Large Language Models (LLMs) are increasingly deployed in high‑stakes scenarios, yet their propensity to produce toxic, harmful, or policy‑violating content creates serious safety concerns. Detecting such unsafe outputs in a black‑box manner remains an open challenge. This paper extends a recently proposed dynamical‑systems framework—originally designed for hallucination detection—to LLM safety classification. Prompts and responses are projected into high‑dimensional embedding spaces, and separate Koopman‑based predictive models are fitted for safe and unsafe regimes. New outputs are classified using a differential residual score that compares the prediction errors of the two regimes. The main contribution is the joint modeling of prompt and response embedding dynamics, yielding Koopman operators that capture essential interaction patterns. Experiments on three safety benchmarks with three embedding models show that incorporating prompt embeddings consistently improves performance, especially for interaction‑dependent violations (e.g., with causal decoders in Llama‑3), while response‑only violations benefit more from dense semantic embeddings. These results open the door to using dynamical‑systems analysis to study AI systems themselves, rather than the prevailing paradigm of using AI to model dynamical systems.
Blogger's Review: The study ingeniously brings Koopman dynamics into LLM safety detection, highlighting the value of prompt‑response interaction information and offering a fresh black‑box evaluation avenue. Future work could explore richer embedding architectures and real‑time detection feasibility.