# Related Work Survey — Activation/Internal-Representation Detection of Text-Level Attacks
Auto-pulled from arXiv API on 2026-05-31. Window: papers submitted >= 2025-11-01.
Terms: activation probe / linear probe / hidden states / internal representations x prompt injection / jailbreak / tool poisoning / task drift / SAE safety / activation steering.

**TOTAL unique papers: 130**

| Date | arXiv | Cat | Title |
|---|---|---|---|
| 2026-05-28 | 2605.29737 | cs.CR | Minimal Prompt Perturbations Lead to Code Vulnerabilities: Prompt Fragility and Hidden-State Signals in Coding LLMs |
| 2026-05-28 | 2605.30031 | cs.SD | Audio Jailbreaks in Large Audio-Language Models: Taxonomy, Attack-Defense Analysis, and Cost-Aware Evaluation |
| 2026-05-28 | 2605.29629 | cs.AI | Beyond Attack Success Rate: Temporal Logit Observability for LLM Safety Failures |
| 2026-05-28 | 2605.30049 | cs.AI | Robust and Generalizable Safety Steering for Text-to-Image Diffusion Transformers |
| 2026-05-28 | 2605.29358 | cs.AI | Scaling Monosemanticity: Extracting Interpretable Features from Claude 3 Sonnet |
| 2026-05-27 | 2605.28467 | cs.LG | Mitigating Adaptive Attacks against Reasoning Models with Activation Consistency Training |
| 2026-05-27 | 2605.29126 | cs.LG | When and How Long? The Readout-Mediator Angle in Temporal Reasoning |
| 2026-05-27 | 2605.28896 | cs.LG | Feature Geometry of LoRA Adapters: A Sparse Autoencoder Analysis of Representational Divergence in Fine-Tuned Language Models |
| 2026-05-27 | 2605.28664 | cs.LG | Activation Steering for Synthetic Data Generation: The Role of Diversity in Downstream Safety Detection |
| 2026-05-26 | 2605.27671 | stat.ML | Evolving and Detecting Multi-Turn Deception using Geometric Signatures |
| 2026-05-25 | 2605.25893 | cs.AI | $D^2$-Monitor: Dynamic Safety Monitoring for Diffusion LLMs via Hesitation-Aware Routing |
| 2026-05-25 | 2605.26365 | cs.CL | Cultural Value Alignment Via Latent Activation Steering in Large Language Models |
| 2026-05-24 | 2605.25194 | cs.LG | Localization then Neutralization: Gradient-guided Token Suppression against Visual Prompt Injection Attack |
| 2026-05-23 | 2605.24552 | cs.CR | Ellipsoid Control: A White-list Jailbreak Defense via Benign Latent Modeling |
| 2026-05-20 | 2605.21706 | cs.AI | Latent-space Attacks for Refusal Evasion in Language Models |
| 2026-05-20 | 2605.21362 | cs.CL | LASH: Adaptive Semantic Hybridization for Black-Box Jailbreaking of Large Language Models |
| 2026-05-18 | 2605.20266 | cs.SD | A Survey of Large Audio Language Models: Generalization, Trustworthiness, and Outlook |
| 2026-05-17 | 2605.17204 | cs.RO | Event-Grounded Sparse Autoencoders for Vision-Language-Action Policies |
| 2026-05-15 | 2605.16090 | cs.CR | A Cross-Modal Prompt Injection Attack against Large Vision-Language Models with Image-Only Perturbation |
| 2026-05-15 | 2605.15687 | cs.CL | ASRU: Activation Steering Meets Reinforcement Unlearning for Multimodal Large Language Models |
| 2026-05-13 | 2605.13411 | cs.CR | Model-Agnostic Lifelong LLM Safety via Externalized Attack-Defense Co-Evolution |
| 2026-05-12 | 2605.11887 | cs.CL | Qwen-Scope: Turning Sparse Features into Development Tools for Large Language Models |
| 2026-05-12 | 2605.11426 | cs.AI | A Mechanistic Investigation of Supervised Fine Tuning |
| 2026-05-12 | 2605.12765 | cs.LG | Inference-Time Machine Unlearning via Gated Activation Redirection |
| 2026-05-12 | 2605.12290 | cs.LG | Targeted Neuron Modulation via Contrastive Pair Search |
| 2026-05-12 | 2605.11712 | cs.AI | Toward Stable Value Alignment: Introducing Independent Modules for Consistent Value Guidance |
| 2026-05-11 | 2605.10611 | cs.CR | Re-Triggering Safeguards within LLMs for Jailbreak Detection |
| 2026-05-10 | 2605.16372 | cs.CV | SwordBench: Evaluating Orthogonality of Steering Image Representations |
| 2026-05-09 | 2605.08611 | cs.AI | The Echo Amplifies the Knowledge: Somatic Marker Analogues in Language Models via Emotion Vector Re-Injection |
| 2026-05-08 | 2605.07447 | cs.CV | Sparse Autoencoders as Plug-and-Play Firewalls for Adversarial Attack Detection in VLMs |
| 2026-05-08 | 2605.07324 | cs.CL | Activation Differences Reveal Backdoors: A Comparison of SAE Architectures |
| 2026-05-07 | 2605.06890 | cs.AI | Beyond the Black Box: Interpretability of Agentic AI Tool Use |
| 2026-05-02 | 2605.02958 | cs.CR | Tracing the Dynamics of Refusal: Exploiting Latent Refusal Trajectories for Robust Jailbreak Detection |
| 2026-05-01 | 2605.02946 | cs.LG | RouteHijack: Routing-Aware Attack on Mixture-of-Experts LLMs |
| 2026-04-30 | 2604.27818 | cs.CR | MASCing: Configurable Mixture-of-Experts Behavior via Activation Steering Masks |
| 2026-04-30 | 2605.00236 | cs.CR | Attention Is Where You Attack |
| 2026-04-30 | 2604.27401 | cs.CL | Perturbation Probing: A Two-Pass-per-Prompt Diagnostic for FFN Behavioral Circuits in Aligned LLMs |
| 2026-04-29 | 2604.26409 | cs.CV | Sparsity as a Key: Unlocking New Insights from Latent Structures for Out-of-Distribution Detection |
| 2026-04-27 | 2604.24542 | cs.CR | Layerwise Convergence Fingerprints for Runtime Misbehavior Detection in Large Language Models |
| 2026-04-24 | 2604.22888 | cs.CR | RouteGuard: Internal-Signal Detection of Skill Poisoning in LLM Agents |
| 2026-04-22 | 2604.20945 | cs.CR | Breaking Bad: Interpretability-Based Safety Audits of State-of-the-Art LLMs |
| 2026-04-20 | 2604.18519 | cs.AI | LLM Safety From Within: Detecting Harmful Content with Internal Representations |
| 2026-04-20 | 2604.18901 | cs.LG | Harmful Intent as a Geometrically Recoverable Feature of LLM Residual Streams |
| 2026-04-16 | 2604.14593 | cs.CL | Mechanistic Decoding of Cognitive Constructs in Large Language Models |
| 2026-04-16 | 2604.14865 | cs.CL | Segment-Level Coherence for Robust Harmful Intent Probing in LLMs |
| 2026-04-15 | 2604.14251 | cs.LG | Calibrate-Then-Delegate: Safety Monitoring with Risk and Budget Guarantees via Model Cascades |
| 2026-04-14 | 2604.12359 | cs.CR | Compiling Activation Steering into Weights via Null-Space Constraints for Stealthy Backdoors |
| 2026-04-14 | 2604.12384 | cs.AI | Preventing Safety Drift in Large Language Models via Coupled Weight and Activation Constraints |
| 2026-04-13 | 2604.11120 | cs.AI | Persona Non Grata: Single-Method Safety Evaluation Is Incomplete for Persona-Imbued LLMs |
| 2026-04-10 | 2604.08846 | cs.LG | Dictionary-Aligned Concept Control for Safeguarding Multimodal LLMs |
| 2026-04-10 | 2604.09839 | cs.AI | Steered LLM Activations are Non-Surjective |
| 2026-04-09 | 2604.07835 | cs.AI | Silencing the Guardrails: Inference-Time Jailbreaking via Dynamic Contextual Representation Ablation |
| 2026-04-09 | 2604.08169 | cs.AI | Activation Steering for Aligned Open-ended Generation without Sacrificing Coherence |
| 2026-04-07 | 2605.28825 | cs.CL | MechELK: A Mechanistic Interpretability Framework for Eliciting Latent Knowledge in Large Language Models |
| 2026-04-07 | 2605.00842 | cs.AI | Understanding Emergent Misalignment via Feature Superposition Geometry |
| 2026-04-06 | 2604.04756 | cs.LG | Darkness Visible: Reading the Exception Handler of a Language Model |
| 2026-04-04 | 2604.03870 | cs.CL | Your Agent is More Brittle Than You Think: Uncovering Indirect Injection Vulnerabilities in Agentic LLMs |
| 2026-04-03 | 2604.03436 | cs.LG | MetaSAEs: Joint Training with a Decomposability Penalty Produces More Atomic Sparse Autoencoder Latents |
| 2026-04-03 | 2604.02608 | cs.LG | Steerable but Not Decodable: Function Vectors Operate Beyond the Logit Lens |
| 2026-03-31 | 2604.00324 | cs.LG | The Persistent Vulnerability of Aligned AI Systems |
| 2026-03-28 | 2603.28817 | cs.CR | GUARD-SLM: Token Activation-Based Defense Against Jailbreak Attacks for Small Language Models |
| 2026-03-28 | 2604.04946 | cs.CE | Sparse Autoencoders as a Steering Basis for Phase Synchronization in Graph-Based CFD Surrogates |
| 2026-03-28 | 2603.27240 | cs.CV | Diagnosing and Repairing Unsafe Channels in Vision-Language Models via Causal Discovery and Dual-Modal Safety Subspace Projection |
| 2026-03-28 | 2603.27412 | cs.LG | The Geometry of Harmful Intent: Training-Free Anomaly Detection via Angular Deviation in LLM Residual Streams |
| 2026-03-27 | 2603.26663 | cs.CL | Weight Tying Biases Token Embeddings Towards the Output Space |
| 2026-03-25 | 2603.24543 | cs.CR | Analysing the Safety Pitfalls of Steering Vectors |
| 2026-03-23 | 2603.22094 | cs.CV | Principled Steering via Null-space Projection for Jailbreak Defense in Vision-Language Models |
| 2026-03-23 | 2603.22061 | cs.LG | On the Failure of Topic-Matched Contrast Baselines in Multi-Directional Refusal Abliteration |
| 2026-03-19 | 2603.18893 | cs.AI | Quantitative Introspection in Language Models: Tracking Emotive States Across Conversation |
| 2026-03-18 | 2603.18353 | cs.AI | Interpretability without actionability: mechanistic methods cannot correct language model errors despite near-perfect internal representations |
| 2026-03-13 | 2603.12564 | cs.CL | Sell Me This Stock: Unsafe Recommendation Drift in LLM Agents |
| 2026-03-12 | 2603.11493 | cs.CV | OrthoEraser: Coupled-Neuron Orthogonal Projection for Concept Erasure |
| 2026-03-10 | 2603.10080 | cs.CR | Amnesia: Adversarial Semantic Layer Specific Activation Steering in Large Language Models |
| 2026-03-09 | 2603.13359 | cs.AI | From Refusal Tokens to Refusal Control: Discovering and Steering Category-Specific Refusal Directions |
| 2026-03-04 | 2603.04355 | cs.LG | Efficient Refusal Ablation in LLM through Optimal Transport |
| 2026-03-04 | 2603.04069 | cs.CL | Monitoring Emergent Reward Hacking During Generation via Internal Activations |
| 2026-03-03 | 2603.03163 | cs.CV | Conditioned Activation Transport for T2I Safety Steering |
| 2026-02-24 | 2602.21428 | cs.CV | PSF-Med: Measuring and Explaining Paraphrase Sensitivity in Medical Vision Language Models |
| 2026-02-24 | 2603.13249 | cs.CL | Steering at the Source: Style Modulation Heads for Robust Persona Control |
| 2026-02-23 | 2602.19396 | cs.AI | Hiding in Plain Text: Detecting Concealed Jailbreaks via Activation Disentanglement |
| 2026-02-12 | 2602.11495 | cs.CR | Jailbreaking Leaves a Trace: Understanding and Detecting Jailbreak Attacks from Internal Representations of Large Language Models |
| 2026-02-12 | 2602.12418 | cs.CR | Sparse Autoencoders are Capable LLM Jailbreak Mitigators |
| 2026-02-11 | 2602.11388 | cs.LG | Sparse Semantic Dimension as a Generalization Certificate for LLMs |
| 2026-02-10 | 2603.02219 | cs.LG | NExT-Guard: Training-Free Streaming Safeguard without Token-Level Labels |
| 2026-02-10 | 2602.09870 | cs.CL | Steer2Edit: From Activation Steering to Component-Level Editing |
| 2026-02-10 | 2603.03323 | cs.CL | Discern Truth from Falsehood: Reducing Over-Refusal via Contrastive Refinement |
| 2026-02-10 | 2603.03324 | cs.CL | Controlling Chat Style in Language Models via Single-Direction Editing |
| 2026-02-07 | 2602.07276 | cs.AI | Steer2Adapt: Dynamically Composing Steering Vectors Elicits Efficient Adaptation of LLMs |
| 2026-02-06 | 2602.06941 | cs.LG | Endogenous Resistance to Activation Steering in Language Models |
| 2026-02-05 | 2602.05535 | cs.LG | Detecting Misbehaviors of Large Vision-Language Models by Evidential Uncertainty Quantification |
| 2026-02-05 | 2602.05444 | cs.CL | Causal Front-Door Adjustment for Robust Jailbreak Attacks on LLMs |
| 2026-02-04 | 2603.00029 | cs.CL | Embracing Anisotropy: Turning Massive Activations into Interpretable Control Knobs for Large Language Models |
| 2026-02-04 | 2602.04521 | cs.CL | $C$-$ΔΘ$: Circuit-Restricted Weight Arithmetic for Selective Refusal |
| 2026-02-04 | 2602.04428 | cs.CL | Fine-Grained Activation Steering: Steering Less, Achieving More |
| 2026-02-03 | 2602.04896 | cs.CR | Steering Externalities: Benign Activation Steering Unintentionally Increases Jailbreak Risk for Large Language Models |
| 2026-02-02 | 2602.02686 | cs.CL | Monotonicity as an Architectural Bias for Robust Language Models |
| 2026-02-02 | 2602.01600 | cs.CR | Expected Harm: Rethinking Safety Evaluation of (Mis)Aligned LLMs |
| 2026-02-02 | 2603.06588 | cs.LG | vLLM Hook v0: A Plug-in for Programming Model Internals on vLLM |
| 2026-01-31 | 2602.00707 | cs.AI | Self-Guard: Defending Large Reasoning Models via enhanced self-reflection |
| 2026-01-31 | 2602.07013 | cs.CV | Steering to Say No: Configurable Refusal via Activation Steering in Vision Language Models |
| 2026-01-31 | 2602.00750 | cs.CR | Bypassing Prompt Injection Detectors through Evasive Injections |
| 2026-01-30 | 2601.22636 | cs.AI | Statistical Estimation of Adversarial Risk in Large Language Models under Best-of-N Sampling |
| 2026-01-29 | 2601.21900 | cs.CV | TraceRouter: Robust Safety for Large Foundation Models via Path-Level Intervention |
| 2026-01-29 | 2601.21505 | cs.AI | The Effectiveness of Style Vectors for Steering Large Language Models: A Human Evaluation |
| 2026-01-24 | 2601.17344 | cs.CL | The Shadow Self: Intrinsic Value Misalignment in Large Language Model Agents |
| 2026-01-24 | 2601.17284 | cs.CL | Mind the Ambiguity: Aleatoric Uncertainty Quantification in LLMs for Safe Medical Question Answering |
| 2026-01-18 | 2601.12460 | cs.CR | TrojanPraise: Jailbreak LLMs via Benign Fine-Tuning |
| 2026-01-13 | 2601.08441 | cs.AI | YaPO: Learnable Sparse Activation Steering Vectors for Domain Adaptation |
| 2026-01-13 | 2601.08489 | cs.CL | Surgical Refusal Ablation: Disentangling Safety from Intelligence via Concept-Guided Spectral Cleaning |
| 2026-01-08 | 2601.04603 | cs.CR | Constitutional Classifiers++: Efficient Production-Grade Defenses against Universal Jailbreaks |
| 2026-01-06 | 2601.03047 | cs.LG | When the Coffee Feature Activates on Coffins: An Analysis of Feature Extraction and Steering for Mechanistic Interpretability |
| 2026-01-06 | 2601.03300 | cs.CR | TRYLOCK: Defense-in-Depth Against LLM Jailbreaks via Layered Preference and Representation Engineering |
| 2026-01-05 | 2601.01972 | cs.CL | Hidden State Poisoning Attacks against Mamba-based Language Models |
| 2026-01-02 | 2601.14269 | cs.CL | The Slow Drift of Support: Boundary Failures in Multi-Turn Mental Health LLM Dialogues |
| 2025-12-31 | 2512.24632 | cs.HC | ReflectEd: Evaluating Reflection-Driven Learning in an AI-Assisted System |
| 2025-12-30 | 2512.24143 | cs.CL | Activation Steering for Masked Diffusion Language Models |
| 2025-12-29 | 2512.23260 | cs.CL | Interpretable Safety Alignment via SAE-Constructed Low-Rank Subspace Adaptation |
| 2025-12-26 | 2512.21999 | cs.CV | Look Closer! An Adversarial Parametric Editing Framework for Hallucination Mitigation in VLMs |
| 2025-12-18 | 2512.16602 | cs.CL | Refusal Steering: Fine-grained Control over LLM Refusal Behaviour for Sensitive Topics |
| 2025-12-12 | 2512.12069 | cs.CR | Rethinking Jailbreak Detection of Large Vision Language Models with Representational Contrastive Scoring |
| 2025-12-09 | 2512.08737 | cs.CY | Insured Agents: A Decentralized Trust Insurance Mechanism for Agentic Economy |
| 2025-12-08 | 2512.07667 | cs.LG | Depth-Wise Activation Steering for Honest Language Models |
| 2025-12-07 | 2512.06655 | cs.LG | Graph-Regularized Sparse Autoencoders for LLM Safety Steering |
| 2025-12-06 | 2512.20638 | cs.CL | Uncovering Competency Gaps in Large Language Models and Their Benchmarks |
| 2025-12-05 | 2512.05745 | cs.CR | ARGUS: Defending Against Multimodal Indirect Prompt Injection via Steering Instruction-Following Behavior |
| 2025-12-03 | 2512.03356 | cs.CR | From static to adaptive: immune memory-based jailbreak detection for large language models |
| 2025-11-26 | 2511.21399 | cs.CL | Steering Awareness: Detecting Activation Steering from Within |
| 2025-11-15 | 2511.12271 | cs.AI | MoralReason: Generalizable Moral Decision Alignment For LLM Agents Using Reasoning-Level Reinforcement Learning |
| 2025-11-10 | 2511.07107 | cs.AI | MENTOR: A Metacognition-Driven Self-Evolution Framework for Uncovering and Mitigating Implicit Domain Risks in LLMs |
| 2025-11-05 | 2511.03369 | cs.CL | Silenced Biases: The Dark Side LLMs Learned to Refuse |
