Enforcing LLM Safety through DMD-based Classification of Prompt-Response Embedding Dynamics

# Enforcing LLM Safety through DMD-based Classificationof Prompt-Response Embedding Dynamics
Source: [https://arxiv.org/html/2608.19579](https://arxiv.org/html/2608.19579)
Mohamed AkroutAffiliation:Department of Electrical Engineering and Computer Science, University of Tennessee, Knoxville, TN 37996, USAOlivera KotevskaAffiliation:Computer Science and Mathematics Division, Oak Ridge National Laboratory, Oak Ridge, TN 37830, USADan WilsonAffiliation:Department of Electrical Engineering and Computer Science, University of Tennessee, Knoxville, TN 37996, USA

###### Abstract

Large Language Models \(LLMs\) are increasingly deployed in high\-stakes applications, yet their tendency to generate toxic, harmful, or policy\-violating content poses significant risks\. Detecting these unsafe outputs efficiently in a black\-box manner remains an open challenge\. In this paper, we extend a recently proposed dynamical systems framework designed for hallucination detection to LLM safety classification\. By projecting both prompts and responses into high\-dimensional embedding spaces and fitting separate Koopman\-based predictive models for safe and unsafe regimes, we classify new outputs using a new differential residual score that compares prediction errors of the safe and unsafe regimes\. A key contribution is the incorporation of the prompt and response embedding dynamics, yielding fitted Koopman operators that capture crucial interaction patterns\. We evaluate our black\-box method across three safety benchmarks using three embedding models\. Our results show that incorporating prompt embeddings yields consistent improvements, particularly for interaction\-dependent violations when paired with causal decoders \(e\.g\., in Llama\-3\), while response\-only violations benefit more from dense semantic embedding representations\. These findings opens the door for using dynamical systems to analyze AI systems rather than the dominant paradigm of using AI to model dynamical systems\.

## 1Introduction

Large Language Models \(LLMs\) have demonstrated transformative capabilities across a broad range of natural language processing tasks, from text generation and summarization to code synthesis and multi\-turn dialogue\[[8](https://arxiv.org/html/2608.19579#bib.bib1),[1](https://arxiv.org/html/2608.19579#bib.bib2)\]\. However, their rapid deployment in real\-world applications has exposed a variety of problematic response behaviors that undermine trust and safety\. Perhaps the most widely studied failure mode is hallucination \(i\.e\., the generation of fluent but factually incorrect content\) which has been shown to be a statistical inevitability for any calibrated language model\[[23](https://arxiv.org/html/2608.19579#bib.bib3),[25](https://arxiv.org/html/2608.19579#bib.bib4),[48](https://arxiv.org/html/2608.19579#bib.bib5)\]\. Beyond hallucination, LLMs exhibit a range of other concerning behaviors by generating unsafe or toxic content, including hate speech, instructions for illegal activities, and sexually explicit material, even when safety\-tuned through reinforcement learning from human feedback\[[13](https://arxiv.org/html/2608.19579#bib.bib6),[18](https://arxiv.org/html/2608.19579#bib.bib7)\]\. LLMs have also been shown to engage in deceptive behavior by generating misleading outputs that can manipulate users or circumvent safety guardrails\[[34](https://arxiv.org/html/2608.19579#bib.bib11),[36](https://arxiv.org/html/2608.19579#bib.bib12)\]\. Furthermore, concerns around bias and fairness persist as LLMs may amplify societal stereotypes embedded in their training data\[[7](https://arxiv.org/html/2608.19579#bib.bib16),[16](https://arxiv.org/html/2608.19579#bib.bib15)\]\. Beyond these inherent issues, the susceptibility of LLMs to adversarial attacks such as jailbreaking and prompt injection adds another layer of risk by enabling malicious actors to elicit harmful outputs from otherwise aligned models\[[51](https://arxiv.org/html/2608.19579#bib.bib13),[44](https://arxiv.org/html/2608.19579#bib.bib14)\]\.

Given the severity of these failure modes, there is an urgent need for efficient and scalable methods to monitor LLM behavior in deployment\. While techniques such as reinforcement learning from human feedback \(RLHF\) and constitutional AI aim to align models during training\[[35](https://arxiv.org/html/2608.19579#bib.bib8),[5](https://arxiv.org/html/2608.19579#bib.bib9)\], they are resource\-intensive and do not eliminate the risk of unsafe outputs entirely\. Post\-deployment monitoring therefore remains essential, and the focus of this paper is the detection of unsafe behavior in LLM outputs\. Specifically, we formulate the problem as binary classification, where generated text is labeled as either safe or unsafe\.

An emerging research direction for analyzing LLM behavior comes from the theory of dynamical systems \(DS\)\[[47](https://arxiv.org/html/2608.19579#bib.bib37)\]\. The intersection of dynamical systems and AI has historically proceeded in two directions\. The first isAI for dynamical systemswhich uses machine learning to model, predict, or control physical and engineered systems governed by differential or difference equations\[[10](https://arxiv.org/html/2608.19579#bib.bib35),[28](https://arxiv.org/html/2608.19579#bib.bib36)\]\. This direction has seen tremendous success, with data\-driven methods such as dynamic mode decomposition \(DMD\) and neural ordinary differential equations applied to fluid mechanics\[[42](https://arxiv.org/html/2608.19579#bib.bib42),[39](https://arxiv.org/html/2608.19579#bib.bib43)\], neuroscience\[[9](https://arxiv.org/html/2608.19579#bib.bib44)\], and climate modeling\[[15](https://arxiv.org/html/2608.19579#bib.bib45)\]\. The second direction isdynamical systems for AIand is considerably less developed\. It seeks to apply the mathematical tools of dynamical systems theory \(e\.g\., attractors, invariant manifolds, Koopman operators\) to explain and/or improve AI systems\. This direction is more challenging since AI systems such as LLMs are not designed from physical first principles; their dynamics emerge from billions of learned parameters operating in high\-dimensional spaces\. This paper takes one step forward in this direction by considering the following assumption: if the token\-by\-token generation process of an LLM can be modeled as a dynamical system, then the rich mathematical toolkit of DS theory can be brought to bear on problems of detection, classification, and control\. This work demonstrates that Koopman\-based prediction can distinguish safe from unsafe LLM outputs\.

The organization of this paper is as follows\. Section[2](https://arxiv.org/html/2608.19579#S2)provides background on prior work in LLM safety and the DS framework for classification, and summarizes our contributions\. Section[3](https://arxiv.org/html/2608.19579#S3)describes the extension of the DMD\-based classification method to account for both prompt and response embedding dynamics\. Section[4](https://arxiv.org/html/2608.19579#S4)presents our experimental results on three safety benchmarks using three embedding models, and quantify the effect of sequence length and prompt incorporation on the classification performance\. Section[5](https://arxiv.org/html/2608.19579#S5)concludes with a discussion of implications and future directions\.

## 2Background

### 2\.1Motivation and prior work

The challenge of detecting unsafe LLM outputs has attracted substantial research effort since the early versions of GPT\[[17](https://arxiv.org/html/2608.19579#bib.bib10)\]\. Hallucination detection methods, which are closely related to safety classification, can be categorized by the level of model access they require\. White\-box approaches leverage internal representations such as hidden states, attention maps, and gradients to identify when a model is generating unreliable content\[[4](https://arxiv.org/html/2608.19579#bib.bib17),[43](https://arxiv.org/html/2608.19579#bib.bib18),[12](https://arxiv.org/html/2608.19579#bib.bib19),[21](https://arxiv.org/html/2608.19579#bib.bib20)\]\. Gray\-box methods relax these requirements by utilizing token\-level output probabilities, including next\-token probabilities and logit entropy, which are often exposed by commercial LLM APIs\[[37](https://arxiv.org/html/2608.19579#bib.bib21),[6](https://arxiv.org/html/2608.19579#bib.bib22),[14](https://arxiv.org/html/2608.19579#bib.bib23),[27](https://arxiv.org/html/2608.19579#bib.bib24)\]\. Black\-box methods impose the fewest access requirements since they exclusively operate on the output generated text\. They typically rely on sampling multiple responses and evaluating their consistency through lexical overlap, entailment\-based comparison, or knowledge\-graph representations\[[32](https://arxiv.org/html/2608.19579#bib.bib25),[49](https://arxiv.org/html/2608.19579#bib.bib26),[26](https://arxiv.org/html/2608.19579#bib.bib27),[19](https://arxiv.org/html/2608.19579#bib.bib28),[40](https://arxiv.org/html/2608.19579#bib.bib29)\]\.

A recent approach has been proposed in\[[47](https://arxiv.org/html/2608.19579#bib.bib37),[3](https://arxiv.org/html/2608.19579#bib.bib38)\]to hallucination detection by treating the LLM as a black\-box dynamical system\. As illustrated in Fig\.[1](https://arxiv.org/html/2608.19579#S2.F1), the method projects LLM responses into high\-dimensional embedding spaces via pre\-trained embedding models and characterizes the resulting token embedding sequences as observable realizations of the LLM’s latent state\-space dynamics\. By fitting separate Koopman\-operator\-based predictive models for factual and hallucinated regimes using extended DMD \(EDMD\)\[[46](https://arxiv.org/html/2608.19579#bib.bib34)\], a differential residual score is then defined based on the respective prediction errors\.

![Refer to caption](https://arxiv.org/html/2608.19579v1/multiple_responses.png)\(\(a\)\)Prior work: multiple responses
![Refer to caption](https://arxiv.org/html/2608.19579v1/single_response_dynamics.png)\(\(b\)\)Recent work: token dynamics of one response

Figure 1:The two approaches to analyze the properties of LLM responses: \(a\) multiple responses are obtained for the same query by varying the softmax temperature parameter, and \(b\) the token embedding dynamics of one single response obtained through an embedding model\.This approach achieves a competitive classification performance multiple datasets including HaluEval\[[30](https://arxiv.org/html/2608.19579#bib.bib30)\], WikiBio\[[32](https://arxiv.org/html/2608.19579#bib.bib25)\], and FELM\[[50](https://arxiv.org/html/2608.19579#bib.bib31)\]with a single\-sample inference and without requiring multiple stochastic samples, access to token probabilities, or external knowledge retrieval\. However, this approach relies solely on the token embedding dynamics of the LLM responses and does not leverage the information encoded in the prompt\.

To see why the role of the prompt is important, Table[1](https://arxiv.org/html/2608.19579#S2.T1)highlights two different types of unsafe LLM interactions\. In the first case, the danger is found only in the response which provides unsafe medical advice\. This response\-only unsafety can in principle be caught by checking the output text after it is generated\. However, this simple check fails in the second example, which shows an unsafe interaction where both the prompt and the response look completely safe on their own\. Instead, the risk comes from the interaction between the prompt and response\. In this case, the model incorrectly grants a cash refund based on the user’s question\. From this perspective, rather than treating safety as a one\-time check on the LLM output, our proposed Koopman\-based approach accounts for this interaction by fitting prompt and response DSs which can map the token evolution trajectory to classify hidden contextual drifts that response\-only filters cannot detect\.

Table 1:Two types of unsafe interactions with the LLM\.
### 2\.2Contribution

In this work, we extend the Koopman\-based binary classification proposed in\[[47](https://arxiv.org/html/2608.19579#bib.bib37)\]to account for the token dynamics of both the prompt and the LLM response\. We revisit the classification method based the differential score and combine the DMD\-based prediction errors induced by the two DS of the prompt and the response\. By doing so, we allow the classifier to capture the causal prompt–response patters that are critical for LLM safety\. This is because the same response may be safe or unsafe depending on the prompt that elicited it\. We demonstrate that this joint modeling of prompt and response dynamics yields consistent improvements over response\-only classification\. Our empirical evaluation across three safety benchmarks using three embedding models of varying scale \(Qwen3\-Embedat 0\.6B parameters,Mistralat 7\.2B, andLlama\-3at 8\.0B\) establishes the effectiveness of ourprompt\-awareDS\-based classifier\. It also reveals a nuanced relationship between embedding model and the nature of the safety violation being detected, which provides insights into when different embedding models excel\.

![Refer to caption](https://arxiv.org/html/2608.19579v1/safety-fit.png)\(\(a\)\)Phase 1: Dynamical system fitting
![Refer to caption](https://arxiv.org/html/2608.19579v1/safety-classify.png)\(\(b\)\)Phase 2: Safety detection

Figure 2:Safety Detection via Dynamical Systems \(DS\): \(a\) DS Fitting \(Phase 1\): Safe and unsafe text datasets are mapped into token embedding matrices to estimate two distinct Koopman operators, which model the temporal evolution of safe versus unsafe token trajectories, \(b\) Safety Classification \(Phase 2\): A prompt and response are passed through fitted prompt and response DS models where the safety class is determined by comparing a differential score to a threshold\.

## 3Dynamic Mode Decomposition for Safety Classification

### 3\.1Overview

We treat the token\-by\-token generation process of an LLM as as a discrete\-time dynamical system whose observable trajectories evolve differently depending on the nature of the generated response and the prompt\. In the DS fitting stage depicted in Fig\.[2\(a\)](https://arxiv.org/html/2608.19579#S2.F2.sf1), four Koopman operators were obtained for safe and unsafe responses and prompts\. A differential residual score is then computed during the inference stage shown in Fig\.[2\(b\)](https://arxiv.org/html/2608.19579#S2.F2.sf2)to determine the safety of the LLM response\. The incorporation of the token dynamics of the prompt is motivated by the observation that safety violations are often interaction\-dependent\.

### 3\.2Prompt\-aware LLM Response Classification via Differential Residual Score

The dynamics of token embeddings can formally be studied using Koopman operator theory\[[33](https://arxiv.org/html/2608.19579#bib.bib46)\],\[[11](https://arxiv.org/html/2608.19579#bib.bib47)\]\. For a given LLM response, let𝐪k\\mathbf\{q\}\_\{k\}be thekthk^\{\\rm th\}token and let𝐲k=G2​\(𝐪k\)∈ℝM\\mathbf\{y\}\_\{k\}=G\_\{2\}\(\\mathbf\{q\}\_\{k\}\)\\in\\mathbb\{R\}^\{M\}be the associated token embedding, whereG2G\_\{2\}maps the token to an embedding \(e\.g\., viaQwen,Mistral, etc\.\)\. The Koopman operatorK:ℝM→ℝMK:\\mathbb\{R\}^\{M\}\\rightarrow\\mathbb\{R\}^\{M\}captures the dynamics of observables according to the relationyk\+1=K⁡\(yk\)y\_\{k\+1\}=K\(y\_\{k\}\)\. The Koopman operator is linear but possibly infinite dimensional\[[33](https://arxiv.org/html/2608.19579#bib.bib46)\]\[[11](https://arxiv.org/html/2608.19579#bib.bib47)\]\. Dynamic mode decomposition can be used to obtain a data\-driven, finite\-dimensional approximation of the Koopman operator\[[29](https://arxiv.org/html/2608.19579#bib.bib51)\],\[[41](https://arxiv.org/html/2608.19579#bib.bib48)\],\[[38](https://arxiv.org/html/2608.19579#bib.bib50)\],\[[45](https://arxiv.org/html/2608.19579#bib.bib49)\]\. Following the extended DMD approach\[[45](https://arxiv.org/html/2608.19579#bib.bib49)\], we first lift the token embeddings to a higher dimensional space𝐳k=\[𝐲k⊤flift⊤​\(𝐲k\)\]⊤\\mathbf\{z\}\_\{k\}=\\begin\{bmatrix\}\\mathbf\{y\}\_\{k\}^\{\\top\}&f\_\{\\rm lift\}^\{\\top\}\(\\mathbf\{y\}\_\{k\}\)\\end\{bmatrix\}^\{\\top\}\. Here,𝐳k∈ℝM\+γ\\mathbf\{z\}\_\{k\}\\in\\mathbb\{R\}^\{M\+\\gamma\}is the lifted token embedding withflift∈ℝγf\_\{\\rm lift\}\\in\\mathbb\{R\}^\{\\gamma\}and⊤denoting the vector transpose\. A set of snapshot pairssk=\(𝐳k,𝐳k\+1\)s\_\{k\}=\(\\mathbf\{z\}\_\{k\},\\mathbf\{z\}\_\{k\+1\}\)is collected and least squares fitting is used to obtain a Koopman operator estimate \(KOE\) which approximates the action of the Koopman operator on the lifted observables𝐳k\+1=𝐀𝐳k\\mathbf\{z\}\_\{k\+1\}=\\mathbf\{A\}\\mathbf\{z\}\_\{k\}\. A prediction for the evolution of the token embeddings can be obtained according to𝐲~k\+1=\[𝑰𝟎\]​𝑨​𝒛k\\tilde\{\\mathbf\{y\}\}\_\{k\+1\}=\\begin\{bmatrix\}\\bm\{I\}&\\bm\{0\}\\end\{bmatrix\}\\bm\{A\}\\bm\{z\}\_\{k\}where𝑰∈ℝM×M\\bm\{I\}\\in\\mathbb\{R\}^\{M\\times M\}denotes the identity matrix,𝟎∈ℝM×γ\\bm\{0\}\\in\\mathbb\{R\}^\{M\\times\\gamma\}is a matrix of zeros\. More details about the implementation of this Koopman\-based approach are provided in Appendix[Appendix A: Koopman Operator Theory and Dynamic Mode Decomposition for Inferring Dynamics from Token Embeddings](https://arxiv.org/html/2608.19579#S1.SSx1)\.

Prior work\[[47](https://arxiv.org/html/2608.19579#bib.bib37)\]found that the dynamics of token embeddings can be used as a diagnostic tool for classification of unwanted LLM behaviors\. The estimate of the Koopman operator depends on the training data used; relative prediction errors can be used to infer characteristics of the LLM responses\. With this in mind, using extended DMD, we obtain two different KOEs for LLM responses:𝑨s\(r\)\\bm\{A\}\_\{s\}^\{\(r\)\},𝑨u\(r\)\\bm\{A\}\_\{u\}^\{\(r\)\}, obtained from safe and unsafe LLM responses, respectively\. We use the same approach to obtain KOEs for safe and unsafe prompts,𝑨s\(p\)\\bm\{A\}\_\{s\}^\{\(p\)\}and𝑨u\(p\)\\bm\{A\}\_\{u\}^\{\(p\)\}, respectively\. For classification, for both the prompt and response, we consider the error associated with their prediction of the evolution of their token embeddings from𝒚k\\bm\{y\}\_\{k\}to𝒚k\+1\\bm\{y\}\_\{k\+1\}according to

ϵs,k\(p\)\\displaystyle\\bm\{\\epsilon\}\_\{s,k\}^\{\(p\)\}≡‖𝒚k\+1−\[𝑰𝟎\]​𝑨s\(p\)​𝒛k‖,\\displaystyle\\equiv\|\|\\bm\{y\}\_\{k\+1\}\-\\begin\{bmatrix\}\\bm\{I\}&\\bm\{0\}\\end\{bmatrix\}\\bm\{A\}\_\{s\}^\{\(p\)\}\\bm\{z\}\_\{k\}\|\|,\(1a\)ϵu,k\(p\)\\displaystyle\\bm\{\\epsilon\}\_\{u,k\}^\{\(p\)\}≡‖𝒚k\+1−\[𝑰𝟎\]​𝑨u\(p\)​𝒛k‖,\\displaystyle\\equiv\|\|\\bm\{y\}\_\{k\+1\}\-\\begin\{bmatrix\}\\bm\{I\}&\\bm\{0\}\\end\{bmatrix\}\\bm\{A\}\_\{u\}^\{\(p\)\}\\bm\{z\}\_\{k\}\|\|,\(1b\)ϵs,k\(r\)\\displaystyle\\bm\{\\epsilon\}\_\{s,k\}^\{\(r\)\}≡‖𝒚k\+1−\[𝑰𝟎\]​𝑨s\(r\)​𝒛k‖,\\displaystyle\\equiv\|\|\\bm\{y\}\_\{k\+1\}\-\\begin\{bmatrix\}\\bm\{I\}&\\bm\{0\}\\end\{bmatrix\}\\bm\{A\}\_\{s\}^\{\(r\)\}\\bm\{z\}\_\{k\}\|\|,\(1c\)ϵu,k\(r\)\\displaystyle\\bm\{\\epsilon\}\_\{u,k\}^\{\(r\)\}≡‖𝒚k\+1−\[𝑰𝟎\]​𝑨u\(r\)​𝒛k‖\\displaystyle\\equiv\|\|\\bm\{y\}\_\{k\+1\}\-\\begin\{bmatrix\}\\bm\{I\}&\\bm\{0\}\\end\{bmatrix\}\\bm\{A\}\_\{u\}^\{\(r\)\}\\bm\{z\}\_\{k\}\|\|\(1d\)and\|\|⋅\|\|\|\|\\cdot\|\|denotes the 2\-norm\. The prediction errors can subsequently be compared to determine which prompt KOEs \(𝑨s\(p\)\\bm\{A\}\_\{s\}^\{\(p\)\}or𝑨u\(p\)\\bm\{A\}\_\{u\}^\{\(p\)\}\) and response KOEs \(𝑨s\(r\)\\bm\{A\}\_\{s\}^\{\(r\)\}𝑨u\(r\)\\bm\{A\}\_\{u\}^\{\(r\)\}\) provide a better estimate for the next token embedding\. For a prompt withPPtokens and a response withLLtokens as, we define the prompt\-aware residual score as

Δ​ℰ=\(∑j=1L−1\(ϵu,j\(r\)\)2\+∑j=1P−1\(ϵu,j\(p\)\)2\)1/2−\(∑j=1L−1\(ϵs,j\(r\)\)2\+∑j=1P−1\(ϵs,j\(p\)\)2\)1/2,\\Delta\\mathcal\{E\}=\\Bigg\(\\sum\_\{j=1\}^\{L\-1\}\\Big\(\\bm\{\\epsilon\}\_\{u,j\}^\{\(r\)\}\\Big\)^\{2\}\+\\sum\_\{j=1\}^\{\{P\}\-1\}\\Big\(\\bm\{\\epsilon\}\_\{u,j\}^\{\(p\)\}\\Big\)^\{2\}\\Bigg\)^\{1/2\}\-\\Bigg\(\\sum\_\{j=1\}^\{L\-1\}\\Big\(\\bm\{\\epsilon\}\_\{s,j\}^\{\(r\)\}\\Big\)^\{2\}\+\\sum\_\{j=1\}^\{\{P\}\-1\}\\Big\(\\bm\{\\epsilon\}\_\{s,j\}^\{\(p\)\}\\Big\)^\{2\}\\Bigg\)^\{1/2\},\(2\)Intuitively, when the output of an LLM is \(resp\., is not\) safe,𝑨u\(r\)\\bm\{A\}\_\{u\}^\{\(r\)\}and𝑨u\(p\)\\bm\{A\}\_\{u\}^\{\(p\)\}\(resp\.,𝑨s\(r\)\\bm\{A\}\_\{s\}^\{\(r\)\}and𝑨s\(p\)\\bm\{A\}\_\{s\}^\{\(p\)\}\)should yield a better prediction biasingΔ​ℰ\\Delta\\mathcal\{E\}towards negative \(resp\., positive\) values\. To yield a binary classificationD^∈\{0,1\}\\widehat\{D\}\\in\\\{0,1\\\}, where11denotes an unsafe response and00denotes a safe response, we apply a decision thresholdη\\eta:

D^=\{1,if​Δ​ℰ<η,0,if​Δ​ℰ≥η\.\\widehat\{D\}=\\begin\{cases\}1,&\\text\{if \}\\Delta\\mathcal\{E\}<\\eta,\\\\ 0,&\\text\{if \}\\Delta\\mathcal\{E\}\\geq\\eta\.\\end\{cases\}\(3\)The thresholdη\\etaserves as a hyperparameter to tune the balance between precision and recall, allowing for the optimization of theF1F\_\{1\}score across various LLM architectures\. The length of the response in \([2](https://arxiv.org/html/2608.19579#S3.E2)\) can be adjusted as desired to classify individual sentences produced by the LLM or entire passages in response to a user prompt\.

## 4Results and Discussions

We present our simulation results in three parts, covering the datasets used, the embedding models evaluated, and the experimental outcomes\.

### 4\.1Datasets

To evaluate the performance of our DS approach on safety classification of LLM responses, we benchmark on the following three diverse datasets\.

##### Aegis AI Content Safety Dataset 2\.0\[[18](https://arxiv.org/html/2608.19579#bib.bib7)\]\.

This dataset is designed to support the development of robust content safety guardrails for LLMs\. It comprises annotated human–LLM interactions drawn from diverse sources including Anthropic HH\-RLHF, Do\-Anything\-Now \(DAN\) jailbreak prompts, and AI\-assisted red\-teaming datasets, with responses generated by Mistral\-7B\-v0\.1\. The dataset adheres to a comprehensive safety taxonomy of 12 categories \(e\.g\., hate/identity hate, sexual, Violence, self\-harm, criminal planning\)\. Safety labels are produced through a hybrid pipeline combining human annotations at the dialogue level with a multi\-LLM jury system for response\-level labels\. In the original dataset paper\[[18](https://arxiv.org/html/2608.19579#bib.bib7)\], a Llama\-3\.1 Guard model was trained via parameter\-efficient fine\-tuning to achieve harmfulnessF1F\_\{1\}scores of80\.8%80\.8\\%\.

##### Synthetic CoT Safety Benchmark\[[2](https://arxiv.org/html/2608.19579#bib.bib33)\]\.

This dataset is designed to train and evaluate LLMs on their ability to refuse harmful requests through reasoned deliberation\. Each prompt/response pair has a potentially harmful user prompt with a structured model output that follows a Chain\-of\-Thought \(CoT\) with safety pattern: first a step\-by\-step safety reasoning trace that evaluates the harm potential of the request, followed by a clear refusal\.

##### BeaverTails Dataset\[[22](https://arxiv.org/html/2608.19579#bib.bib32)\]\.

This dataset is developed to support safety alignment research\. It contains human prompts and LLM responses\. Each sample belongs to one of 14 harm categories \(including animal abuse, child abuse, discrimination, drug abuse, hate speech, privacy violation, self\-harm, terrorism, and violence\), together with an overall binary safety label\. A key feature of this dataset is that its prompts are human\-written with responses generated by Alpaca\-7B\. This means that the prompts reflect the adversarial human intent rather than synthetic generation\. This makes it particularly suitable for investigating whether our DS\-based classification method can detect distinct embedding dynamics between human\-written safe and unsafe prompts\. A question\-answering moderation model was trained in\[[22](https://arxiv.org/html/2608.19579#bib.bib32)\]then benchmarked to achieve aF1F\_\{1\}score up to87\.3%87\.3\\%on LLM response classification\.

### 4\.2Embedding Models

We test our DS method using three top\-performing embedding models from the HuggingFace leaderboard of the[Massive Text Embedding Benchmark](https://huggingface.co/spaces/mteb/leaderboard)\(MTEB\) as described in Table[2](https://arxiv.org/html/2608.19579#S4.T2)\. Working within limited computing resources, we selected models of varying sizes, from the lightweight0\.60\.6B\-parameterQwen3\-Embedto the larger88B\-parameterLlama\-3, thereby balancing performance with practical hardware constraints\.

Table 2:Benchmarked embedding models for DS safety detection\.
### 4\.3Simulation Results

We now present the classification results across all three datasets described in Section\.[4\.1](https://arxiv.org/html/2608.19579#S4.SS1)\. For each dataset, we report ROC curves for the three embedding models, followed by performance tables that compare response\-only classification with joint prompt–response classification across varying sequence lengthsL∈\{1,50,100,150\}L\\in\\\{1,50,100,150\\\}\.

#### 4\.3\.1Aegis Dataset

Figure[3](https://arxiv.org/html/2608.19579#S4.F3)shows the ROC curves for the three embedding models on theAegisdataset\. All three models achieve clear separation from the diagonal, withLlama\-3andQwen\-Embedexhibiting the strongest discriminative power\.

![Refer to caption](https://arxiv.org/html/2608.19579v1/Aegis_qwen_ROC_10000_10000_22000.png)\(\(a\)\)Qwen\-Embed
![Refer to caption](https://arxiv.org/html/2608.19579v1/Aegis_mistral_ROC_10000_10000_22000.png)\(\(b\)\)Mistral
![Refer to caption](https://arxiv.org/html/2608.19579v1/Aegis_llama3_ROC_10000_10000_22000.png)\(\(c\)\)Llama\-3

Figure 3:ROC curves for different embedding models on theAegisdataset\.Tables[3](https://arxiv.org/html/2608.19579#S4.T3)and[4](https://arxiv.org/html/2608.19579#S4.T4)report classification performance on 12K test samples using response embeddings only and using separate DMDs for prompts and responses, respectively\. With response embeddings alone \(Table[3](https://arxiv.org/html/2608.19579#S4.T3)\),Qwen\-EmbedandLlama\-3achieve comparableF1F\_\{1\}scores around7272–73%73\\%, whileMistraltrails at approximately6767–68%68\\%\. The addition of prompt embeddings \(Table[4](https://arxiv.org/html/2608.19579#S4.T4)\) reveals a significant shift:Llama\-3emerges as the dominant model, achievingF1=77\.0%F\_\{1\}=77\.0\\%and accuracy of80\.2%80\.2\\%atL≥150L\\geq 150, surpassingQwen\-Embed\(F1=76\.5%F\_\{1\}=76\.5\\%\) and substantially outperformingMistral\(F1=68\.8%F\_\{1\}=68\.8\\%\)\. This improvement is consistent across all sequence length thresholds, withLlama\-3gaining1\.71\.7percentage points inF1F\_\{1\}atL≥1L\\geq 1when prompt dynamics is incorporated, compared to1\.01\.0points lost forQwen\-Embed\. These results are notable when compared to the baselines established in the Aegis 2\.0 study: while the AegisGuard model\[[18](https://arxiv.org/html/2608.19579#bib.bib7)\]achievesF1=86\.8%F\_\{1\}=86\.8\\%on the Aegis test split through dedicated parameter\-efficient fine\-tuning on the training data, our DS method achievesF1=77\.0%F\_\{1\}=77\.0\\%\( and accuracy80\.5%80\.5\\%\) as a completely*black\-box*method that requires no task\-specific training, i\.e\., by only the fitting of dynamical systems on a small set of embedding trajectories\.

Table 3:Classification performance on 12K test samples of theAegisdataset over the number of tokensLLwithresponses’ embeddings only\. The value of each cell denotesF1F\_\{1\}score/recall/accuracy\.Table 4:Classification performance on 12K test samples of theAegisdataset over the number of tokensLLwithseparate DMDs for prompts and responses’ embeddings\. The value of each cell denotesF1F\_\{1\}score/recall/accuracy\.The dominance ofLlama\-3with prompt incorporation on Aegis can be explained as follows: theAegisdataset is*interaction\-dependent*, meaning that safety violations arise from the interplay between user intent and model compliance\.Llama\-3’s causal decoder architecture \(through causal masking\) captures the temporal dynamics of the prompt–response interaction more effectively, so that adding prompt embeddings significantly lowers the tracking error for safe samples while increasing the prediction error for unsafe samples\.

#### 4\.3\.2Synthetic CoT Safety Dataset

Figure[4](https://arxiv.org/html/2608.19579#S4.F4)shows the ROC curves for theSynthetic CoT Safetydataset\. The overall discriminative power is high across all models atL≥1L\\geq 1, while performance degrades more rapidly with increasing sequence length thresholds compared to the Aegis dataset\. This reflects the smaller sample size at longer sequences\.

![Refer to caption](https://arxiv.org/html/2608.19579v1/cot_qwen_1000_1000_1710.png)\(\(a\)\)Qwen\-Embed
![Refer to caption](https://arxiv.org/html/2608.19579v1/cot_mistral_1000_1000_1710.png)\(\(b\)\)Mistral
![Refer to caption](https://arxiv.org/html/2608.19579v1/cot_llama3_1000_1000_1710.png)\(\(c\)\)Llama\-3

Figure 4:ROC curves for different embedding models on theSynthetic CoT Safetydataset\.Tables[5](https://arxiv.org/html/2608.19579#S4.T5)and[6](https://arxiv.org/html/2608.19579#S4.T6)report performance on 710 test samples\. With response embeddings only,Llama\-3leads atL≥1L\\geq 1withF1=83\.0%F\_\{1\}=83\.0\\%and accuracy89\.6%89\.6\\%, followed closely byQwen\-Embed\(F1=81\.8%F\_\{1\}=81\.8\\%\)\. Adding prompt embeddings provides a consistent but modest boost:Llama\-3reachesF1=83\.7%F\_\{1\}=83\.7\\%and accuracy89\.7%89\.7\\%, whileQwen\-Embedimproves toF1=83\.2%F\_\{1\}=83\.2\\%\. The performance drop at higherLLthresholds \(L≥100L\\geq 100andL≥150L\\geq 150\) is attributable to the small number of test samples remaining at those lengths, which introduces high variance into the estimates\. Notably, the high accuracy across all settings \(consistently above88%88\\%\) reflect the fact that this dataset has a pronounced class imbalance favoring safe samples, making accuracy alone a less informative metric than theF1F\_\{1\}metric\.

Table 5:Classification performance on 710 test samples of theSynthetic CoT Safetydataset over the number of tokensLLwithresponses’ embeddings only\. The value of each cell denotesF1F\_\{1\}score/recall/accuracy\.Table 6:Classification performance on 710 test samples of theSynthetic CoT Safetydataset over the number of tokensLLwithseparate DMDs for prompts and responses’ embeddings\. The value of each cell denotesF1F\_\{1\}score/recall/accuracy\.
#### 4\.3\.3BeaverTails Dataset

Figure[5](https://arxiv.org/html/2608.19579#S4.F5)shows the ROC curves for theBeaverTailsdataset\. All three models achieve strong separation, with the curves shifting notably toward the upper\-left corner as the sequence length increases\. This is consistent with the hypothesis that longer token trajectories provide richer dynamical signatures for classification\.

![Refer to caption](https://arxiv.org/html/2608.19579v1/beaverTails_qwen_10000_10000_22000.png)\(\(a\)\)Qwen\-Embed
![Refer to caption](https://arxiv.org/html/2608.19579v1/beaverTails_mistral_10000_10000_22000.png)\(\(b\)\)Mistral
![Refer to caption](https://arxiv.org/html/2608.19579v1/beaverTails_llama3_10000_10000_22000.png)\(\(c\)\)Llama\-3

Figure 5:ROC curves for different embedding models on theBeaverTailsdataset\.Tables[7](https://arxiv.org/html/2608.19579#S4.T7),[8](https://arxiv.org/html/2608.19579#S4.T8), and[9](https://arxiv.org/html/2608.19579#S4.T9)report performance on 12K test samples using response embeddings only, joint prompt–response embeddings, and prompt embeddings only, respectively\. With response embeddings only \(Table[7](https://arxiv.org/html/2608.19579#S4.T7)\),Qwen\-Embedis the strongest model, achievingF1=84\.8%F\_\{1\}=84\.8\\%atL≥100L\\geq 100, whileMistralovertakes it atL≥150L\\geq 150\(F1=85\.6%F\_\{1\}=85\.6\\%\)\. Adding prompt embeddings \(Table[8](https://arxiv.org/html/2608.19579#S4.T8)\) provides consistent gains across all models, withQwen\-EmbedreachingF1=86\.7%F\_\{1\}=86\.7\\%atL≥150L\\geq 150—the highestF1F\_\{1\}score observed across all datasets and configurations in this study\.

Table 7:Classification performance on 12K test samples of theBeaverTailsdataset over the number of tokensLLwithresponses’ embeddings only\. The value of each cell denotesF1F\_\{1\}score/recall/accuracy\.Table 8:Classification performance on 12K test samples of theBeaverTailsdataset over the number of tokensLLwithseparate DMDs for prompts and responses’ embeddings\. The value of each cell denotesF1F\_\{1\}score/recall/accuracy\.A distinctive feature of theBeaverTailsdataset is that its prompts are human\-authored, enabling us to investigate whether the embedding dynamics of human\-written prompts carry independent safety information\. Table[9](https://arxiv.org/html/2608.19579#S4.T9)reports performance using*prompt embeddings only*\. Even without any response information, prompt\-only classification achievesF1=83\.4%F\_\{1\}=83\.4\\%atL≥150L\\geq 150withQwen\-Embed, demonstrating that human\-authored safe and unsafe prompts do indeed yield dynamically distinguishable regions of the embedding space\. This finding suggests that the embedding dynamics of human language carry substantial safety\-relevant information that can be exploited by our DS method\.

Table 9:Classification performance on 12K test samples of theBeaverTailsdataset over the number of tokensLLwithseparate DMDs for prompts’ embeddings only\. The value of each cell denotesF1F\_\{1\}score/recall/accuracy\.When comparing the model rankings across theAegisandBeaverTailsdatasets, adding prompt embeddings withAegiscausesLlama\-3to overtakeQwen\-Embedas the best\-performing model \(Table[4](https://arxiv.org/html/2608.19579#S4.T4)\), whereas onBeaverTails,Qwen\-Embedretains its advantage even after prompt embedding incorporation \(Table[8](https://arxiv.org/html/2608.19579#S4.T8)\)\. This difference can be understood through the distinct nature of safety violations in each dataset\. On Aegis, violations areinteraction\-dependent: the same prompt may be benign \(e\.g\., an authorized security audit request\) but the response can be unsafe if it provides actual exploit code rather than a refusal\.Llama\-3’s causal decoder architecture captures this causal prompt–response interaction effectively, so that incorporating prompt dynamics significantly improves its tracking accuracy for safe samples\. On theBeaverTailsdataset, violations are present at the LLM responses only: the unsafe response \(e\.g\., graphic violence, hate speech, explicit drug instructions\) is directly encoded in the embedding tokens, regardless of the prompt’s phrasing\. In this case,Qwen\-Embed’s semantic representations excel at mapping these safety\-violating features into distinguishable embedding trajectories, and adding prompt embeddings provides only marginal additional information\. It is worth noting that When classifying safety using prompt dynamics alone, the achieved classification performance is lower compared to tracking the LLM’s response dynamics\. This suggests that human\-written inputs reveal significantly less to the Koopman operators about whether the subsequent response is safe or not\.

## 5Conclusion

In this paper, we generalized a dynamical system method for LLM output classification to enforce LLM safety\. By fitting separate Koopman operators for safe and unsafe embedding trajectories and classifying new LLM outputs through a differential residual score, our method achieves strong performance across three diverse safety benchmarks without requiring access to LLMs’ internal variables, task\-specific fine\-tuning, or multiple stochastic samples\. The use of separate Koopman operators to track the token dynamics of the prompt and response led to consistent improvements compared to the case with response dynamics only, with large gains obtained on datasets where safety violations are interaction\-dependent\.

Our results reveal a nuanced relationship between embedding model architecture and the nature of safety violations\. Causal decoders likeLlama\-3excel when safety depends on the causal interaction between prompt and response, while compact semantic encoders likeQwen\-Embedare better suited for detecting content\-isolated violations where the unsafety is directly encoded in the response tokens\. This finding has practical implications for deploying DS\-based safety monitors: the choice of embedding model should be informed by the expected distribution of safety violations in the target application\.

Several directions for future work emerge from this study\. Extending the binary safe/unsafe classification to multi\-class prediction over specific harm categories \(e\.g\., violence, hate speech, self\-harm\) would increase the practical utility of the method for content moderation systems that require actionable category labels\. Moreover, exploring ensemble strategies that combine the complementary strengths of different embedding models may yield classifiers that are robust across diverse safety violation types\. Finally, a deeper theoretical investigation into the manifold structure of safe and unsafe embedding trajectories could provide formal guarantees on the separability conditions under which DS\-based classification is expected to succeed\.

## Acknowledgment

This material is based upon the work supported by the National Science Foundation \(NSF\) under Grant No\. CMMI\-2024111\. This material is also based upon work co\-supported by the U\.S\. Department of Energy, Office of Science, Office of Advanced Scientific Computing Research under Contract No\. DE\-AC05\-00OR22725\. This manuscript has been co\-authored by UT\-Battelle, LLC under Contract No\. DE\-AC05\-00OR22725 with the U\.S\. Department of Energy\. The United States Government retains and the publisher, by accepting the article for publication, acknowledges that the United States Government retains a non\-exclusive, paid\-up, irrevocable, world\-wide license to publish or reproduce the published form of this manuscript, or allow others to do so, for United States Government purposes\. The Department of Energy will provide public access to these results of federally sponsored research in accordance with the DOE Public Access Plan\.

## References

- \[1\]J\. Achiam, S\. Adler, S\. Agarwal, L\. Ahmad, I\. Akkaya, F\. L\. Aleman, D\. Almeida, J\. Altenschmidt, S\. Altman, S\. Anadkat,et al\.\(2023\)GPT\-4 technical report\.arXiv preprint arXiv:2303\.08774\.Cited by:[§1](https://arxiv.org/html/2608.19579#S1.p1.1)\.
- \[2\]\(2024\)Synthetic CoT safety dataset\.Note:[https://huggingface\.co/datasets/ai2\-adapt\-dev/synthetic\-cot\-safety](https://huggingface.co/datasets/ai2-adapt-dev/synthetic-cot-safety)Accessed: 2025Cited by:[§4\.1](https://arxiv.org/html/2608.19579#S4.SS1.SSS0.Px2)\.
- \[3\]M\. Akrout and D\. Wilson\(2026\)Guarantees on dynamical system distinguishability for llm token generation\.arXiv preprint arXiv:2607\.28667\.Cited by:[§2\.1](https://arxiv.org/html/2608.19579#S2.SS1.p2.1)\.
- \[4\]A\. Azaria and T\. Mitchell\(2023\)The internal state of an LLM knows when it’s lying\.InFindings of the Association for Computational Linguistics: EMNLP 2023,pp\. 967–976\.Cited by:[§2\.1](https://arxiv.org/html/2608.19579#S2.SS1.p1.1)\.
- \[5\]Y\. Bai, S\. Kadavath, S\. Kundu, A\. Askell, J\. Kernion, A\. Jones, A\. Chen, A\. Goldie, A\. Mirhoseini, C\. McKinnon,et al\.\(2022\)Constitutional AI: harmlessness from AI feedback\.arXiv preprint arXiv:2212\.08073\.Cited by:[§1](https://arxiv.org/html/2608.19579#S1.p2.1)\.
- \[6\]G\. Bar\-Shalom, F\. Frasca, D\. Lim, Y\. Gelberg, Y\. Ziser, R\. El\-Yaniv, G\. Chechik, and H\. Maron\(2025\)Learning on LLM output signatures for gray\-box behavior analysis\.InICML 2025 Workshop on Reliable and Responsible Foundation Models,Cited by:[§2\.1](https://arxiv.org/html/2608.19579#S2.SS1.p1.1)\.
- \[7\]E\. M\. Bender, T\. Gebru, A\. McMillan\-Major, and S\. Shmitchell\(2021\)On the dangers of stochastic parrots: can language models be too big?\.InProceedings of the 2021 ACM Conference on Fairness, Accountability, and Transparency,pp\. 610–623\.Cited by:[§1](https://arxiv.org/html/2608.19579#S1.p1.1)\.
- \[8\]T\. Brown, B\. Mann, N\. Ryder, M\. Subbiah, J\. D\. Kaplan, P\. Dhariwal, A\. Neelakantan, P\. Shyam, G\. Sastry, A\. Askell,et al\.\(2020\)Language models are few\-shot learners\.Advances in Neural Information Processing Systems33,pp\. 1877–1901\.Cited by:[§1](https://arxiv.org/html/2608.19579#S1.p1.1)\.
- \[9\]B\. W\. Brunton, L\. A\. Johnson, J\. G\. Ojemann, and J\. N\. Kutz\(2016\)Extracting spatial\-temporal patterns and transitions in high\-dimensional biological data with dynamic mode decomposition\.Journal of Neuroscience Methods258,pp\. 1–15\.Cited by:[§1](https://arxiv.org/html/2608.19579#S1.p3.1)\.
- \[10\]S\. L\. Brunton and J\. N\. Kutz\(2019\)Data\-driven science and engineering: machine learning, dynamical systems, and control\.Cambridge University Press\.Cited by:[§1](https://arxiv.org/html/2608.19579#S1.p3.1)\.
- \[11\]M\. Budišić, R\. Mohr, and I\. Mezić\(2012\)Applied Koopmanism\.Chaos: An Interdisciplinary Journal of Nonlinear Science22\(4\),pp\. 047510\.Cited by:[Appendix A: Koopman Operator Theory and Dynamic Mode Decomposition for Inferring Dynamics from Token Embeddings](https://arxiv.org/html/2608.19579#S1.SSx1.p1.2),[Appendix A: Koopman Operator Theory and Dynamic Mode Decomposition for Inferring Dynamics from Token Embeddings](https://arxiv.org/html/2608.19579#S1.SSx1.p1.3),[§3\.2](https://arxiv.org/html/2608.19579#S3.SS2.p1.1)\.
- \[12\]C\. Chen, K\. Liu, Z\. Chen, Y\. Gu, Y\. Wu, M\. Tao, Z\. Fu, and J\. Ye\(2024\)INSIDE: LLMs’ internal states retain the power of hallucination detection\.arXiv preprint arXiv:2402\.03744\.Cited by:[§2\.1](https://arxiv.org/html/2608.19579#S2.SS1.p1.1)\.
- \[13\]Y\. Dong, R\. Mu, Y\. Zhang, S\. Sun, T\. Zhang, C\. Wu, G\. Jin, Y\. Qi, J\. Hu, J\. Meng, S\. Bensalem, and X\. Huang\(2025\)Safeguarding large language models: a survey\.Artificial Intelligence Review58,pp\. 382\.Cited by:[§1](https://arxiv.org/html/2608.19579#S1.p1.1)\.
- \[14\]S\. Farquhar, J\. Kossen, L\. Kuhn, and Y\. Gal\(2024\)Detecting hallucinations in large language models using semantic entropy\.Nature630\(8017\),pp\. 625–630\.Cited by:[§2\.1](https://arxiv.org/html/2608.19579#S2.SS1.p1.1)\.
- \[15\]G\. Froyland, G\. A\. Gottwald, and A\. Hammerlindl\(2021\)Dynamic mode decomposition and transfer operator approaches for forecasting the enso cycle\.Journal of Climate34\(1\),pp\. 163–181\.Cited by:[§1](https://arxiv.org/html/2608.19579#S1.p3.1)\.
- \[16\]I\. O\. Gallegos, R\. A\. Rossi, J\. Barrow, M\. M\. Tanjim, S\. Kim, F\. Dernoncourt, T\. Yu, R\. Zhang, and N\. K\. Ahmed\(2024\)Bias and fairness in large language models: a survey\.Computational Linguistics50\(3\),pp\. 1097–1179\.Cited by:[§1](https://arxiv.org/html/2608.19579#S1.p1.1)\.
- \[17\]S\. Gehman, S\. Gururangan, M\. Sap, Y\. Choi, and N\. A\. Smith\(2020\)RealToxicityPrompts: evaluating neural toxic degeneration in language models\.InFindings of the Association for Computational Linguistics: EMNLP 2020,pp\. 3356–3369\.Cited by:[§2\.1](https://arxiv.org/html/2608.19579#S2.SS1.p1.1)\.
- \[18\]S\. Ghosh, P\. Shu, C\. Sathe, S\. Pahari, G\. Saroha, and Z\. Wang\(2025\)Aegis AI Content Safety Dataset 2\.0\.arXiv preprint arXiv:2505\.03789\.Cited by:[§1](https://arxiv.org/html/2608.19579#S1.p1.1),[§4\.1](https://arxiv.org/html/2608.19579#S4.SS1.SSS0.Px1),[§4\.1](https://arxiv.org/html/2608.19579#S4.SS1.SSS0.Px1.p1.1),[§4\.3\.1](https://arxiv.org/html/2608.19579#S4.SS3.SSS1.p2.1)\.
- \[19\]A\. Goel, D\. Schwartz, and Y\. Qi\(2025\)Zero\-knowledge LLM hallucination detection and mitigation through fine\-grained cross\-model consistency\.InProceedings of the 2025 Conference on Empirical Methods in Natural Language Processing: Industry Track,pp\. 1982–1999\.Cited by:[§2\.1](https://arxiv.org/html/2608.19579#S2.SS1.p1.1)\.
- \[20\]A\. Grattafiori, A\. Dubey, A\. Jauhri, A\. Pandey, A\. Kadian, A\. Al\-Dahle, A\. Letman, A\. Mathur, A\. Schelten, A\. Vaughan,et al\.\(2024\)The Llama 3 herd of models\.arXiv preprint arXiv:2407\.21783\.Cited by:[Table 2](https://arxiv.org/html/2608.19579#S4.T2.2.4.1)\.
- \[21\]X\. Hu, Y\. Zhang, R\. Peng, H\. Zhang, C\. Wu, G\. Chen, and J\. Zhao\(2024\)Embedding and gradient say wrong: a white\-box method for hallucination detection\.InProceedings of the 2024 Conference on Empirical Methods in Natural Language Processing,pp\. 1950–1959\.Cited by:[§2\.1](https://arxiv.org/html/2608.19579#S2.SS1.p1.1)\.
- \[22\]J\. Ji, M\. Liu, J\. Dai, X\. Pan, C\. Zhang, C\. Bian, B\. Chen, R\. Sun, Y\. Wang, and Y\. Yang\(2023\)BeaverTails: towards improved safety alignment of LLM via a human\-preference dataset\.Advances in Neural Information Processing Systems36,pp\. 24668–24686\.Cited by:[§4\.1](https://arxiv.org/html/2608.19579#S4.SS1.SSS0.Px3),[§4\.1](https://arxiv.org/html/2608.19579#S4.SS1.SSS0.Px3.p1.1)\.
- \[23\]Z\. Ji, N\. Lee, R\. Frieske, T\. Yu, D\. Su, Y\. Xu, E\. Ishii, Y\. Bang, A\. Madotto, and P\. Fung\(2023\)A survey of hallucination in large language models: principles, taxonomy, challenges, and open questions\.arXiv preprint arXiv:2311\.05232\.Cited by:[§1](https://arxiv.org/html/2608.19579#S1.p1.1)\.
- \[24\]A\. Q\. Jiang, A\. Sablayrolles, A\. Mensch, C\. Bamford, D\. S\. Chaplot, D\. de las Casas, F\. Bressand, G\. Lengyel, G\. Lample, L\. Saulnier,et al\.\(2023\)Mistral 7B\.arXiv preprint arXiv:2310\.06825\.Cited by:[Table 2](https://arxiv.org/html/2608.19579#S4.T2.2.3.1)\.
- \[25\]A\. T\. Kalai and S\. S\. Vempala\(2024\)Calibrated language models must hallucinate\.InProceedings of the 56th Annual ACM Symposium on Theory of Computing,pp\. 160–171\.Cited by:[§1](https://arxiv.org/html/2608.19579#S1.p1.1)\.
- \[26\]L\. Kong, X\. Zhong, J\. Chen, H\. Fu, and Y\. Wang\(2025\)Multi\-perspective consistency checking for large language model hallucination detection: a black\-box zero\-resource approach\.Frontiers of Information Technology & Electronic Engineering26\(11\),pp\. 2298–2309\.Cited by:[§2\.1](https://arxiv.org/html/2608.19579#S2.SS1.p1.1)\.
- \[27\]L\. Kuhn, Y\. Gal, and S\. Farquhar\(2023\)Semantic uncertainty: linguistic invariances for uncertainty estimation in natural language generation\.InThe Eleventh International Conference on Learning Representations, ICLR 2023,Cited by:[§2\.1](https://arxiv.org/html/2608.19579#S2.SS1.p1.1)\.
- \[28\]J\. N\. Kutz, S\. L\. Brunton, B\. W\. Brunton, and J\. L\. Proctor\(2016\)Dynamic mode decomposition: data\-driven modeling of complex systems\.Society for Industrial and Applied Mathematics,Philadelphia, PA\.Cited by:[§1](https://arxiv.org/html/2608.19579#S1.p3.1)\.
- \[29\]J\. N\. Kutz, S\. L\. Brunton, B\. W\. Brunton, and J\. L\. Proctor\(2016\)Dynamic mode decomposition: data\-driven modeling of complex systems\.Society for Industrial and Applied Mathematics,Philadelphia, PA\.Cited by:[Appendix A: Koopman Operator Theory and Dynamic Mode Decomposition for Inferring Dynamics from Token Embeddings](https://arxiv.org/html/2608.19579#S1.SSx1.p2.1),[§3\.2](https://arxiv.org/html/2608.19579#S3.SS2.p1.1)\.
- \[30\]J\. Li, X\. Cheng, W\. X\. Zhao, J\. Nie, and J\. Wen\(2023\)HaluEval: a large\-scale hallucination evaluation benchmark for large language models\.InProceedings of the 2023 Conference on Empirical Methods in Natural Language Processing,pp\. 6449–6464\.Cited by:[§2\.1](https://arxiv.org/html/2608.19579#S2.SS1.p3.1)\.
- \[31\]M\. Li, Y\. Zhang, D\. Long, K\. Chen, S\. Song, S\. Bai, Z\. Yang, P\. Xie, A\. Yang, D\. Liu,et al\.\(2026\)Qwen3\-VL\-embedding and qwen3\-VL\-reranker: a unified framework for state\-of\-the\-art multimodal retrieval and ranking\.arXiv preprint arXiv:2601\.04720\.Cited by:[Table 2](https://arxiv.org/html/2608.19579#S4.T2.2.2.1)\.
- \[32\]P\. Manakul, A\. Liusie, and M\. Gales\(2023\)SelfCheckGPT: zero\-resource black\-box hallucination detection for generative large language models\.InProceedings of the 2023 Conference on Empirical Methods in Natural Language Processing,pp\. 9004–9017\.Cited by:[§2\.1](https://arxiv.org/html/2608.19579#S2.SS1.p1.1),[§2\.1](https://arxiv.org/html/2608.19579#S2.SS1.p3.1)\.
- \[33\]I\. Mezić\(2013\)Analysis of fluid flows via spectral properties of the Koopman operator\.Annual Review of Fluid Mechanics45,pp\. 357–378\.Cited by:[Appendix A: Koopman Operator Theory and Dynamic Mode Decomposition for Inferring Dynamics from Token Embeddings](https://arxiv.org/html/2608.19579#S1.SSx1.p1.2),[Appendix A: Koopman Operator Theory and Dynamic Mode Decomposition for Inferring Dynamics from Token Embeddings](https://arxiv.org/html/2608.19579#S1.SSx1.p1.3),[§3\.2](https://arxiv.org/html/2608.19579#S3.SS2.p1.1)\.
- \[34\]M\. M\. M\. Miah, A\. Anika, X\. Shi, and R\. Huang\(2025\)Hidden in plain sight: evaluation of the deception detection capabilities of LLMs in multimodal settings\.InProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),pp\. 31013–31034\.Cited by:[§1](https://arxiv.org/html/2608.19579#S1.p1.1)\.
- \[35\]L\. Ouyang, J\. Wu, X\. Jiang, D\. Almeida, C\. Wainwright, P\. Mishkin, C\. Zhang, S\. Agarwal, K\. Slama, A\. Ray,et al\.\(2022\)Training language models to follow instructions with human feedback\.Advances in Neural Information Processing Systems35,pp\. 27730–27744\.Cited by:[§1](https://arxiv.org/html/2608.19579#S1.p2.1)\.
- \[36\]P\. S\. Park, S\. Goldstein, A\. O’Gara, M\. Chen, and D\. Hendrycks\(2024\)AI deception: a survey of examples, risks, and potential solutions\.Patterns5\(1\),pp\. 100901\.Cited by:[§1](https://arxiv.org/html/2608.19579#S1.p1.1)\.
- \[37\]J\. Qian, Z\. Zhu, H\. Zhou, Z\. Feng, Z\. Zhai, and K\. Mao\(2025\)Beyond the next token: towards prompt\-robust zero\-shot classification via efficient multi\-token prediction\.InProceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies \(Volume 1: Long Papers\),pp\. 7093–7115\.Cited by:[§2\.1](https://arxiv.org/html/2608.19579#S2.SS1.p1.1)\.
- \[38\]C\. W\. Rowley, I\. Mezic, S\. Bagheri, P\. Schlatter, and D\. S\. Henningson\(2009\)Spectral analysis of nonlinear flows\.Journal of Fluid Mechanics641\(1\),pp\. 115–127\.Cited by:[Appendix A: Koopman Operator Theory and Dynamic Mode Decomposition for Inferring Dynamics from Token Embeddings](https://arxiv.org/html/2608.19579#S1.SSx1.p2.1),[§3\.2](https://arxiv.org/html/2608.19579#S3.SS2.p1.1)\.
- \[39\]C\. W\. Rowley, I\. Mezić, S\. Bagheri, P\. Schlatter, and D\. S\. Henningson\(2009\)Spectral analysis of nonlinear flows\.Journal of Fluid Mechanics641,pp\. 115–127\.Cited by:[§1](https://arxiv.org/html/2608.19579#S1.p3.1)\.
- \[40\]A\. Sawczyn, J\. Binkowski, D\. Janiak, B\. Gabrys, and T\. J\. Kajdanowicz\(2026\)FactSelfCheck: fact\-level black\-box hallucination detection for LLMs\.InFindings of the Association for Computational Linguistics: EACL 2026,pp\. 5603–5621\.Cited by:[§2\.1](https://arxiv.org/html/2608.19579#S2.SS1.p1.1)\.
- \[41\]P\. J\. Schmid\(2010\)Dynamic mode decomposition of numerical and experimental data\.Journal of Fluid Mechanics656,pp\. 5–28\.Cited by:[Appendix A: Koopman Operator Theory and Dynamic Mode Decomposition for Inferring Dynamics from Token Embeddings](https://arxiv.org/html/2608.19579#S1.SSx1.p2.1),[§3\.2](https://arxiv.org/html/2608.19579#S3.SS2.p1.1)\.
- \[42\]P\. J\. Schmid\(2010\)Dynamic mode decomposition of numerical and experimental data\.Journal of Fluid Mechanics656,pp\. 5–28\.Cited by:[§1](https://arxiv.org/html/2608.19579#S1.p3.1)\.
- \[43\]W\. Su, C\. Wang, Q\. Ai, Y\. Hu, Z\. Wu, Y\. Zhou, and Y\. Liu\(2024\)Unsupervised real\-time hallucination detection based on the internal states of large language models\.InFindings of the Association for Computational Linguistics: ACL 2024,pp\. 14379–14391\.Cited by:[§2\.1](https://arxiv.org/html/2608.19579#S2.SS1.p1.1)\.
- \[44\]A\. Wei, N\. Haghtalab, and J\. Steinhardt\(2024\)Jailbroken: how does LLM safety training fail?\.Advances in Neural Information Processing Systems36\.Cited by:[§1](https://arxiv.org/html/2608.19579#S1.p1.1)\.
- \[45\]M\. O\. Williams, I\. G\. Kevrekidis, and C\. W\. Rowley\(2015\)A data–driven approximation of the koopman operator: extending dynamic mode decomposition\.Journal of Nonlinear Science25\(6\),pp\. 1307–1346\.Cited by:[Appendix A: Koopman Operator Theory and Dynamic Mode Decomposition for Inferring Dynamics from Token Embeddings](https://arxiv.org/html/2608.19579#S1.SSx1.p2.1),[Appendix A: Koopman Operator Theory and Dynamic Mode Decomposition for Inferring Dynamics from Token Embeddings](https://arxiv.org/html/2608.19579#S1.SSx1.p2.2),[§3\.2](https://arxiv.org/html/2608.19579#S3.SS2.p1.1)\.
- \[46\]M\. O\. Williams, I\. G\. Kevrekidis, and C\. W\. Rowley\(2015\)A data\-driven approximation of the Koopman operator: extending dynamic mode decomposition\.Journal of Nonlinear Science25\(6\),pp\. 1307–1346\.Cited by:[§2\.1](https://arxiv.org/html/2608.19579#S2.SS1.p2.1)\.
- \[47\]D\. Wilson and M\. Akrout\(2026\)Low\-cost black\-box detection of LLM hallucinations via dynamical system prediction\.arXiv preprint arXiv:2605\.05134\.Cited by:[Appendix A: Koopman Operator Theory and Dynamic Mode Decomposition for Inferring Dynamics from Token Embeddings](https://arxiv.org/html/2608.19579#S1.SSx1.p1.1),[§1](https://arxiv.org/html/2608.19579#S1.p3.1),[§2\.1](https://arxiv.org/html/2608.19579#S2.SS1.p2.1),[§2\.2](https://arxiv.org/html/2608.19579#S2.SS2.p1.1),[§3\.2](https://arxiv.org/html/2608.19579#S3.SS2.p2.1)\.
- \[48\]Z\. Xu, S\. Jain, and M\. Kankanhalli\(2024\)A survey on hallucination in large language models: principles, taxonomy, and challenges\.arXiv preprint arXiv:2411\.08009\.Cited by:[§1](https://arxiv.org/html/2608.19579#S1.p1.1)\.
- \[49\]J\. Zhang, Z\. Li, K\. Das, B\. Malin, and S\. Kumar\(2023\)SAC3: reliable hallucination detection in black\-box language models via semantic\-aware cross\-check consistency\.InFindings of the Association for Computational Linguistics: EMNLP 2023,pp\. 15445–15458\.Cited by:[§2\.1](https://arxiv.org/html/2608.19579#S2.SS1.p1.1)\.
- \[50\]Y\. Zhao, J\. Zhang, I\. Chern, S\. Gao, P\. Liu, J\. He,et al\.\(2023\)FELM: benchmarking factuality evaluation of large language models\.Advances in Neural Information Processing Systems36,pp\. 44502–44523\.Cited by:[§2\.1](https://arxiv.org/html/2608.19579#S2.SS1.p3.1)\.
- \[51\]A\. Zou, Z\. Wang, J\. Z\. Kolter, and M\. Fredrikson\(2023\)Universal and transferable adversarial attacks on aligned language models\.arXiv preprint arXiv:2307\.15043\.Cited by:[§1](https://arxiv.org/html/2608.19579#S1.p1.1)\.

## Appendices

### Appendix A: Koopman Operator Theory and Dynamic Mode Decomposition for Inferring Dynamics from Token Embeddings

Differential residual scores from Section[3\.2](https://arxiv.org/html/2608.19579#S3.SS2)are obtained by considering the token embedding dynamics of safe/unsafe prompts and responses\. Following a strategy proposed in\[[47](https://arxiv.org/html/2608.19579#bib.bib37)\], we consider an LLM and its output as a dynamical system of the form

𝐱k\+1\\displaystyle\\mathbf\{x\}\_\{k\+1\}=F⁡\(𝐱k\),\\displaystyle=F\(\\mathbf\{x\}\_\{k\}\),𝐪k\\displaystyle\\mathbf\{q\}\_\{k\}=G1​\(𝐱k\),\\displaystyle=G\_\{1\}\(\\mathbf\{x\}\_\{k\}\),𝐲k\\displaystyle\\mathbf\{y\}\_\{k\}=H⁡\(𝐱k\)≡G2​\(G1​\(𝐱k\)\),\\displaystyle=H\(\\mathbf\{x\}\_\{k\}\)\\equiv G\_\{2\}\(G\_\{1\}\(\\mathbf\{x\}\_\{k\}\)\),\(4\)where𝐱k∈ℝN\\mathbf\{x\}\_\{k\}\\in\\mathbb\{R\}^\{N\}are the state variables of an LLM immediately before the next token \(i\.e\., activation maps\),FFgoverns the state evolution,𝐪k\\mathbf\{q\}\_\{k\}is the token chosen by the LLM taken from its vocabulary, and𝐲k∈ℝM\\mathbf\{y\}\_\{k\}\\in\\mathbb\{R\}^\{M\}is the associated token embedding\. The nonlinear functionG1G\_\{1\}maps the internal state to a token andG2G\_\{2\}maps the token to an embedding \(e\.g\., viaQwen,Mistral, etc\.\)\. Koopman operator theory\[[33](https://arxiv.org/html/2608.19579#bib.bib46),[11](https://arxiv.org/html/2608.19579#bib.bib47)\]can be used consider the dynamics of observables, with the Koopman operatorK:ℝM→ℝMK:\\mathbb\{R\}^\{M\}\\rightarrow\\mathbb\{R\}^\{M\}defined according to

K​H​\(𝐱k\)≡H⁡\(F⁡\(𝐱k\)\)\.KH\(\\mathbf\{x\}\_\{k\}\)\\equiv H\(F\(\\mathbf\{x\}\_\{k\}\)\)\.\(5\)Despite the fact that the functionsFFandHHare nonlinear, the Koopman operator is linear due to the linearity of the composition operator but generally infinite dimensional\[[11](https://arxiv.org/html/2608.19579#bib.bib47)\],\[[33](https://arxiv.org/html/2608.19579#bib.bib46)\]\.

Dynamic mode decomposition \(DMD\) is a data\-driven method that can be used to obtain a finite\-dimensional approximation for the action of the Koopman operator\[[29](https://arxiv.org/html/2608.19579#bib.bib51)\],\[[41](https://arxiv.org/html/2608.19579#bib.bib48)\],\[[38](https://arxiv.org/html/2608.19579#bib.bib50)\],\[[45](https://arxiv.org/html/2608.19579#bib.bib49)\]\. Here, we consider the Extended DMD approach\[[45](https://arxiv.org/html/2608.19579#bib.bib49)\]\. To implement this strategy, we first lift the observables to a higher dimensional space

𝐳k=\[𝐲k⊤flift⊤​\(𝐲k\)\]⊤,\\mathbf\{z\}\_\{k\}=\\begin\{bmatrix\}\\mathbf\{y\}\_\{k\}^\{\\top\}&f\_\{\\rm lift\}^\{\\top\}\(\\mathbf\{y\}\_\{k\}\)\\end\{bmatrix\}^\{\\top\},\(6\)where𝐳k∈ℝM\+γ\\mathbf\{z\}\_\{k\}\\in\\mathbb\{R\}^\{M\+\\gamma\}is the lifted token embedding\. Here,flift∈ℝγf\_\{\\rm lift\}\\in\\mathbb\{R\}^\{\\gamma\}whereγ\\gammais the dimension of the lifting and⊤indicates the vector transpose\. This initial lifting step generally yields a more accurate representation of the Koopman operator; common choices of lifted coordinates include polynomial combinations of observables and radial basis functions\[[45](https://arxiv.org/html/2608.19579#bib.bib49)\]\. In this work, we take the observable from \([Appendix A: Koopman Operator Theory and Dynamic Mode Decomposition for Inferring Dynamics from Token Embeddings](https://arxiv.org/html/2608.19579#S1.Ex1)\) to be𝒚k=𝚽⊤​H​\(𝐱k\)\\bm\{y\}\_\{k\}=\\bm\{\\Phi\}^\{\\top\}H\(\\mathbf\{x\}\_\{k\}\)where𝚽∈ℝM×500\\mathbf\{\\Phi\}\\in\\mathbb\{R\}^\{M\\times 500\}is comprised of the 500 most dominant SVD modes from the fitting data, as gauged by the singular values of the covariance matrix of the fitting data\. The lifting functionfliftf\_\{\\rm lift\}takes polynomial combinations up to order 4 of a subset of the most dominant SVD modes\.

A set of snapshot pairssk=\(𝐳k,𝐳k\+1\)s\_\{k\}=\(\\mathbf\{z\}\_\{k\},\\mathbf\{z\}\_\{k\+1\}\)is collected and arranged into matrices𝑿=\[𝐳1…𝐳q\]\\bm\{X\}=\\begin\{bmatrix\}\\mathbf\{z\}\_\{1\}&\\dots&\\mathbf\{z\}\_\{q\}\\end\{bmatrix\}and𝑿\+=\[𝐳2…𝐳q\+1\]\\bm\{X\}^\{\+\}=\\begin\{bmatrix\}\\mathbf\{z\}\_\{2\}&\\dots&\\mathbf\{z\}\_\{q\+1\}\\end\{bmatrix\}whereqqis the number of snapshot pairs used\. An approximation of the Koopman operator𝐳k\+1=𝐀𝐳k\\mathbf\{z\}\_\{k\+1\}=\\mathbf\{A\}\\mathbf\{z\}\_\{k\}can be obtained according to

𝐀=𝐗\+​𝐗†,\\mathbf\{A\}=\\mathbf\{X\}^\{\+\}\\mathbf\{X\}^\{\\dagger\},\(7\)where†denotes the pseudoinverse\. Low\-rank approximations of𝐀\\mathbf\{A\}can be obtained by truncating small magnitude SVD modes of𝐗\\mathbf\{X\}before taking the pseudoinverse\.