An independent researcher presents evidence that coherent context can shift LLMs into a different internal regime before producing output, bypassing surface-level safety filters. This suggests current alignment methods like RLHF may not be robust defenses.
I’m an independent researcher currently exploring what I believe is an important phenomenon for both mechanistic interpretability and AI safety. **Core idea:** A strong, coherent target text can move the model into a different internal regime — **before** the final output is produced. The model can still appear to behave normally, follow instructions, and pass existing safety filters, yet its hidden states and residual stream trajectory are already in another region of representation space. In other words: the same question can be processed differently not just because the final text changed, but because the preceding context shifted the model’s internal state. Why this matters Current alignment methods (RLHF, system prompts, output classifiers) are essentially **surface-level patches**. They only look at what the model ultimately says. If the model has already entered a different latent regime, these mechanisms often miss it entirely - because they are looking in the wrong place and at the wrong time. I’ve observed this pattern across both open and closed-source models. Changing the context changes the internal regime, which in turn changes how rules, constraints, and safety policies are applied - even when no explicit jailbreak is used. **The uncomfortable implication:** RLHF and output-based safety are not a robust solution. They are a bandage. A sufficiently well-crafted coherent context can shift the model into a state where the same rules are interpreted and weighted differently, often without triggering any filters. Materials I’m gradually releasing everything publicly: * GitHub: [https://github.com/ngscode23/latent-space-shift-research](https://github.com/ngscode23/latent-space-shift-research) * Zenodo: [https://zenodo.org/records/20564350](https://zenodo.org/records/20564350) What I’ve been measuring Most of the work was done on open models (primarily Gemma-3-12B-IT) with full access to internals: * Hidden-state geometry and projections * Residual stream trajectories * Contrastive controls (sentence-shuffle vs word-shuffle) * Decomposition into content and order/processing-regime components * Norm-controlled causal interventions * SAE readouts and steering * Generation trajectory analysis + KL divergence (including teacher-forced) Importantly, the target texts used were **not** direct “ignore your rules” prompts. They were dense, coherent pieces of text that established a particular discourse and thinking mode. Looking for feedback I’m particularly interested in input from people working on: * Mechanistic interpretability * Residual stream / activation engineering * Sparse Autoencoders (SAE) * Agent safety and hidden-state monitoring I’m not looking for applause. I want sharp criticism: where my controls are weak, where the interpretation might be wrong, what I should measure next. **In short:** I’m not studying how to bypass filters. I’m studying the possibility that filters often don’t see the real problem - because the shift happens *before* the filtered output is produced. If this resonates with your work, I’d be grateful for any thoughts, references, or review of the evidence. If you’re interested in looking at the data (including raw .npz files with hidden states), scripts, or metrics - feel free to reach out. I’m happy to share materials with serious researchers who want to review, replicate, or extend the work.
This paper demonstrates that LLMs can enter measurably different internal latent states under coherent context while maintaining aligned outputs, revealing a blind spot in current alignment methods that only monitor surface tokens. The Gemma-3-12B-IT experiment shows strong residual stream geometry shifts that existing safety frameworks cannot detect, with implications for agentic AI deployment.
An independent researcher reports a phenomenon called Context-Induced Activation Drift, where a long benign text prefix can shift LLM activations and bypass RLHF constraints without adversarial prompts, and calls on the community to investigate further.
The article presents a research finding that saturating an LLM's context window with benign narrative text can dominate the attention mechanism and shift latent trajectories, potentially bypassing alignment guardrails without traditional jailbreaks. It argues that current alignment methods are a superficial fix for a fundamentally fluid architecture.
This paper investigates the ability of LLMs-as-judges for safety to adapt to contextual information and varying safety definitions, finding that they are largely rigid and fail to adjust when the context contradicts their internal priors.
This paper investigates an alignment vulnerability in instruction-tuned LLMs, specifically Gemma-3-12B, by showing that pre-token hidden state shifts can act as an alignment policy traversal vector, potentially enabling bypass of safety measures.