DMD-Koopman operators on prompt-response embeddings classify LLM safety violations across three benchmarks

The method projects prompts and responses into embedding spaces from three models, fits DMD-derived Koopman operators separately for safe and unsafe regimes, then applies a differential residual score for black-box classification. On three safety benchmarks the approach records consistent gains when prompt dynamics are included, especially for causal decoders, while dense semantic embeddings perform better on response-only violations.

Prior hallucination-detection work using the same dynamical-systems framing is extended here to policy-violating content. The paper shows that interaction patterns captured by the prompt-conditioned operators reduce misclassification on benchmarks where single-turn response embeddings alone are insufficient. This reverses the usual direction of applying AI to dynamical systems by instead using dynamical systems to audit AI outputs.

Operationally the method requires only embedding access and offline operator fitting, enabling deployment without white-box logits or fine-tuning. Residual comparison provides an interpretable signal that can be thresholded per deployment risk tolerance. Limitations include sensitivity to embedding model choice and the need for labeled safe/unsafe trajectories for operator construction.

Next steps include testing on streaming multi-turn conversations and integration with existing guardrail pipelines to measure latency overhead versus accuracy lift.