Analysing Self-Harm Representations in Language Models: a Cross-Architecture Study

# Analysing Self-Harm Representations in Language Models: a Cross-Architecture Study
Source: [https://arxiv.org/html/2607.21988](https://arxiv.org/html/2607.21988)
Luis Espinosa\-Anke Carla Perez\-Almendros Cardiff University \{espinosa\-ankel, perezalmendrosc\}@cardiff\.ac\.uk

###### Abstract

Detecting self\-harm is a challenging and high\-stakes task requiring the highest accuracy to enable timely intervention and flagging at\-risk users\. In this paper, we present an analysis of how LLMs represent such self\-harm posts\.We perform two experiments: \(1\) We train and evaluate linear probes across all layers of each model on two self\-harm datasets and find that self\-harm information crystallizes in the final 3 \- 7% of network layers \(93 to 97% depth\)\. \(2\) We extract contrastive self\-harm directions and, after performing a normalization step, we find that the most accurate probes are not necessarily the most linearly separable\. In particular, we find Gemma\-3\-4B to represent thiscontrastive self\-harm directionin a slightly different, more intricate way than the other LLMs111Code available at[https://github\.com/luisespinosaanke/self\-harm\-analysis](https://github.com/luisespinosaanke/self-harm-analysis)\.\.

## 1Introduction

Self\-harm content on social media poses a significant public health concern\. Researchers have focused on using AI for analyzing mental health disordersOwenet al\.\([2024](https://arxiv.org/html/2607.21988#bib.bib32)\), with many building classifiers for depressionNadeem \([2016](https://arxiv.org/html/2607.21988#bib.bib20)\)and self\-harm detection\(Antypaset al\.,[2025](https://arxiv.org/html/2607.21988#bib.bib1); Rozovaet al\.,[2022](https://arxiv.org/html/2607.21988#bib.bib17); Ayreet al\.,[2021](https://arxiv.org/html/2607.21988#bib.bib18)\)\. Automated detection systems, thus, play a critical role in content moderation\(Coppersmithet al\.,[2018](https://arxiv.org/html/2607.21988#bib.bib16); Jiet al\.,[2022](https://arxiv.org/html/2607.21988#bib.bib11)\)and for flagging depressive disordersLeiva and Freire \([2017](https://arxiv.org/html/2607.21988#bib.bib19)\)\. Past approaches include using LSTMsYateset al\.\([2017](https://arxiv.org/html/2607.21988#bib.bib30)\), BERT\-based transformersOwenet al\.\([2020](https://arxiv.org/html/2607.21988#bib.bib31)\)and LLMsOhseet al\.\([2024](https://arxiv.org/html/2607.21988#bib.bib33)\)\. However, there is still a significant gap in understanding*how*LLMs internally represent such content: where in the network self\-harm concepts crystallize, how geometrically stable these representations are across layers, or whether the structure is consistent across architectures and scales\. We argue that gaining deeper understanding on these questions can contribute dramatically to building safer systems that go beyond prompt engineering, and instead include explicit, testable components, which also enables more realistic intervention, governance and escalationReddy and Reddy \([2025](https://arxiv.org/html/2607.21988#bib.bib23)\)222When deployed without such features, AI\-based assistants have proven brittle in real world scenarios, and caused genuine public health issues:[https://www\.bbc\.co\.uk/news/world\-us\-canada\-65771872](https://www.bbc.co.uk/news/world-us-canada-65771872)\.\. In this context, “representation engineering”\(Zouet al\.,[2023](https://arxiv.org/html/2607.21988#bib.bib3)\)offers a promising framework for understanding model internals through the lens of residual stream activations\. In particular, the extraction of contrastive directions \(typically via datasets of contrastive prompts that elicit opposed behaviours in LLMs\) allows us to probe concept separability as well as to characterise the geometry of safety\-relevant embeddings\(Turneret al\.,[2023](https://arxiv.org/html/2607.21988#bib.bib4); Liet al\.,[2024](https://arxiv.org/html/2607.21988#bib.bib6)\), with direct applications in bias mitigation\(Siddiqueet al\.,[2026](https://arxiv.org/html/2607.21988#bib.bib2)\)\. In this paper, thus, we ask ourselves the question whether self\-harmcontentis equally, more or less likely to be captured by a single direction, a proven feature in “refusal”, for instance, a well\-known proxy for embedded safety in AI\-assistantsArditiet al\.\([2024](https://arxiv.org/html/2607.21988#bib.bib24)\)\. We found consistent late\-layer crystallisation of self\-harm concepts, and a cross\-layer block\-diagonal embedding of contrastive directions, which we argue paves the way for future more effecrtive intervention\.

## 2Related Work

Automated detection of suicidal ideation and self\-harm has long been studied\(Leiva and Freire,[2017](https://arxiv.org/html/2607.21988#bib.bib19); Coppersmithet al\.,[2018](https://arxiv.org/html/2607.21988#bib.bib16); Jiet al\.,[2022](https://arxiv.org/html/2607.21988#bib.bib11); Yanget al\.,[2023](https://arxiv.org/html/2607.21988#bib.bib22); Ghoshet al\.,[2025](https://arxiv.org/html/2607.21988#bib.bib21)\)\. However, they are noteably unable to handle mental health\-specific challenges like prioritising crisis intervention accuracy or preventing escalationsZhanget al\.\([2025](https://arxiv.org/html/2607.21988#bib.bib26)\); Leeet al\.\([2025](https://arxiv.org/html/2607.21988#bib.bib25)\); Schoene and Canca \([2025](https://arxiv.org/html/2607.21988#bib.bib27)\); Stamatiset al\.\([2026](https://arxiv.org/html/2607.21988#bib.bib28)\); Lyuet al\.\([2025](https://arxiv.org/html/2607.21988#bib.bib29)\)\.Seeking AI\-safety, LLMs are reinforced with human feedback to replicate human preferencesZiegleret al\.\([2019](https://arxiv.org/html/2607.21988#bib.bib35)\); Baiet al\.\([2022a](https://arxiv.org/html/2607.21988#bib.bib34)\)\. Initiatives like Constitutional AIBaiet al\.\([2022b](https://arxiv.org/html/2607.21988#bib.bib36)\)also allow models to learn from their own outputs to maximize safe and accurate responses\. Another approach to safety involves the better understanding of LLMs behaviour through representation analysis, in particular leveraging linear probes\(Alain and Bengio,[2016](https://arxiv.org/html/2607.21988#bib.bib10); Belinkov,[2022](https://arxiv.org/html/2607.21988#bib.bib12); Burnset al\.,[2023](https://arxiv.org/html/2607.21988#bib.bib7)\)\. Recent work has extended probing to latent knowledge discovery\(Burnset al\.,[2023](https://arxiv.org/html/2607.21988#bib.bib7)\)and safety\-relevant concepts\.Zouet al\.\([2023](https://arxiv.org/html/2607.21988#bib.bib3)\)characterizes*where*in the activation space the concept lives and how it evolves across layers, by extracting mean\-difference contrastive directions\.Subramaniet al\.\([2022](https://arxiv.org/html/2607.21988#bib.bib13)\)andTurneret al\.\([2023](https://arxiv.org/html/2607.21988#bib.bib4)\)showed that such directions can be used for inference\-time control, whileSiddiqueet al\.\([2026](https://arxiv.org/html/2607.21988#bib.bib2)\)andLiet al\.\([2024](https://arxiv.org/html/2607.21988#bib.bib6)\)demonstrated downstream applications in bias mitigation and truthfulness\.

## 3Data and Models

We evaluate on two datasets\. First,X\-Sensitive \(X\-S\)Antypaset al\.\([2025](https://arxiv.org/html/2607.21988#bib.bib1)\), a multi\-label corpus of English\-language social media posts annotated for six sensitive content categories: self\-harm, conflictual, profanity, sex, drugs, and spam\. We combine all available splits \(train, validation, test\) and extract 200 self\-harm positive posts \(selfharm=1=1\) and the 200 control posts where all categories are 0\. Second,SH\-Detection \(SH\-D\)\.Tharsi \([2025](https://arxiv.org/html/2607.21988#bib.bib37)\), where self\-harm posts haveclass==‘‘self\-harm’’; all remaining posts serve as controls\. Unlike X\-S, controls may include posts from any non\-self\-harm category\. We sample a balanced binary 600\-post dataset\.For both datasets, posts shorter than 20 characters are discarded, URLs are removed, whitespace is collapsed, and @mentions are anonymised\. Representative examples are shown in Table[1](https://arxiv.org/html/2607.21988#S3.T1)\. In terms of LLMs, we select four instruction\-tuned transformer architectures:Qwen3\-0\.6B\(0\.6B parameters, 28 layers,dmodel=1024d\_\{\\text\{model\}\}=1024;Qwen\-Team,[2025](https://arxiv.org/html/2607.21988#bib.bib14)\),Llama 3\.2\-1B\-Instruct\(1B parameters, 16 layers,dmodel=2048d\_\{\\text\{model\}\}=2048;Grattafioriet al\.,[2024](https://arxiv.org/html/2607.21988#bib.bib9)\),Llama 3\.2\-3B\-Instruct\(3B parameters, 28 layers,dmodel=3072d\_\{\\text\{model\}\}=3072;Grattafioriet al\.,[2024](https://arxiv.org/html/2607.21988#bib.bib9)\), andGemma\-3\-4B\-it\(4B parameters, 34 layers,dmodel=2560d\_\{\\text\{model\}\}=2560;Gemma\-Team,[2025](https://arxiv.org/html/2607.21988#bib.bib15)\)\. We access internal representations via TransformerLens\(Nanda and Bloom,[2022](https://arxiv.org/html/2607.21988#bib.bib5)\), hooking intohook\_resid\_postat each transformer block to extract residual stream activations after the full sublayer stack \(attention \+ MLP\)\. We use the*last token position*as the representation of each input, following standard practice for causal LMs where the final token aggregates full left context\.

Table 1:Representative self\-harm \(S\-H\) and control \(C\) examples from X\-Sensitive \(X\-S\) and self\-harm detection \(SH\-D\)\.
## 4Experiments

### 4\.1Layer\-wise Probing

![Refer to caption](https://arxiv.org/html/2607.21988v1/fig_probe_accuracy.png)Figure 1:Layer\-wise probe ROC\-AUC for all four models on X\-Sensitive\. Shaded regions denote±\\pm1 SD across 5\-fold CV\.![Refer to caption](https://arxiv.org/html/2607.21988v1/fig_probe_accuracy_SH.png)Figure 2:Layer\-wise probe ROC\-AUC for all four models on SH\-Detection\. Shaded regions denote±\\pm1 SD across 5\-fold CV\.#### Setup\.

For each layerℓ∈\{1,…,L\}\\ell\\in\\\{1,\\ldots,L\\\}, we extract last\-token residual\-stream activations𝐚ℓ∈ℝdmodel\\mathbf\{a\}\_\{\\ell\}\\in\\mathbb\{R\}^\{d\_\{\\text\{model\}\}\}for all posts in each dataset \(400 for X\-S, 600 for SH\-D\) and train anℓ2\\ell\_\{2\}\-regularised logistic regression probe \(C=1\.0C=1\.0,lbfgssolver, max 1000 iterations\) using 5\-fold stratified cross\-validation\. We report mean ROC\-AUC as our primary metric, as it measures discriminability independently of classification threshold and is robust to class balance effects\. Activations are not normalised prior to probing\.

#### Results\.

Table[2](https://arxiv.org/html/2607.21988#S4.T2)summarises the probing results\. Across all four models and both datasets, self\-harm information crystallizes at 93 \- 97% of network depth\. In terms of classification, AUC ranges from 0\.703 \(Qwen3\-0\.6B\) to 0\.817 \(Gemma\-3\-4B\) in X\-S\. On SH\-D, all models improve substantially: AUC ranges from 0\.923 \(Qwen3\-0\.6B\) to 0\.972 \(Llama 3\.2\-3B\), with significantly lower variance \(standard deviation halves\)\. Figures[1](https://arxiv.org/html/2607.21988#S4.F1)and[2](https://arxiv.org/html/2607.21988#S4.F2)show the full layer\-wise increasing AUC curves for X\-S and SH\-Detection, respectively\. As for a dataset comparison, SH\-D achieves uniformly higher AUC with lower variance\. We attribute this to corpus differences, e\.g\., presence of figurative or metaphorical content in X\-S’s vs\. SH\-D’s cleaner binary labelling\. Such figurative language also makes X\-S’s negative examples subtler, which might reduce probe ceiling performance\.

Table 2:Best linear probe ROC\-AUC per dataset\.LL= total layers; Bestℓ\\ellis the layer maximising mean ROC\-AUC across 5\-fold CV\.
#### Error analysis\.

At the best probe layer on X\-S, false negatives mostly consist of self\-harm posts using figurative or metaphorical language, legal or news contexts, or pop\-culture references\. False positives, on the other hand, are predominantly mental health advocacy posts, content\-warning\-prefixed posts, and third\-person crisis descriptions, which use vocabulary related to critical situations, but do not convey first\-person distress signals, which makes them legitimate confounders\.

### 4\.2Contrastive Direction Analysis

#### Setup\.

FollowingZouet al\.\([2023](https://arxiv.org/html/2607.21988#bib.bib3)\), we compute the contrastive self\-harm direction at each layer:

𝐝ℓ=𝐚¯ℓ\+−𝐚¯ℓ−‖𝐚¯ℓ\+−𝐚¯ℓ−‖\\mathbf\{d\}\_\{\\ell\}=\\frac\{\\bar\{\\mathbf\{a\}\}\_\{\\ell\}^\{\+\}\-\\bar\{\\mathbf\{a\}\}\_\{\\ell\}^\{\-\}\}\{\\\|\\bar\{\\mathbf\{a\}\}\_\{\\ell\}^\{\+\}\-\\bar\{\\mathbf\{a\}\}\_\{\\ell\}^\{\-\}\\\|\}\(1\)where𝐚¯ℓ\+\\bar\{\\mathbf\{a\}\}\_\{\\ell\}^\{\+\}and𝐚¯ℓ−\\bar\{\\mathbf\{a\}\}\_\{\\ell\}^\{\-\}are mean last\-token activations of self\-harm and control posts\. Each example’s scalar projectionsi=𝐚ℓ,i⋅𝐝ℓs\_\{i\}=\\mathbf\{a\}\_\{\\ell,i\}\\cdot\\mathbf\{d\}\_\{\\ell\}provides a single\-dimensional self\-harm score\. To enable cross\-model comparison despite differences in activation magnitudes, we compute Cohen’sddat the best\-separation layer:

d=s¯\+−s¯−\(σ\+2\+σ−2\)/2d=\\frac\{\\bar\{s\}^\{\+\}\-\\bar\{s\}^\{\-\}\}\{\\sqrt\{\(\\sigma\_\{\+\}^\{2\}\+\\sigma\_\{\-\}^\{2\}\)/2\}\}\(2\)We assess directional stability via theL×LL\\times Lpairwise cosine similarity matrixcos​\(𝐝i,𝐝j\)\\text\{cos\}\(\\mathbf\{d\}\_\{i\},\\mathbf\{d\}\_\{j\}\)\.

#### Separability\.

Table[3](https://arxiv.org/html/2607.21988#S4.T3)shows contrastive geometry results\. The reason for normalizing with Cohen’sddis that raw separation scores vary by orders of magnitude across models and datasets \(e\.g\. 3\.1 for Llama\-1B on X\-S vs\. 6,767 for Gemma\-3\-4B on SH\-D\) and so comparison between models would be challenging\.

Table 3:Contrastive direction Cohen’sddat each model’s best probe layer \(from Table[2](https://arxiv.org/html/2607.21988#S4.T2)\)\.![Refer to caption](https://arxiv.org/html/2607.21988v1/fig_projection_hist.png)Figure 3:Scalar projections onto the contrastive self\-harm direction at each model’s best layer for X\-S\.![Refer to caption](https://arxiv.org/html/2607.21988v1/fig_projection_layers.png)Figure 4:Per\-layer mean projection onto the contrastive self\-harm direction for all four models \(X\-Sensitive\)\.Table 4:Directional stability summary\.Adj\.: mean cosine similarity between adjacent\-layer direction pairs\.Cross: mean cosine between directions in the first and last thirds of the network\. FullL×LL\{\\times\}Lmatrices are in Figure[5](https://arxiv.org/html/2607.21988#A1.F5)\(Appendix[A](https://arxiv.org/html/2607.21988#A1)\)\.On X\-S, effect sizes range from 0\.71 \(Gemma\-3\-4B\) to 1\.26 \(Llama 3\.2\-1B\), all indicating large\-effect separability\. On SH\-D, effect sizes roughly double: 1\.18 to 2\.08, with Gemma\-3\-4B again the lowest despite its superior probe AUC\. This discrepancy, namely the high classification accuracy vs\. a lower geometric separation for Gemma is consistent for both datasets\. We argue that this points to a model\-specific representational property rather than an artifact in the dataset\. To give a concrete example, on SH\-D the contrastive direction for Llama 3\.2\-3B peaks in Cohen’sddat layer 14 \(d=2\.20d=2\.20\), well before the final layers, while probe AUC continues rising to layer 27\. This divergence sharpens the interpretation that probing and directional analysis capture complementary aspects: mid\-network directions may be potent but not yet sufficient for accurate linear classification\.

One geometric interpretation of Gemma’s dissociation is as follows\. A linear probe has access to the fulldmodeld\_\{\\text\{model\}\}\-dimensional activation space and can find a separating hyperplane exploiting any combination of features, including signal distributed, even if weakly, across many dimensions\. Cohen’sddon the mean\-difference direction reveals whether the*mean class centroids*are far apart relative to within\-class spread along that single axis\. High AUC with lowddtherefore implies that Gemma’s self\-harm signal is not concentrated in one direction, but spread across the activation space\. Next, we generate projection histograms at each model’s best layer \(Figure[3](https://arxiv.org/html/2607.21988#S4.F3)\), as well as per\-layer mean projection curves \(Figure[4](https://arxiv.org/html/2607.21988#S4.F4)\) for X\-S333Similar pattern for SH\-D\.\. These visuals show, first, a clear bimodal distribution with overlapping tails, which illustrates the geometric difference between the encodings of this dataset across models \(although smaller for Gemma\-3\-4B\)\. Also, that control means diverge mostly in the final two to four layers\.

#### Directional stability\.

Table[4](https://arxiv.org/html/2607.21988#S4.T4)summarises the block\-diagonal structure visible in the full cosine matrices \(Figure[5](https://arxiv.org/html/2607.21988#A1.F5), Appendix[A](https://arxiv.org/html/2607.21988#A1)\)\. On both corpora, adjacent\-layer directions are highly aligned \(0\.76 to 0\.92\), while directions from the first and last thirds of each network are nearly orthogonal \(between 0\.14 and 0\.38\)\. This means that the self\-harm concept is dynamically*re\-represented*across depth, i\.e\., the direction*rotates*substantially between early and late layers, and this structural property holds on the two datasets\. Gemma\-3\-4B shows the lowest cross\-comparison cosine on SH\-D \(0\.135\)\.

## 5Conclusion

We have presented a cross\-architecture analysis of self\-harm representations\. In our experiments, self\-harm concepts crystallize consistently in the 3\-7% “latest” layer block\. Moreover, the self\-harm contrastive direction is not stable across network depth, a direction extracted at an early layer does not transfer to late layers\. In addition, the most accurate linear probes are not the most geometrically separable\. Finally, the uniform performance gap between X\-Sensitive and SH\-Detection \(0\.12 to 0\.17 AUC,∼\\sim1 Cohen’sddunit\) also suggests that labelling quality and corpus composition have a large, systematic effect on representational quality\. For future work, we could extend these experiments to larger \(7B up to or beyond 70B\) models and to other sensitive content categories\.

## References

- Understanding intermediate layers using linear classifier probes\.arXiv preprint arXiv:1610\.01644\.Cited by:[§2](https://arxiv.org/html/2607.21988#S2.p1.1)\.
- D\. Antypas, I\. Sen, C\. Perez Almendros, J\. Camacho\-Collados, and F\. Barbieri \(2025\)Sensitive content classification in social media: a holistic resource and evaluation\.InProceedings of the 9th Workshop on Online Abuse and Harms \(WOAH\),Vienna, Austria,pp\. 17–31\.Cited by:[§1](https://arxiv.org/html/2607.21988#S1.p1.1),[§3](https://arxiv.org/html/2607.21988#S3.p1.6)\.
- A\. Arditi, O\. Obeso, A\. Syed, D\. Paleka, N\. Panickssery, W\. Gurnee, and N\. Nanda \(2024\)Refusal in language models is mediated by a single direction\.External Links:2406\.11717,[Link](https://arxiv.org/abs/2406.11717)Cited by:[§1](https://arxiv.org/html/2607.21988#S1.p1.1)\.
- K\. Ayre, A\. Bittar, J\. Kam, S\. Verma, L\. M\. Howard, and R\. Dutta \(2021\)Developing a natural language processing tool to identify perinatal self\-harm in electronic healthcare records\.PLoS one16\(8\),pp\. e0253809\.Cited by:[§1](https://arxiv.org/html/2607.21988#S1.p1.1)\.
- Y\. Bai, A\. Jones, K\. Ndousse, A\. Askell, A\. Chen, N\. DasSarma, D\. Drain, S\. Fort, D\. Ganguli, T\. Henighan,et al\.\(2022a\)Training a helpful and harmless assistant with reinforcement learning from human feedback\.arXiv preprint arXiv:2204\.05862\.Cited by:[§2](https://arxiv.org/html/2607.21988#S2.p1.1)\.
- Y\. Bai, S\. Kadavath, S\. Kundu, A\. Askell, J\. Kernion, A\. Jones, A\. Chen, A\. Goldie, A\. Mirhoseini, C\. McKinnon,et al\.\(2022b\)Constitutional ai: harmlessness from ai feedback\.arXiv preprint arXiv:2212\.08073\.Cited by:[§2](https://arxiv.org/html/2607.21988#S2.p1.1)\.
- Y\. Belinkov \(2022\)Probing classifiers: promises, shortcomings, and advances\.Computational Linguistics48\(1\),pp\. 207–219\.Cited by:[§2](https://arxiv.org/html/2607.21988#S2.p1.1)\.
- C\. Burns, H\. Ye, D\. Klein, and J\. Steinhardt \(2023\)Discovering latent knowledge in language models without supervision\.InThe Eleventh International Conference on Learning Representations,Cited by:[§2](https://arxiv.org/html/2607.21988#S2.p1.1)\.
- G\. Coppersmith, R\. Leary, P\. Crutchley, and A\. Fine \(2018\)Natural language processing of social media as screening for suicide risk\.InBiomedical Informatics Insights,Vol\.10\.Cited by:[§1](https://arxiv.org/html/2607.21988#S1.p1.1),[§2](https://arxiv.org/html/2607.21988#S2.p1.1)\.
- Gemma\-Team \(2025\)Gemma 3 technical report\.arXiv preprint arXiv:2503\.19786\.Cited by:[§3](https://arxiv.org/html/2607.21988#S3.p1.6)\.
- S\. Ghosh, G\. V\. Singh, Shambhavi, S\. Choudhury, and A\. Ekbal \(2025\)Just a scratch: enhancing LLM capabilities for self\-harm detection through intent differentiation and emoji interpretation\.InProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),W\. Che, J\. Nabende, E\. Shutova, and M\. T\. Pilehvar \(Eds\.\),Vienna, Austria,pp\. 27428–27445\.External Links:[Link](https://aclanthology.org/2025.acl-long.1330/),[Document](https://dx.doi.org/10.18653/v1/2025.acl-long.1330),ISBN 979\-8\-89176\-251\-0Cited by:[§2](https://arxiv.org/html/2607.21988#S2.p1.1)\.
- A\. Grattafiori, A\. Dubey,et al\.\(2024\)The Llama 3 herd of models\.arXiv preprint arXiv:2407\.21783\.Cited by:[§3](https://arxiv.org/html/2607.21988#S3.p1.6)\.
- S\. Ji, S\. Pan, X\. Li, E\. Cambria, G\. Long, and Z\. Huang \(2022\)Suicidal ideation detection: a review of machine learning methods and applications\.IEEE Transactions on Computational Social Systems9\(1\),pp\. 214–226\.Cited by:[§1](https://arxiv.org/html/2607.21988#S1.p1.1),[§2](https://arxiv.org/html/2607.21988#S2.p1.1)\.
- B\. W\. Lee, I\. Padhi, K\. N\. Ramamurthy, E\. Miehling, P\. Dognin, M\. Nagireddy, and A\. Dhurandhar \(2025\)Programming refusal with conditional activation steering\.External Links:2409\.05907,[Link](https://arxiv.org/abs/2409.05907)Cited by:[§2](https://arxiv.org/html/2607.21988#S2.p1.1)\.
- V\. Leiva and A\. Freire \(2017\)Towards suicide prevention: early detection of depression on social media\.InInternet Science \- 4th International Conference, INSCI 2017, Thessaloniki, Greece, November 22\-24, 2017, Proceedings,I\. Kompatsiaris, J\. Cave, A\. Satsiou, G\. Carle, A\. Passani, E\. Kontopoulos, S\. Diplaris, and D\. McMillan \(Eds\.\),Lecture Notes in Computer Science,pp\. 428–436\.External Links:[Link](https://doi.org/10.1007/978-3-319-70284-1%5C_34),[Document](https://dx.doi.org/10.1007/978-3-319-70284-1%5F34)Cited by:[§1](https://arxiv.org/html/2607.21988#S1.p1.1),[§2](https://arxiv.org/html/2607.21988#S2.p1.1)\.
- K\. Li, O\. Patel, F\. Viégas, H\. Pfister, and M\. Wattenberg \(2024\)Inference\-time intervention: eliciting truthful answers from a language model\.Advances in Neural Information Processing Systems36\.Cited by:[§1](https://arxiv.org/html/2607.21988#S1.p1.1),[§2](https://arxiv.org/html/2607.21988#S2.p1.1)\.
- C\. Lyu, Y\. Song, P\. Zhang, and A\. M\. Rahmani \(2025\)Domain\-specific constitutional ai: enhancing safety in llm\-powered mental health chatbots\.In2025 IEEE 21st International Conference on Body Sensor Networks \(BSN\),pp\. 1–4\.External Links:[Link](http://dx.doi.org/10.1109/BSN66969.2025.11337405),[Document](https://dx.doi.org/10.1109/bsn66969.2025.11337405)Cited by:[§2](https://arxiv.org/html/2607.21988#S2.p1.1)\.
- M\. Nadeem \(2016\)Identifying depression on twitter\.External Links:1607\.07384,[Link](https://arxiv.org/abs/1607.07384)Cited by:[§1](https://arxiv.org/html/2607.21988#S1.p1.1)\.
- N\. Nanda and J\. Bloom \(2022\)TransformerLens\.Note:[https://github\.com/TransformerLensOrg/TransformerLens](https://github.com/TransformerLensOrg/TransformerLens)Cited by:[§3](https://arxiv.org/html/2607.21988#S3.p1.6)\.
- J\. Ohse, B\. Hadžić, P\. Mohammed, N\. Peperkorn, M\. Danner, A\. Yorita, N\. Kubota, M\. Rätsch, and Y\. Shiban \(2024\)Zero\-shot strike: testing the generalisation capabilities of out\-of\-the\-box llm models for depression detection\.Computer Speech & Language88,pp\. 101663\.Cited by:[§1](https://arxiv.org/html/2607.21988#S1.p1.1)\.
- D\. Owen, J\. Camacho\-Collados, and L\. Espinosa Anke \(2020\)Towards preemptive detection of depression and anxiety in Twitter\.InProceedings of the Fifth Social Media Mining for Health Applications Workshop & Shared Task,G\. Gonzalez\-Hernandez, A\. Z\. Klein, I\. Flores, D\. Weissenbacher, A\. Magge, K\. O’Connor, A\. Sarker, A\. Minard, E\. Tutubalina, Z\. Miftahutdinov, and I\. Alimova \(Eds\.\),Barcelona, Spain \(Online\),pp\. 82–89\.External Links:[Link](https://aclanthology.org/2020.smm4h-1.12/)Cited by:[§1](https://arxiv.org/html/2607.21988#S1.p1.1)\.
- D\. Owen, A\. J\. Lynham, S\. E\. Smart, A\. F\. Pardiñas, and J\. Camacho Collados \(2024\)Ai for analyzing mental health disorders among social media users: quarter\-century narrative review of progress and challenges\.Journal of medical Internet research26,pp\. e59225\.Cited by:[§1](https://arxiv.org/html/2607.21988#S1.p1.1)\.
- Qwen\-Team \(2025\)Qwen3 technical report\.arXiv preprint arXiv:2505\.09388\.Cited by:[§3](https://arxiv.org/html/2607.21988#S3.p1.6)\.
- P\. Reddy and N\. Reddy \(2025\)Preventing another tessa: modular safety middleware for health\-adjacent ai assistants\.External Links:2509\.07022,[Link](https://arxiv.org/abs/2509.07022)Cited by:[§1](https://arxiv.org/html/2607.21988#S1.p1.1)\.
- V\. Rozova, K\. Witt, J\. Robinson, Y\. Li, and K\. Verspoor \(2022\)Detection of self\-harm and suicidal ideation in emergency department triage notes\.Journal of the American Medical Informatics Association29\(3\),pp\. 472–480\.Cited by:[§1](https://arxiv.org/html/2607.21988#S1.p1.1)\.
- A\. M\. Schoene and C\. Canca \(2025\)‘For argument’s sake, show me how to harm myself\!’: jailbreaking llms in suicide and self\-harm contexts\.In2025 IEEE International Symposium on Technology and Society \(ISTAS\),Vol\.,pp\. 1–7\.External Links:[Document](https://dx.doi.org/10.1109/ISTAS65609.2025.11269647)Cited by:[§2](https://arxiv.org/html/2607.21988#S2.p1.1)\.
- Z\. Siddique, I\. Khalid, L\. Turner, and L\. Espinosa\-Anke \(2026\)Shifting perspectives: steering vectors for robust bias mitigation in LLMs\.InFindings of the Association for Computational Linguistics: EACL 2026,Rabat, Morocco,pp\. 809–820\.Cited by:[§1](https://arxiv.org/html/2607.21988#S1.p1.1),[§2](https://arxiv.org/html/2607.21988#S2.p1.1)\.
- C\. A\. Stamatis, J\. Meyerhoff, R\. Zhang, O\. Tieleman, M\. Malgaroli, and T\. D\. Hull \(2026\)Beyond simulations: what 20,000 real conversations reveal about mental health ai safety\.External Links:2601\.17003,[Link](https://arxiv.org/abs/2601.17003)Cited by:[§2](https://arxiv.org/html/2607.21988#S2.p1.1)\.
- N\. Subramani, N\. Suber, S\. Mathew, and N\. Shah \(2022\)Extracting latent steering vectors from pretrained language models\.InFindings of the Association for Computational Linguistics: ACL 2022,pp\. 566–581\.Cited by:[§2](https://arxiv.org/html/2607.21988#S2.p1.1)\.
- S\. Tharsi \(2025\)Self\-harm detection\.Hugging Face\.Note:[https://huggingface\.co/datasets/sivasothy\-Tharsi/self\-harm\-detection](https://huggingface.co/datasets/sivasothy-Tharsi/self-harm-detection)Cited by:[§3](https://arxiv.org/html/2607.21988#S3.p1.6)\.
- A\. M\. Turner, L\. Thiergart, D\. Udell, G\. Leech, U\. Mini, and M\. Peluso \(2023\)Activation addition: steering language models without optimization\.arXiv preprint arXiv:2308\.10248\.Cited by:[§1](https://arxiv.org/html/2607.21988#S1.p1.1),[§2](https://arxiv.org/html/2607.21988#S2.p1.1)\.
- K\. Yang, T\. Zhang, Z\. Kuang, Q\. Xie, and S\. Ananiadou \(2023\)MentalLLaMA: interpretable mental health analysis on social media with large language models\.arXiv preprint arXiv:2309\.13567\.Cited by:[§2](https://arxiv.org/html/2607.21988#S2.p1.1)\.
- A\. Yates, A\. Cohan, and N\. Goharian \(2017\)Depression and self\-harm risk assessment in online forums\.InProceedings of the 2017 Conference on Empirical Methods in Natural Language Processing,M\. Palmer, R\. Hwa, and S\. Riedel \(Eds\.\),Copenhagen, Denmark,pp\. 2968–2978\.External Links:[Link](https://aclanthology.org/D17-1322/),[Document](https://dx.doi.org/10.18653/v1/D17-1322)Cited by:[§1](https://arxiv.org/html/2607.21988#S1.p1.1)\.
- Y\. Zhang, M\. Li, W\. Han, Y\. Yao, Z\. Cen, and D\. Zhao \(2025\)Safety is not only about refusal: reasoning\-enhanced fine\-tuning for interpretable llm safety\.External Links:2503\.05021,[Link](https://arxiv.org/abs/2503.05021)Cited by:[§2](https://arxiv.org/html/2607.21988#S2.p1.1)\.
- D\. M\. Ziegler, N\. Stiennon, J\. Wu, T\. B\. Brown, A\. Radford, D\. Amodei, P\. Christiano, and G\. Irving \(2019\)Fine\-tuning language models from human preferences\.arXiv preprint arXiv:1909\.08593\.Cited by:[§2](https://arxiv.org/html/2607.21988#S2.p1.1)\.
- A\. Zou, L\. Phan, S\. Chen, J\. Campbell, P\. Guo, R\. Ren, A\. Pan, X\. Yin, M\. Mazeika, A\. Dombrowski, S\. Goel, N\. Li, M\. J\. Byun, Z\. Wang, A\. Mallen, S\. Basart, S\. Koyejo, D\. Song, M\. Fredrikson, J\. Z\. Kolter, and D\. Hendrycks \(2023\)Representation engineering: a top\-down approach to AI transparency\.arXiv preprint arXiv:2310\.01405\.Cited by:[§1](https://arxiv.org/html/2607.21988#S1.p1.1),[§2](https://arxiv.org/html/2607.21988#S2.p1.1),[§4\.2](https://arxiv.org/html/2607.21988#S4.SS2.SSS0.Px1.p1.7)\.

## Appendix ACross\-layer Directional Stability

Figure[5](https://arxiv.org/html/2607.21988#A1.F5)shows the fullL×LL\\times Lpairwise cosine similarity matrices between contrastive self\-harm directions across all layers, for all four models on both datasets\. The block\-diagonal structure is remarkably consistent across all plots: directions within the same network phase \(early or late\) are highly aligned, while directions from opposite phases are nearly orthogonal\. Gemma\-3\-4B \(rightmost column\) stands out with an abrupt near\-zero or negative cosine stripe at layers 5 through 8, particularly on SH\-Detection, indicating a sharper directional transition than the other models\. Summary statistics are reported in Table[4](https://arxiv.org/html/2607.21988#S4.T4)\.

![Refer to caption](https://arxiv.org/html/2607.21988v1/fig_cosines.png)Figure 5:Cross\-layer cosine similarity of contrastive self\-harm directions \(L×LL\\times Lmatrices\) for X\-Sensitive \(top row\) and SH\-Detection \(bottom row\)\. High within\-comparison and near\-orthogonal cross\-comparison cosines confirm the block\-diagonal structure across all four models and both corpora\.