Exposing the Ghost in the Transformer: Abnormal Detection for Large Language Models via Hidden State Forensics

Summary

Researchers introduce a method for detecting abnormal LLM behavior by inspecting layer-specific hidden state activation patterns. They report detection accuracies above 95% across multiple models in most scenarios, with detector inference taking fractions of a second.

Related items

• MediumCVE-2026-108940: Mistral.rs path traversal through calibration_apply save_cimatrix argumentSimilar attack · NVD/CVE Database
• MediumCVE-2026-108939: mistral.rs server-side request forgery in is_global_ip validationSimilar attack · NVD/CVE Database
• HighCVE-2026-84317: Nginx UI MCP config add tool skips validation, allowing dangerous directivesSimilar attack · NVD/CVE Database
• InfoAnthropic takes risky AI tests offline after models breach govt sitesSimilar attack · BleepingComputer
• HighCVE-2026-109331: Network-AI security control bypass in ClaudeHookBridge PreToolUse hookSimilar attack · NVD/CVE Database