Home
The Alignment Stress Map: Runtime Per-Token Sensitivity Attribution via Weight Delta Projection in Transformer Language Models
We propose the Alignment Stress Map (ASM), a runtime monitoring architecture that derives per- token, per-layer sensitivity attribution from the weight delta between a base language model and its alignment-tuned counterpart. The core observation is simple: at any point during inference, the magnitude of the alignment correction — computed by projecting current activations through the precomputed weight delta — indicates how much corrective force the alignment training applies in that region of representational space.
We formalize this as a layerwise amplitude field over the model’s forward pass, show that the transformer's attention mechanism permits exact decomposition of this field into per-token contributions at each attention sublayer, and define the resulting per-token amplitude trajectory as a fine-grained, interpretable diagnostic signal. The architecture requires only one additional matrix multiplication per monitored layer, using quantities already computed during standard inference. We characterize the expected structure of the amplitude field, derive specific empirical predictions about the relationship between amplitude and adversarial vulnerability, and outline an experimental program to validate or falsify these predictions using open-weight model pairs.
The contribution is architectural rather than algorithmic: we assemble existing components — weight deltas from task arithmetic, attention decomposition from standard transformer inference, behavioral subspace identification from mechanistic interpretability — into a monitoring instrument that has not previously been implemented because the contributing research programs have not been connected.
Alignment training modifies a language model's behavior. The modification is encoded in the model's weights. Current methods treat these modified weights as the endpoint of the alignment process — once training is complete, the weights serve inference but are not themselves interrogated at runtime. We argue this discards information that is both cheaply accessible and diagnostically valuable. The weight delta between a base model and its alignment-tuned counterpart — ΔW = W_aligned − W_base — is a complete record of every behavioral correction that alignment training applied. Task arithmetic (Ilharco et al., 2023) established that such deltas are meaningful objects: they can be added, subtracted, and composed to predictably modify model behavior. Fierro and Roger (2025) extended this to contrastive weight steering, demonstrating that weight-space behavioral directions often generalize further than activation-space interventions, and providing preliminary evidence that weight deltas can detect emergent misalignment during training. Hazra et al. (2024) showed that weight arithmetic can enforce safety properties at test time without retraining.
These works use weight deltas to modify behavior. We propose a complementary use: treating the weight delta as a diagnostic instrument that is queried continuously during inference to produce a real- time, per-token, per-layer map of where alignment correction is active, how strongly it is operating, and which input tokens are driving it.
This reframing matters because the delta's amplitude at any point during inference is not a measure of safety. It is a measure of tension — the distance between what the base model's learned geometry tends toward and what alignment training enforces. Low-amplitude regions are regions where pretraining data already produced behavior that alignment training endorsed: the base geometry naturally coupled relevant knowledge with appropriate contextual signals (consequence awareness, uncertainty markers, risk associations) because these patterns co-occur in the training corpus. High-amplitude regions are regions where alignment training had to override the base tendency — where the distributional patterns in pretraining data pulled toward outputs that alignment training judged unacceptable.
This distinction has immediate implications for adversarial robustness. An adversarial attack does not need to find regions that alignment missed. It needs to find regions where the alignment correction can be destabilized — where the base geometric gradient is steep enough that the right perturbation causes the model to follow the base tendency rather than the correction. The amplitude map predicts where this pressure is greatest.
We formalize this intuition, define the mathematical objects precisely, characterize their computational cost, and specify the empirical predictions that would validate or falsify the framework.
Based on: The Alignment Stress Map: Runtime Per-Token Sensitivity Attribution via Weight Delta Projection in Transformer Language Models (Ostrander, 2026)