Reading Between the States: Contrasting Hidden-State Dynamics for Jailbreak Detection

Jailbreak attacks disguise harmful requests through diverse prompt constructions, posing a persistent threat to the safe deployment of large language models (LLMs). Recent defenses increasingly exploit internal hidden-state patterns across layers for jailbreak detection. However, these approaches fall short of explicitly modeling the underlying transition relationships, leaving their predictive value underexplored as generalizable detection evidence. Crucially, while unseen attacks exhibit unfamiliar trajectories, their state transitions often follow predictive regularities shared with known jailbreaks. This suggests a distinct detection principle: identifying which class-specific dynamics better predict the observed evolution. To realize this principle, we introduce **CORD** (**C**ompeting **O**perator **R**esidual **D**etection), which detects jailbreaks by comparing two predictive explanations of hidden-state evolution. CORD learns benign and jailbreak dynamical models through a conditional Koopman formulation, using shared observables to model transitions across token progression and network depth. Both models predict the same observed successors under identical context, making their prediction errors directly comparable. The resulting residual contrast assigns higher risk when jailbreak dynamics explain the observed evolution better than benign dynamics. Extensive experiments across four LLMs and ten attack families show that CORD achieves 93.94% macro TPR@1, surpassing the strongest evaluated baseline by 38.17%. Comprehensive experimental analyses demonstrate that predictive contrast captures discriminative differences between benign and jailbreak hidden-state dynamics, providing a promising basis for detecting unseen jailbreak attacks. Code: https://anonymous.4open.science/r/CORD-8DF6114514/anonymous repository.