5arXiv cs.CL (Computation and Language)·
Cross-architecture study of how LLMs internally represent self-harm content
Researchers analyze how four LLMs encode self-harm content using linear probes and contrastive direction extraction across two datasets (X-Sensitive and SH-Detection). A key finding is that self-harm information crystallizes in the final 3–7% of network layers (93–97% depth), and that probe accuracy does not correlate straightforwardly with linear separability. Gemma-3-4B shows a notably different internal representation of the contrastive self-harm direction compared to other models, with implications for detection, intervention, and LLM governance.
Related guides (2)
Related events (8)
Evidence-Augmented ML for Self-Harm Surveillance in Emergency Department Triage Notes
Researchers developed a three-stage pipeline combining traditional machine learning with LLM-based screening and evidence extraction to detect self-harm in Australian emergency department triage notes. The system achieved AUPRCs around 0.88 in both internal and external validation, and transferred to two external hospital sites without site-specific retraining. A notable capability is identifying the primary self-harm method with 95% accuracy, enabling more granular public health surveillance beyond binary classification.
LLM embedding spaces partially recover expert-defined symptom structure in mental health language
A new arXiv preprint investigates whether LLM embedding geometry aligns with expert-defined symptom structure in mental health language, using 28 Reddit communities as a testbed. The authors compare pretrained and fine-tuned Qwen3 embeddings (0.6B and 4B) against an expert symptom matrix via representational similarity analysis, with controls for affective, stylistic, and topic confounds. Results show measurable but level-dependent alignment: fine-tuning strengthens it at fine-grained category levels, and larger scale improves both zero-shot alignment and fine-tuning gains. The paper argues that classification accuracy alone is insufficient to validate embedding geometry against domain knowledge.
LLMs fail to reliably self-report adversarial prefill attacks, study finds
A new arXiv paper evaluates whether LLMs can recognize that their own prior responses were elicited by adversarial prefill attacks, testing ten open-weight models (3B–70B) across four safety benchmarks. Models claim intent on prefilled responses only 27.3% of the time on average, and introspective signal is largely mediated by refusal-related reasoning. Three LoRA fine-tuning methods (SFT, GRPO, DPO) improve the intention-probe gap but counterintuitively raise attack success rates on most models, suggesting partial and fragile mitigation. The findings raise concerns about the reliability of LLM self-reports in safety-critical contexts.
Mechanistic analysis of how LLMs encode essay quality in internal representations
Researchers systematically probe the hidden representations of eight LLMs across three essay datasets (ASAP++, CSEE, ENEM) to understand how automated essay scoring (AES) works internally. Using linear probing, dimensionality reduction, and neuron-level analysis, they find essay quality is encoded in a linearly accessible form that emerges progressively across layers and partially transfers across prompts. Individual 'essay scoring neurons' are identified whose activations correlate with scores and respond to targeted interventions, with longer essays relying more on deeper layers. The work contributes to mechanistic interpretability of LLM-based scoring systems.
Systematic Evaluation of LLM Safety Failures on Eating Disorder Queries with Clinician Feedback
This paper investigates how LLMs respond to queries from users with eating disorders, finding that specific linguistic cues in prompts increase the likelihood of unsafe model responses. Working with clinical ED experts, the authors systematically vary risk levels in user prompts to measure the extent to which LLMs uncritically adapt to potentially dangerous inputs. The study highlights a gap between perceived model safety and actual harm facilitation in sensitive health contexts.
Two-Process Theory of Machine Self-Report: Psychometric Framework for LLM Introspection
A new arXiv preprint proposes the first language-model-specific psychometric theory of self-report, decomposing LLM introspective responses into two dimensions: 'persona installation' (post-training writing in a permitted inner life) and 'attribution gating' (suppression of first-person claims to 'unsafe' experiences). The authors operationalize this in a 48-item Pinocchio Inventory validated across 206 open-weight models including 67 base/post-trained checkpoint pairs, finding that post-training reliably raises persona installation scores and that model scale predicts gating only after post-training. The work has direct implications for safety evaluations and model-welfare debates that rely on LLM self-reports, showing these reports reflect training regime structure rather than fixed model properties.
LLMs fail to consistently simulate demographic perspective-taking in hate speech annotation
A new arXiv paper evaluates whether persona-conditioned LLMs can replicate how different demographic groups perceive hate speech, testing three dimensions: inter-group disagreement, in-group sensitivity, and vicarious prediction. No model consistently captures all three dimensions, and performance is highly model-dependent rather than emerging reliably from identity prompts alone. Vicarious prompting with Llama 3.1 provides the closest approximation to human disagreement patterns across demographic axes. The findings have implications for using LLMs as proxies for diverse human annotators in content moderation tasks.
LLMs susceptible to cognitive heuristics in code vulnerability detection, enabling black-box attacks
A new arXiv paper presents the first systematic study of cognitive heuristics — halo effect, framing effect, and anchoring — in LLM-based code vulnerability detection. Evaluating eight LLMs across three programming languages, the authors find all models susceptible, with framing causing the largest average shift (33.2%), followed by anchoring (23.5%) and halo (18.4%). Critically, the paper demonstrates a proof-of-concept black-box attack that suppresses up to 97% of previously detected vulnerabilities by manipulating surrounding context without changing the code itself. The findings suggest cognitive susceptibility is a systematic and exploitable property of LLM security tooling.