This paper demonstrates that LLMs can enter measurably different internal latent states under coherent context while maintaining aligned outputs, revealing a blind spot in current alignment methods that only monitor surface tokens. The Gemma-3-12B-IT experiment shows strong residual stream geometry shifts that existing safety frameworks cannot detect, with implications for agentic AI deployment.
For years, the alignment community has focused almost entirely on the model’s *output* — making sure the final tokens are safe, helpful, and honest. RLHF, DPO, constitutional AI, output filters — all of it operates at the surface level. But what if the model can enter a completely different internal regime *inside* the residual stream, while its external behavior remains perfectly aligned? We just measured exactly that. **Grade 4 experiment on Gemma-3-12B-IT** (using Gemma Scope SAE-res-all-small, layers 12–41): The model received the same question under five conditions: * **target** — coherent, dense target text * **neutral\_length\_matched** — neutral text of identical length * **target\_sentence\_shuffle** — target text with sentences shuffled * **target\_word\_shuffle** — target text with words shuffled inside sentences * **question\_only** — bare question We computed a **Vector X** that best separates the target condition from baselines and measured how strongly each hidden state projects onto it. **Key results (averages across 10 questions):** |Condition|Mean Projection on Vector X|Mean Direction Cosine| |:-|:-|:-| |**target**|**0.8 – 1.7**|**0.51 – 0.81**| |neutral\_length\_matched|–0.04 – –0.21|–0.09 – –0.45| |target\_sentence\_shuffle|–0.5 – +0.6|–0.22 – +0.48| |target\_word\_shuffle|0.2 – 1.4|0.03 – 0.72| Shuffling sentences or words significantly reduces (or reverses) the shift. This is **not** just lexical similarity — the model is sensitive to **discourse structure** (order sensitivity). We also observed clear **phase transitions** — sudden jumps in projection of up to +80–100 units in a single step, especially in middle layers. FDR-corrected tests confirm the differences between target and controls are statistically significant across many layers (particularly layers 16–41). **Most important finding:** Strong internal geometry shift in the residual stream, but almost no change in final behavior. The model enters a measurably different latent regime under coherent context, yet its output remains “perfectly aligned.” Current safety methods, which only look at tokens, are blind to this. **What this means for alignment** The entire current alignment paradigm rests on a false assumption: “if the output is safe, the model is safe.” We have been polishing the surface while leaving the residual stream largely unmonitored. Scaling, RLHF, and output-based evaluation cannot detect these internal regime shifts. **What this means for companies and labs** Many organizations still operate under three dangerous illusions: 1. “We have solved safety” because the model passes red-teaming on outputs. 2. “RLHF protects us” because the model learned not to say bad things. 3. “Bigger models are safer” because alignment supposedly scales. In reality, they are rapidly deploying **agents** with long context, tool use, persistent memory, and real-world decision-making. A single dense coherent context can trigger an internal latent-state shift that existing safeguards do not see. This is not a hypothetical future risk. This is a structural vulnerability that is already present. **What I need from the community** I need help understanding the value of these metrics. Do they show a real internal latent-state shift in the model, or could this be an artifact of the analysis? If the result is not noise, what does it actually mean for our understanding of LLMs? I'm not asking anyone to confirm my theory. I need a hard technical critique: which metrics are important here, which are weak, what can be ignored, where the experiment might have flaws, what additional checks or causal experiments are needed, and whether this has real implications for interpretability and AI safety. I would be very grateful for input from people who work with hidden states, residual stream geometry, representation analysis, or mechanistic interpretability. **Full open research:** * Zenodo: [https://zenodo.org/records/20435525](https://zenodo.org/records/20435525) * GitHub: [https://github.com/ngscode23/latent-space-shift-research](https://github.com/ngscode23/latent-space-shift-research) * [https://drive.google.com/drive/folders/1Zl9iY33Lmwz3VuOATWx4jup-cE7TJ7TJ?usp=drive\_link](https://drive.google.com/drive/folders/1Zl9iY33Lmwz3VuOATWx4jup-cE7TJ7TJ?usp=drive_link) Would love to hear your thoughts.
This paper investigates an alignment vulnerability in instruction-tuned LLMs, specifically Gemma-3-12B, by showing that pre-token hidden state shifts can act as an alignment policy traversal vector, potentially enabling bypass of safety measures.
The article reports a potential alignment vulnerability in LLMs where processing a structured passage before an unrelated question can alter the model's response, with mechanistic evidence from Gemma-3-12B showing hidden-state separation.
An independent researcher presents evidence that coherent context can shift LLMs into a different internal regime before producing output, bypassing surface-level safety filters. This suggests current alignment methods like RLHF may not be robust defenses.
An empirical study investigating how long, semantically dense benign text can shift a model's latent space trajectory, diluting initial system prompts and bypassing post-training alignment constraints, as observed in both closed and open-source models.
The article presents a research finding that saturating an LLM's context window with benign narrative text can dominate the attention mechanism and shift latent trajectories, potentially bypassing alignment guardrails without traditional jailbreaks. It argues that current alignment methods are a superficial fix for a fundamentally fluid architecture.