Safety Beyond the Interface: Detecting Harm via Latent States in Large Language Models
Lightweight 12.6M-parameter probes on LLaMA-3.1-8B activations detect harmful prompts with F1 up to 99%, matching guard models 1000x larger at lower cost.
The study extracts activations from LLaMA-3.1-8B and trains lightweight MLP classifier probes with 12.6M parameters to detect harmful prompts. Evaluated on WildJailbreak, BeaverTails, and AEGIS 2.0, the probes achieve F1 scores of 99%, 83%, and 84%, respectively, competitive with guard models roughly 1000x larger. This internal-state approach addresses the latency, compute overhead, and assurance gap of external guardrail models in resource-constrained, time-critical deployments.
- Probes read LLaMA-3.1-8B internal activations instead of relying on external guardrail models.
- 12.6M-parameter MLP classifiers achieve F1 of 99%, 83%, and 84% on three benchmarks.
- Performance matches guard models roughly 1000x larger while cutting latency and compute.
- Targets resource-constrained, time-critical deployments where external guardrails add overhead.
Full article103 words · extracted from arxiv.org · click to collapse
Autonomous systems increasingly rely on Large Language Models (LLMs) yet the safety infrastructure surrounding these models introduces latency and compute overhead. This limits utility in resource-constrained, time-critical deployments. Existing external guardrail models remain blind to the model's internal workings, creating a fundamental assurance gap. We ask: does the model already know when the content is harmful? We extract activations from LLaMA-3.1-8B and train lightweight MLP classifier probes (12.6M parameters) to detect harmful prompts. Evaluated on WildJailbreak, Beavertails, and AEGIS 2.0, our probes achieve F1 scores of 99%, 83%, and 84%, respectively competitive with 1000x larger guard models while cutting latency and compute costs.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.19472