Analysing Self-Harm Representations in Language Models: a Cross-Architecture Study

2026-07-27 · Source: cs.CL updates on arXiv.org · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Data Science & Analytics, Cybersecurity & Data Privacy · Depth: Expert, long

Summary

A cross-architecture study analyzed how Large Language Models (LLMs) internally represent self-harm content, using linear probes and contrastive direction analysis on Qwen3-0.6B, Llama 3.2-1B-Instruct, Llama 3.2-3B-Instruct, and Gemma-3-4B-it. Researchers found that self-harm information consistently crystallizes in the final 3-7% of network layers (93-97% depth) across two datasets, X-Sensitive and SH-Detection. While probe AUC ranged from 0.703 to 0.817 on X-Sensitive and 0.923 to 0.972 on SH-Detection, the most accurate probes were not always the most geometrically separable. Notably, Gemma-3-4B exhibited a more intricate representation, spreading the self-harm signal across its activation space rather than concentrating it in a single direction. The study also revealed that self-harm contrastive directions are dynamically re-represented, rotating substantially between early and late layers, with adjacent-layer directions showing high alignment (0.76-0.92) but early-to-late layer directions being nearly orthogonal (0.14-0.38).

Key takeaway

For AI safety engineers developing content moderation systems, understanding LLM internal representations is crucial. You should focus intervention strategies on the final 3-7% of network layers where self-harm concepts crystallize. Be aware that models like Gemma-3-4B may distribute sensitive signals across activation space, requiring more complex detection methods than simple linear separation. Your efforts should extend beyond prompt engineering to include explicit, testable components for robust and effective safety mechanisms.

Key insights

Self-harm representations in LLMs crystallize late in networks but are geometrically unstable and distributed across activation space.

Principles

• Self-harm concepts emerge in final 3-7% of layers.
• Representations dynamically re-represent across depth.
• Probe accuracy doesn't equal linear separability.

Method

Linear probes evaluate layer-wise ROC-AUC. Contrastive directions are computed via mean-difference activations, then assessed for separability (Cohen's d) and stability (cosine similarity).

In practice

• Focus safety interventions on late-layer activations.
• Consider distributed signals for Gemma-like models.
• Evaluate dataset quality for representation impact.

Topics

• Self-Harm Detection
• Language Model Interpretability
• Representation Engineering
• Linear Probing
• Contrastive Directions
• AI Safety

Code references

• luisespinosaanke/self-harm-analysis
• TransformerLensOrg/TransformerLens

Best for: Research Scientist, AI Scientist, Machine Learning Engineer, AI Security Engineer

Related on AIssential

• Analysing Self-Harm Representations in Language Models: a Cross-Architecture Study — Self-harm content representations in LLMs localize to specific layers and vary across architectures.
• Mechanistic Interpretability of Cognitive Complexity in LLMs via Linear Probing using Bloom's Taxonomy — LLMs encode cognitive complexity in a linearly separable latent space, emerging early in processing.
• Distributed Sparse Interventions in Language Models — DSI enables fine-grained, sparse, and distributed control over language model task behavior by targeting specific neurons.
• Hierarchical Multi-Stage Modeling of Adaptive and Maladaptive Self-States in Social Media Timelines — Integrating multi-task learning and structured generation enhances interpretable mental health analysis from social media data.
• Beyond Surface Statistics: Robust Conformal Prediction for LLMs via Internal Representations — Internal LLM representations offer more robust uncertainty signals for conformal prediction, especially under distribution shifts.
• From Prompt Risk to Response Risk: Paired Analysis of Safety Behavior of Large Language Model — LLM safety analysis benefits from paired prompt-to-response severity transitions and joint relevance assessment.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by cs.CL updates on arXiv.org.