Harm Propagation Prediction

• Harm Propagation Prediction is a quantitative approach that estimates how an initiating failure produces downstream harm across time, network paths, and causal chains.
• It employs diverse methods—including extreme value theory, network percolation, and causal inference—to model tail events and cascading failures in various domains.
• The field integrates counterfactual analysis, simulation, and rigorous calibration techniques to inform intervention strategies and optimize risk reduction.

Harm propagation prediction denotes the estimation of how an initiating failure, perturbation, or extreme event produces downstream harm across time, network distance, execution traces, or causal pathways. In the cited literature, the propagated object may be a future tail event in a multivariate time series, a cascade of line outages in a power system, citation-based harm from retracted papers, execution of a failed automated decision, amplification across multi-agent LLM traces, or the emergence of harmful behavior within a reasoning chain (Courgeau et al., 2021, Ghosh et al., 2024, Huang et al., 2024, Srivastava et al., 22 Feb 2026, Rahman et al., 26 May 2026, Kakkar et al., 21 Apr 2026). The field is therefore not a single model class but a family of quantitative formalisms that link an identifiable source event to a structured notion of downstream impact.

1. Formal definitions of propagated harm

Courgeau and Veraart formulate propagation from an extreme “cause” margin to future “impact” events in a $d$-dimensional stationary time series $X_t=(X_t^1,\dots,X_t^d)$. For cause margin $i$, the cause event is $C_t^{(i)}=\{X_t^i>\mu_i\}$, while the impact over the next $k$ steps is defined as $I_t(v,w,k)=\{w^\top X_{t+1}(k)>v\}$ for a weight vector $w\in[0,\infty)^{kd}$. Their framework then evaluates factual and counterfactual tail probabilities,

$$p_+^{(i)}(v;w,k)=P(w^\top X_1(k)>v\mid X_0^i>\mu_i),\qquad p_-^{(i)}(v;w,k)=P(w^\top X_1(k)>v\mid X_0^i\le \mu_i),$$

and converts them into the probabilities of necessity (PN), sufficiency (PS), and necessity-and-sufficiency (PNS) following Hannart & Pearl 2016 (Courgeau et al., 2021).

In citation-based studies of retracted research, harm is defined by shortfall in citations relative to a comparator set. If $$D(p)=\{q\in P\mid venue(q)=venue(p),\,year(q)\in\{year(p)-1,year(p),year(p)+1\},\,field(q)\cap field(p)\neq\emptyset\}$$, then total-citation harm is

$$H_0(p)=1-\frac{cite\_count(p)}{\frac{1}{n_D(p)}\sum_{q\in D(p)} cite\_count(q)},$$

with year-specific variants $X_t=(X_t^1,\dots,X_t^d)$0 for $X_t=(X_t^1,\dots,X_t^d)$1. Propagation is indexed by citation distance: $X_t=(X_t^1,\dots,X_t^d)$2 cites a retracted paper directly, and $X_t=(X_t^1,\dots,X_t^d)$3 for $X_t=(X_t^1,\dots,X_t^d)$4 cites at least one paper in $X_t=(X_t^1,\dots,X_t^d)$5 (Huang et al., 2024).

In high-automation AI systems, Srivastava & Sah decompose expected loss per decision into technical failure risk, deployment risk, and consequence severity:

$X_t=(X_t^1,\dots,X_t^d)$6

Here $X_t=(X_t^1,\dots,X_t^d)$7 is “system failure,” $X_t=(X_t^1,\dots,X_t^d)$8 is “harm occurs,” $X_t=(X_t^1,\dots,X_t^d)$9 is the automation level, and $i$0 is severity conditional on harm. Their framework isolates $i$1 as the harm-propagation probability, and under the conditions $i$2, $i$3, and $i$4, proves the equivalence $i$5, linking harm propagation to execution controls rather than model accuracy alone (Srivastava et al., 22 Feb 2026).

In multi-agent LLM systems, HARP defines local harm as deviation over targeted agents or corrupted channels, global harm as deviation over the full trace, and harm amplification as

$i$6

A paired clean/perturbed execution therefore yields a direct operational measure of how orchestration spreads a bounded local perturbation into system-level harm (Rahman et al., 26 May 2026).

For multi-turn conversations, HarmAmp introduces a turn-wise propagation probability $i$7, where $i$8 is the increment in harmful content caused by the $i$9th reply. HarmThoughts instead treats reasoning as a time series of discrete sentence-level behaviors $C_t^{(i)}=\{X_t^i>\mu_i\}$0 drawn from 16 classes and represents propagation by a first-order Markov chain

$C_t^{(i)}=\{X_t^i>\mu_i\}$1

This shifts attention from final harmful outputs to the intermediate sequence by which harm emerges (Guo et al., 1 Jun 2026, Kakkar et al., 21 Apr 2026).

2. Propagation mechanisms and model classes

A prominent line of work models propagation through tails, copulas, and counterfactual dependence. The Extreme Event Propagation framework uses extreme value theory for upper tails, with a semiparametric probability integral transform and generalized Pareto distributions above threshold $C_t^{(i)}=\{X_t^i>\mu_i\}$2, while a stationary vine copula captures joint extremal behavior. One stationary vine copula is fitted to $C_t^{(i)}=\{X_t^i>\mu_i\}$3 with Markov order $C_t^{(i)}=\{X_t^i>\mu_i\}$4 selected by AIC/BIC, pair-copula families drawn from independence, Clayton, Gumbel, Frank, Joe, and rotated variants, and conditional sampling based on vine-conditioning and the Rosenblatt transform is used to estimate $C_t^{(i)}=\{X_t^i>\mu_i\}$5 and $C_t^{(i)}=\{X_t^i>\mu_i\}$6 when data are scarce at high $C_t^{(i)}=\{X_t^i>\mu_i\}$7 (Courgeau et al., 2021).

A second family models propagation as network percolation or epidemic diffusion. In error propagation with non-uniform failure, edges are partitioned into types $C_t^{(i)}=\{X_t^i>\mu_i\}$8 and each type independently transmits onward with probability $C_t^{(i)}=\{X_t^i>\mu_i\}$9. The generating-function machinery yields a branching factor $k$0 in the occupied network, and $k$1 is the necessary and sufficient condition for a nonzero probability of an unbounded cascade. The same formalism gives the fixed-point equation $k$2 and final giant-component size $k$3 (König, 2016). In electric power cyber-physical systems, percolation is extended to a dual-layer dependency network with directed inter-layer links, survival fractions $k$4 and $k$5, and a critical attack threshold $k$6 determined by a survival-function analysis (Qu et al., 2018).

Diffusion models in power systems also appear in learned contagion form. The hyperparametric Information Cascades model represents transmission-line failures on a directed influence graph and assumes that each edge $k$7 carries a contagion probability

$k$8

where $k$9 is derived from line features and $I_t(v,w,k)=\{w^\top X_{t+1}(k)>v\}$0 is global. Given newly active parents $I_t(v,w,k)=\{w^\top X_{t+1}(k)>v\}$1, the independent-cascade activation probability is $I_t(v,w,k)=\{w^\top X_{t+1}(k)>v\}$2 (Xiang et al., 2024).

Causal-inference approaches replace physical topology with a learned latent graph. In cascading-failure prediction for transmission networks, nodes represent lines, directed edges encode cause-effect relations, and the linear structural causal model

$I_t(v,w,k)=\{w^\top X_{t+1}(k)>v\}$3

is learned from observational anomalies. The propagation probability $I_t(v,w,k)=\{w^\top X_{t+1}(k)>v\}$4 is then proportional to a path-sum over all directed paths from $I_t(v,w,k)=\{w^\top X_{t+1}(k)>v\}$5 to $I_t(v,w,k)=\{w^\top X_{t+1}(k)>v\}$6, with products of edge weights along each path. This explicitly captures nonlocal dependencies that the physical topology need not exhibit (Ghosh et al., 2024).

Economic cascade models take a different form. In the trade-network model for global cascading financial failure, each node has capacity $I_t(v,w,k)=\{w^\top X_{t+1}(k)>v\}$7 and state $I_t(v,w,k)=\{w^\top X_{t+1}(k)>v\}$8, the fractional loss of capacity. Propagation is governed by the transfer function

$I_t(v,w,k)=\{w^\top X_{t+1}(k)>v\}$9

the edge transfer $w\in[0,\infty)^{kd}$0, and the update

$w\in[0,\infty)^{kd}$1

with cap $w\in[0,\infty)^{kd}$2 and a breadth-first sweep over newly activated nodes (Gajewski et al., 18 Feb 2025).

3. Learning, calibration, and inference procedures

The inference pipeline depends strongly on the modeling choice. In Extreme Event Propagation, marginal thresholds $w\in[0,\infty)^{kd}$3 are chosen by sequential GoF tests controlling FDR, generalized Pareto parameters $w\in[0,\infty)^{kd}$4 are fitted above threshold by POT MLE, semiparametric PIT values $w\in[0,\infty)^{kd}$5 are computed, a stationary vine is fitted to $w\in[0,\infty)^{kd}$6, and conditional samples for $w\in[0,\infty)^{kd}$7 are drawn under both $w\in[0,\infty)^{kd}$8 and $w\in[0,\infty)^{kd}$9. The objective is then to maximize a chosen counterfactual probability of causation over $$p_+^{(i)}(v;w,k)=P(w^\top X_1(k)>v\mid X_0^i>\mu_i),\qquad p_-^{(i)}(v;w,k)=P(w^\top X_1(k)>v\mid X_0^i\le \mu_i),$$0 with $$p_+^{(i)}(v;w,k)=P(w^\top X_1(k)>v\mid X_0^i>\mu_i),\qquad p_-^{(i)}(v;w,k)=P(w^\top X_1(k)>v\mid X_0^i\le \mu_i),$$1, using Differential Evolution globally and L-BFGS-B with multistart locally, optionally with $$p_+^{(i)}(v;w,k)=P(w^\top X_1(k)>v\mid X_0^i>\mu_i),\qquad p_-^{(i)}(v;w,k)=P(w^\top X_1(k)>v\mid X_0^i\le \mu_i),$$2 or $$p_+^{(i)}(v;w,k)=P(w^\top X_1(k)>v\mid X_0^i>\mu_i),\qquad p_-^{(i)}(v;w,k)=P(w^\top X_1(k)>v\mid X_0^i\le \mu_i),$$3 penalties (Courgeau et al., 2021).

In hyperparametric diffusion for power grids, training data are extracted from observed cascades as positive samples $$p_+^{(i)}(v;w,k)=P(w^\top X_1(k)>v\mid X_0^i>\mu_i),\qquad p_-^{(i)}(v;w,k)=P(w^\top X_1(k)>v\mid X_0^i\le \mu_i),$$4 and negative samples $$p_+^{(i)}(v;w,k)=P(w^\top X_1(k)>v\mid X_0^i>\mu_i),\qquad p_-^{(i)}(v;w,k)=P(w^\top X_1(k)>v\mid X_0^i\le \mu_i),$$5. For a sample $$p_+^{(i)}(v;w,k)=P(w^\top X_1(k)>v\mid X_0^i>\mu_i),\qquad p_-^{(i)}(v;w,k)=P(w^\top X_1(k)>v\mid X_0^i\le \mu_i),$$6, the success probability is $$p_+^{(i)}(v;w,k)=P(w^\top X_1(k)>v\mid X_0^i>\mu_i),\qquad p_-^{(i)}(v;w,k)=P(w^\top X_1(k)>v\mid X_0^i\le \mu_i),$$7, and the average log-likelihood $$p_+^{(i)}(v;w,k)=P(w^\top X_1(k)>v\mid X_0^i>\mu_i),\qquad p_-^{(i)}(v;w,k)=P(w^\top X_1(k)>v\mid X_0^i\le \mu_i),$$8 is maximized over $$p_+^{(i)}(v;w,k)=P(w^\top X_1(k)>v\mid X_0^i>\mu_i),\qquad p_-^{(i)}(v;w,k)=P(w^\top X_1(k)>v\mid X_0^i\le \mu_i),$$9 by L-BFGS-B with analytic gradients. The paper also provides a PAC-style sample-complexity guarantee of order

$$D(p)=\{q\in P\mid venue(q)=venue(p),\,year(q)\in\{year(p)-1,year(p),year(p)+1\},\,field(q)\cap field(p)\neq\emptyset\}$$0

for excess expected risk at most $$D(p)=\{q\in P\mid venue(q)=venue(p),\,year(q)\in\{year(p)-1,year(p),year(p)+1\},\,field(q)\cap field(p)\neq\emptyset\}$$1 with probability at least $$D(p)=\{q\in P\mid venue(q)=venue(p),\,year(q)\in\{year(p)-1,year(p),year(p)+1\},\,field(q)\cap field(p)\neq\emptyset\}$$2 (Xiang et al., 2024).

Causal-inference models learn the propagation operator differently. The latent coefficient matrix $$D(p)=\{q\in P\mid venue(q)=venue(p),\,year(q)\in\{year(p)-1,year(p),year(p)+1\},\,field(q)\cap field(p)\neq\emptyset\}$$3 is recovered from steady-state anomalies $$D(p)=\{q\in P\mid venue(q)=venue(p),\,year(q)\in\{year(p)-1,year(p),year(p)+1\},\,field(q)\cap field(p)\neq\emptyset\}$$4 by a cyclic-LiNGAM procedure: sparse ICA estimates a mixing matrix $$D(p)=\{q\in P\mid venue(q)=venue(p),\,year(q)\in\{year(p)-1,year(p),year(p)+1\},\,field(q)\cap field(p)\neq\emptyset\}$$5, permutation and scaling normalize its diagonal entries, and the causal coefficient matrix is formed as $$D(p)=\{q\in P\mid venue(q)=venue(p),\,year(q)\in\{year(p)-1,year(p),year(p)+1\},\,field(q)\cap field(p)\neq\emptyset\}$$6. Once learned, prediction of the next failures requires only matrix updates and path-sums (Ghosh et al., 2024).

Financial cascade models calibrate a single free parameter. The propagation intensity $$D(p)=\{q\in P\mid venue(q)=venue(p),\,year(q)\in\{year(p)-1,year(p),year(p)+1\},\,field(q)\cap field(p)\neq\emptyset\}$$7 is fit to the Great Recession by minimizing quantile-regression pinball loss

$$D(p)=\{q\in P\mid venue(q)=venue(p),\,year(q)\in\{year(p)-1,year(p),year(p)+1\},\,field(q)\cap field(p)\neq\emptyset\}$$8

for $$D(p)=\{q\in P\mid venue(q)=venue(p),\,year(q)\in\{year(p)-1,year(p),year(p)+1\},\,field(q)\cap field(p)\neq\emptyset\}$$9 using SciPy’s scalar minimizer. This produces a 50% prediction interval rather than a single best fit (Gajewski et al., 18 Feb 2025).

Run-time prediction in autonomous systems uses yet another inference mode. For trajectory predictors in autonomous vehicles, the monitor samples $$H_0(p)=1-\frac{cite\_count(p)}{\frac{1}{n_D(p)}\sum_{q\in D(p)} cite\_count(q)},$$0 futures from the prediction network, pushes them through planner cost to obtain a cost distribution, compares the realized cost $$H_0(p)=1-\frac{cite\_count(p)}{\frac{1}{n_D(p)}\sum_{q\in D(p)} cite\_count(q)},$$1 to the sampled order statistic $$H_0(p)=1-\frac{cite\_count(p)}{\frac{1}{n_D(p)}\sum_{q\in D(p)} cite\_count(q)},$$2, and declares a harmful prediction failure when $$H_0(p)=1-\frac{cite\_count(p)}{\frac{1}{n_D(p)}\sum_{q\in D(p)} cite\_count(q)},$$3. The false-positive and false-negative bounds are explicit binomial-tail sums, which permits data-free calibration to a desired upper bound on one error rate (Farid et al., 2022).

Sequence forecasting in LLM safety is correspondingly trace-centric. TrajSafe models the monitor as a policy $$H_0(p)=1-\frac{cite\_count(p)}{\frac{1}{n_D(p)}\sum_{q\in D(p)} cite\_count(q)},$$4 over conversation histories and trains it by supervised fine-tuning followed by tree-based reinforcement learning with a composite reward $$H_0(p)=1-\frac{cite\_count(p)}{\frac{1}{n_D(p)}\sum_{q\in D(p)} cite\_count(q)},$$5, with $$H_0(p)=1-\frac{cite\_count(p)}{\frac{1}{n_D(p)}\sum_{q\in D(p)} cite\_count(q)},$$6 (Guo et al., 1 Jun 2026). HarmThoughts, by contrast, explicitly positions its 16-class sentence labels as supervision for recurrent models, Transformers, conditional random fields, or hazard models that forecast the onset of harmful execution, such as the first occurrence of Domain Knowledge Synthesis (Kakkar et al., 21 Apr 2026).

4. Metrics and empirical regularities

The literature measures propagation in multiple, domain-specific ways: counterfactual probabilities of causation, giant-component size, regret, citation shortfall, AUROC, harm amplification, intervention rate, and total expected loss. Several empirical regularities recur: delayed manifestation, amplification across generations or turns, sensitivity to network position, and strong dependence on the intervention layer rather than only the source perturbation.

Domain	Metric or reported result	Citation
Retracted research	For early years $$H_0(p)=1-\frac{cite\_count(p)}{\frac{1}{n_D(p)}\sum_{q\in D(p)} cite\_count(q)},$$7, $$H_0(p)=1-\frac{cite\_count(p)}{\frac{1}{n_D(p)}\sum_{q\in D(p)} cite\_count(q)},$$8 for papers in $$H_0(p)=1-\frac{cite\_count(p)}{\frac{1}{n_D(p)}\sum_{q\in D(p)} cite\_count(q)},$$9 is small, with median $X_t=(X_t^1,\dots,X_t^d)$00, then steadily rises over $X_t=(X_t^1,\dots,X_t^d)$01; for $X_t=(X_t^1,\dots,X_t^d)$02, $X_t=(X_t^1,\dots,X_t^d)$03–$X_t=(X_t^1,\dots,X_t^d)$04 percentage points for $X_t=(X_t^1,\dots,X_t^d)$05, with $X_t=(X_t^1,\dots,X_t^d)$06	(Huang et al., 2024)
Power-system causal inference	For $X_t=(X_t^1,\dots,X_t^d)$07, C-Path achieves $X_t=(X_t^1,\dots,X_t^d)$08 precision on 14/39 bus, versus $X_t=(X_t^1,\dots,X_t^d)$09 by influence-graph and GNN baselines; for $X_t=(X_t^1,\dots,X_t^d)$10, $X_t=(X_t^1,\dots,X_t^d)$11, regret drops below $X_t=(X_t^1,\dots,X_t^d)$12 for $X_t=(X_t^1,\dots,X_t^d)$13	(Ghosh et al., 2024)
Polypharmacy side-effect prediction	TIP-sum reports AUPRC $X_t=(X_t^1,\dots,X_t^d)$14, AUROC $X_t=(X_t^1,\dots,X_t^d)$15, AP@50 $X_t=(X_t^1,\dots,X_t^d)$16, with $X_t=(X_t^1,\dots,X_t^d)$17 speed-up and $X_t=(X_t^1,\dots,X_t^d)$18 memory reduction relative to Decagon	(Xu et al., 2020)
Autonomous-vehicle monitoring	QAD reports AUROC $X_t=(X_t^1,\dots,X_t^d)$19; data-free calibration at target quantile $X_t=(X_t^1,\dots,X_t^d)$20 yields empirical FPR $X_t=(X_t^1,\dots,X_t^d)$21, FNR $X_t=(X_t^1,\dots,X_t^d)$22 when calibrated for $X_t=(X_t^1,\dots,X_t^d)$23	(Farid et al., 2022)
Multi-turn LLM harm	On Llama-3.1-8B, HarmAmp reports multi-turn harm score $X_t=(X_t^1,\dots,X_t^d)$24 for the vanilla model; TrajSafe reduces it to $X_t=(X_t^1,\dots,X_t^d)$25, with over-refusal $X_t=(X_t^1,\dots,X_t^d)$26 and intervention turns $X_t=(X_t^1,\dots,X_t^d)$27	(Guo et al., 1 Jun 2026)
Multi-agent LLM harm amplification	IntegrityGuard achieves the lowest ASR and lowest HA, with HA $X_t=(X_t^1,\dots,X_t^d)$28–$X_t=(X_t^1,\dots,X_t^d)$29 and NTC rising $X_t=(X_t^1,\dots,X_t^d)$30–$X_t=(X_t^1,\dots,X_t^d)$31; prompt-only defense leaves HA $X_t=(X_t^1,\dots,X_t^d)$32–$X_t=(X_t^1,\dots,X_t^d)$33 in single-point attacks	(Rahman et al., 26 May 2026)

Additional numerical findings sharpen the diversity of use cases. In the trade-network model, the median-fit $X_t=(X_t^1,\dots,X_t^d)$34 reproduces country-by-country Great Recession losses with $X_t=(X_t^1,\dots,X_t^d)$35 on the linear scale, and the hypothetical India–Pakistan nuclear conflict produces a median global loss of $X_t=(X_t^1,\dots,X_t^d)$360.812$X_t=(X_t^1,\dots,X_t^d)$37\lambda_{med}$X_t=(X_t^1,\dots,X_t^d)$38\phi\approx0.39$X_t=(X_t^1,\dots,X_t^d)$39\phi\approx0.35$X_t=(X_t^1,\dots,X_t^d)$40\phi\approx0.46$X_t=(X_t^1,\dots,X_t^d)$41\phi\approx0.41$X_t=(X_t^1,\dots,X_t^d)$420.562$X_t=(X_t^1,\dots,X_t^d)$430.494$X_t=(X_t^1,\dots,X_t^d)$440.501$$for the best white-box <a href="https://www.emergentmind.com/topics/linear-probes" title="" rel="nofollow" data-turbo="false" class="assistant-link" x-data x-tooltip.raw="">linear probes</a> (<a href="/papers/2604.19001" title="" rel="nofollow" data-turbo="false" class="assistant-link" x-data x-tooltip.raw="">Kakkar et al., 21 Apr 2026</a>).</p> <h2 class='paper-heading' id='intervention-optimization-and-decision-support'>5. Intervention, optimization, and decision support</h2> <p>Prediction frameworks are frequently paired with explicit control rules. In Extreme Event Propagation, the optimization variable is the nonnegative weight vector$$X_t=(X_t^1,\dots,X_t^d)$45 over future margins and lags, constrained to sum to one. The objective is to maximize a selected counterfactual causation probability, such as PNS$X_t=(X_t^1,\dots,X_t^d)$46, and the output is $X_t=(X_t^1,\dots,X_t^d)$47 together with a ranking of marginals by $X_t=(X_t^1,\dots,X_t^d)$48 (Courgeau et al., 2021).

Automation-risk analysis makes intervention the central object. Srivastava & Sah define total cost as

$X_t=(X_t^1,\dots,X_t^d)$49

derive the first-order condition for the optimal automation level $X_t=(X_t^1,\dots,X_t^d)$50, and state that if all three cost-and-risk functions are convex in $X_t=(X_t^1,\dots,X_t^d)$51, then $X_t=(X_t^1,\dots,X_t^d)$52 is the unique global minimum. For fixed risk-management budget $X_t=(X_t^1,\dots,X_t^d)$53, they further show an equalized marginal ROI rule: resources should be split between reducing $X_t=(X_t^1,\dots,X_t^d)$54 and reducing $X_t=(X_t^1,\dots,X_t^d)$55 until marginal expected-loss reduction per dollar is equal across the two channels (Srivastava et al., 22 Feb 2026).

In power grids, once the hyperparametric independent-cascade probabilities $X_t=(X_t^1,\dots,X_t^d)$56 are learned, the model supports influence-maximization-style strengthening decisions. The paper formulates selection of $X_t=(X_t^1,\dots,X_t^d)$57 critical lines as minimizing expected spread $X_t=(X_t^1,\dots,X_t^d)$58 and notes that greedy or CELF-style routines exploit submodularity; on the IEEE-300 network, strengthening the top-$X_t=(X_t^1,\dots,X_t^d)$59 lines recommended by the model can reduce the frequency of large cascades by tens of percent across all size regimes (Xiang et al., 2024).

LLM systems introduce trajectory-level control. TrajSafe organizes interventions into five families—Engage, Probe, Shape, Divert, and Hard Refuse—and selects among them according to predicted risk along the conversation trajectory (Guo et al., 1 Jun 2026). HARP recommends trace-first paired evaluation, decomposed deviations for each output component, monitoring of the amplification ratio $X_t=(X_t^1,\dots,X_t^d)$60, and defense selection by minimizing a weighted objective over ASR, HA, benign utility, latency, and token cost:

$X_t=(X_t^1,\dots,X_t^d)$61

The emphasis is not only on blocking the initial perturbation, but on suppressing downstream amplification (Rahman et al., 26 May 2026).

A longer-horizon version of intervention appears in risk-aware alignment via simulation. The event-trajectory search builds a breadth-first causal event graph from a prompt-response pair, ranks salient events by likelihood and impact, expands affected population strata, elicits group-specific feedback, and then refines the original response or transfers the preference signal by DPO. On the 100-example indirect harm classification task, this approach reaches roughly 75% accuracy, compared with roughly 60% for Chain-of-Thought and roughly 58% for Best-of-N, while also achieving an average win rate exceeding 70% on existing safety benchmarks (Sun et al., 26 Jun 2025).

6. Assumptions, limitations, and research directions

The strongest limitations are model-specific and often explicit. In Extreme Event Propagation, conditional vine sampling assumes no unobserved confounders; the vine copula may mis-specify tail dependence if the pair-copula families lack flexibility; high-dimensional $X_t=(X_t^1,\dots,X_t^d)$62 may overfit; the impact threshold $X_t=(X_t^1,\dots,X_t^d)$63 must be high enough for EVT but low enough for stable estimates; and stationarity must either hold or be modeled through time-varying margins (Courgeau et al., 2021). In the trade-network cascade model, the mechanism is not microfounded on individual supply-chain or agent expectations, contains no gains or resilience beyond the single quantified transfer function, assumes static topology, and is deterministic rather than stochastic (Gajewski et al., 18 Feb 2025).

LLM-focused work identifies complementary failure modes. HarmThoughts argues that no existing benchmark had previously captured harm emergence at sentence-level granularity in reasoning traces, and its empirical comparisons show that existing detectors struggle with fine-grained behavior detection, particularly within harm emergence and execution (Kakkar et al., 21 Apr 2026). Long-horizon simulation for alignment acknowledges coarse likelihood variables, lack of full probability distributions over event trajectories, and reduced performance when harmful intents are embedded in long adversarial narratives (Sun et al., 26 Jun 2025). HARP shows that prompt-only defenses preserve benign utility but leave high success and stealth, while stronger trace-level defenses reduce global harm at utility, latency, and token-cost trade-offs (Rahman et al., 26 May 2026).

Several strands of the literature also stop short of full forecasting and explicitly frame prediction as a next step. The retracted-research study computes $X_t=(X_t^1,\dots,X_t^d)$64 and documents monotonic increases across years and citation generations, but states that no parametric model was fitted; it instead suggests that harm vectors, impact-factor group, field, and citation distance could serve as features for supervised learning or graph-neural-network-based predictors (Huang et al., 2024). HarmThoughts similarly presents recurrent, CRF, and hazard formulations as natural modeling directions for forecasting drift points such as transitions into Task Decomposition or Domain Knowledge Synthesis (Kakkar et al., 21 Apr 2026).

Taken together, these results suggest that effective harm propagation prediction depends less on a single universal propagation law than on preserving the intermediate structure of the process: conditional tails in extremes, path effects in causal graphs, order statistics in planner cost, citation generations, memory and routing events in LLM traces, or sentence-level behavioral states in reasoning. That inference is consistent with the recurring movement in the literature from end-state damage estimation toward process-level monitoring, counterfactual analysis, and intervention-aware prediction (Courgeau et al., 2021, Ghosh et al., 2024, Farid et al., 2022, Rahman et al., 26 May 2026).