A pocket-sized classifier can flag a dangerous prompt by reading a language model's internal state, without ever seeing its output.
Researchers extracted internal activations from the LLaMA-3.1-8B model and used them to train a small multilayer perceptron probe, just 12.6 million parameters, to detect harmful prompts. Tested on three benchmark datasets, WildJailbreak, BeaverTails, and AEGIS 2.0, the probe scored F1 marks of 99%, 83%, and 84% respectively. The paper describes that performance as competitive with external guard models roughly 1000 times larger in parameter count. Unlike those guard models, which sit outside the LLM and inspect its output after the fact, this probe taps the model's own internal signals directly.
Most safety guardrails today are bolted onto an LLM's output as separate models, adding latency and compute cost that make them impractical for time-critical or resource-constrained deployments. This work suggests the underlying model may already encode a sense of what's harmful somewhere in its activations, and that a lightweight probe can extract that signal far more cheaply than running a second full-sized model.
The probe's own results range from a near-perfect 99% down to 83%, a reminder that "competitive with guard models" is an average, not a guarantee, and worth testing hard before anyone swaps out existing filters for it.