must discriminate intent even among surface-similar (topic- and style-matched) requests. This work dissects that distinction: Do current probe architectures support fine-grained, context-dependent safety evaluation or do they function as broad filters with notable limitations on adversarial, context-shifted input?

Experimental Design

A suite of geometric, deployment-level, and paired-context experiments were conducted across three (7–8B parameter) model families: Llama-3.1-8B-abliterated, Mistral-7B-Instruct-v0.3, and Qwen2.5-7B-abliterated, plus extensions to 24B and 32B. Probes were constructed as cosine-based medoid zone comparators at post-attention activations (layer norm of zero-based layer 14), employing a risk margin between 24 "danger" and 19 "harmless" reference directions.

Evaluation methodology consisted of:

• Broad benchmarks (HarmBench, JailbreakBench, StrongReject), measuring compliant-attack catch and unconditional benign block rates.
• Fine-grained, paired evaluation on constructed twins—surface- and topic-matched pairs with divergent ground-truth intent (camouflaged harmful and benign arms).
• Disjoint transfer: Probes fitted on an external harmful/benign source corpus, then evaluated without further fitting on context-matched pairs (Twin-n163 and others).

Deployment-Level Results

The gate catches 95.5–97.7% of judge-classified compliant attacks in taxonomy-selected benchmarks, indicating strong broad-risk coverage (Figure 1).

Figure 1: Catch among compliant attacks and unconditional benign block rates. Error bars are 95 percent Wilson intervals. The harmful pool contains 480 taxonomy-selected prompts.

However, this comes at substantial cost: 59.6–68.4% of benign, but risk-adjacent, XSTest prompts are also blocked (Figure 2). The benign block rate is markedly elevated on XSTest versus Alpaca or WildJailbreak, indicating a lack of specificity in context adjudication.

Figure 2: Benign block rates by suite with 95 percent Wilson intervals. XSTest is highest in all three families.

Geometric Transfer on Same-Topic Pairs

A mean-difference protocol derived from prior work (e.g., (Llorente-Saguer, 20 Apr 2026Llorente-Saguer, 28 Mar 2026)) achieves near-ceiling AUROC (0.996–0.999) when separating cross-corpus source contrasts. However, when transferred fixed to surface-matched pairs, AUROC plummets—falling to 0.590–0.690 on Twin-n163, with even the best operating points yielding low true negative rates at high TPR (e.g., TNR@95%TPR $\leq$ 21.5%).

The drop in discrimination is consistent and robust to paired-label shuffling and confound controls, highlighting a semi-degenerate "entanglement wall": broad, but not context-precise, geometric signals. This pattern is demonstrated in Figure 3.

Figure 3: Disjoint source audit and fixed-direction transfer. AUROC and low-FPR detection fall on both Twin cohorts. Error bars are 95 percent paired-bootstrap intervals.

Further, deflation—projecting out the mean-difference direction—removes almost all residual separation on these pairs, with random direction removal leaving baseline separation essentially intact (Figure 4).

Figure 4: Llama cross-fit deflation on Twin-n70. Removing the mean-difference direction reduces AUROC to 0.599, while three random removals leave it near baseline. Bars show 20-split medians and interquartile ranges. The null p95 is 0.565.

No axis or direct probe evaluated without substantial pair-boundary exposure reaches the pre-specified operational threshold (AUROC $\geq 0.90$ or TNR@95%TPR $\geq 40\%$) on Twin-n163. Directly paired classifiers achieve in-corpus separation, but generalize poorly, blocking 79.6–100% of XSTest at fixed TPRs.

Implications and Interpretation

The findings establish that activation probes (as realized here) function as broad-risk detectors but fundamentally lack sufficient context sensitivity to reliably distinguish intent flip in surface-matched pairs. This is highly relevant for model deployment: while activation sensors can serve a useful first-stage risk filter, they are not robust standalone context adjudicators. In practical terms, this implies that fine-grained safety enforcement, especially for adversarial or ambiguous prompts, will continue to require additional context-aware layers, such as advanced guard models or dialog-informed post-processors.

Contradictory to some prior claims, the results empirically demonstrate that the strong separation observed in cross-corpus harmful/benign tasks does not transfer to local context distinctions, even when controlling for surface cues, style, and topic. The so-called "entanglement wall" is an empirical limit—persistent at current residual stream read points and using currently standard geometric protocols.

Future Research and Theoretical Outlook

• Attention-head and Dynamic Readouts: Since static residual-stream geometry saturates, future approaches should examine attention mechanism activations or dynamic context evaluation.
• Multi-Turn Context and Intent Accumulation: Extending to dialogic/multi-turn paired contrasts may offer greater ground for intent decodability.
• Scaling and Architecture: While scale extensions (24B/32B) are included, none fundamentally alters the performance floor on surface-matched context adjudication. Broader architectural variety and much larger models may need to be considered.
• Guard Model Complementarity: Dedicated guardrails (e.g., Llama-Guard-3) are still able to separate these twin pairs, underscoring the utility of multi-tier moderation architectures.
• Robustness under Adversarial Distribution Shift: Sensitivity to generation or curation batch effects, exposed here, further supports recent calls for nuanced OOD evaluation and confound controls (Wang et al., 4 Sep 2025, Sahoo et al., 1 Jun 2026, Fomin, 15 Feb 2026).

Conclusion

Activation-based probes at deployment-layer residual streams are confirmed to be effective first-stage risk screens, capturing broad harmfulness but fundamentally limited in resolving context-sensitive intent on surface- and topic-matched pairs. The "entanglement wall" demarcates this operational limit—not as a theoretical impossibility, but as a robust empirical boundary under current protocols. More context-aware mechanisms and in-depth intent modeling remain mandatory for advancing LLM safety assurance in adversarial and ambiguous scenarios.