mlsanityData to 14 Oct 2026

Safety Beyond the Interface: Detecting Harm via Latent States in Large Language Models

arXiv 2609.19472 ↗First posted 16 Sep 2026cs.AI cs.CL cs.CRcited by 1

On the map: LLM safety and security → Safety alignment, refusal and guardrails

Abstract (arXiv)

Autonomous systems increasingly rely on Large Language Models (LLMs) yet the safety infrastructure surrounding these models introduces latency and compute overhead. This limits utility in resource-constrained, time-critical deployments. Existing external guardrail models remain blind to the model's internal workings, creating a fundamental assurance gap. We ask: does the model already know when the content is harmful? We extract activations from LLaMA-3.1-8B and train lightweight MLP classifier probes (12.6M parameters) to detect harmful prompts. Evaluated on WildJailbreak, Beavertails, and AEGIS 2.0, our probes achieve F1 scores of 99%, 83%, and 84%, respectively competitive with 1000x larger guard models while cutting latency and compute costs.

Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Placed in Safety alignment, refusal and guardrails, one of 12 directions in LLM safety and security. Builds on 29 of its 33 references that are in the map. First posted on arXiv 16 Sep 2026.

Builds on

29 of 33 references.

Closest ancestors · 6

Same direction, newest first

  1. 2025Large Language Models Encode Semantics and Alignment in Linearly Separable Representations13 Jul
  2. 2025Aegis2.0: A Diverse AI Safety Dataset and Risks Taxonomy for Alignment of LLM Guardrails15 Jan
  3. 2024Lightweight Safety Guardrails Using Fine-tuned BERT Embeddings21 Nov
  4. 2024WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMs26 Jun
  5. 2024Towards Understanding Safety Alignment: A Mechanistic Perspective from Safety Neurons20 Jun
  6. 2024Building Guardrails for Large Language Models2 Feb

Other references · 23

  1. 2022Training language models to follow instructions with human feedbackcited by 15,971
  2. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  3. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,651
  4. 2023Representation Engineering: A Top-Down Approach to AI Transparencycited by 1,336
  5. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,207
  6. 2023BeaverTails: Towards Improved Safety Alignment of LLM via a Human-Preference Datasetcited by 860
  7. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Modelscited by 536
  8. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attackscited by 486
  9. 2024Alignment faking in large language modelscited by 360
  10. 2024ShieldGemma: Generative AI Content Moderation Based on Gemmacited by 243
  11. 2024Jailbreaking Attack against Multimodal Large Language Modelcited by 135
  12. 2024Attention Tracker: Detecting Prompt Injection Attacks in LLMscited by 95
11 more
  1. 2026Constitutional Classifiers++: Efficient Production-Grade Defenses against Universal Jailbreakscited by 41
  2. 2024Llama Guard 3-1B-INT4: Compact and Efficient Safeguard for Human-AI Conversationscited by 26
  3. 2025Bypassing LLM Guardrails: An Empirical Analysis of Evasion Attacks against Prompt Injection and Jailbreak Detection Systemscited by 26
  4. 2024LLMScan: Causal Scan for LLM Misbehavior Detectioncited by 13
  5. 2025Guiding not Forcing: Enhancing the Transferability of Jailbreaking Attacks on LLMs via Removing Superfluous Constraintscited by 11
  6. 2025Next-Generation LLM for UAV: From Natural Language to Autonomous Flightcited by 10
  7. 2025Probing Latent Subspaces in LLM for AI Security: Identifying and Manipulating Adversarial Statescited by 9
  8. 2025AutoAdv: Automated Adversarial Prompting for Multi-Turn Jailbreaking of Large Language Modelscited by 8
  9. 2026DeepContext: Stateful Real-Time Detection of Multi-Turn Adversarial Intent Drift in LLMscited by 8
  10. 2025Bypassing Prompt Guards in Production with Controlled-Release Promptingcited by 7
  11. 2025Hiding in Plain Sight: A Steganographic Approach to Stealthy LLM Jailbreakscited by 6

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 1.

1 paper.

  1. 2026Same Probe, Different Numbers: Are Activation Probes Robust to Inference-Time Numerical Non-Determinism?cited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025SafeRoute: Adaptive Model Selection for Efficient and Accurate Safety Guardrails in Large Language Models
  2. 2025Noise Injection Systemically Degrades Large Language Model Safety Guardrails
  3. 2026Safety Paradox: How Enhanced Safety Awareness Leaves LLMs Vulnerable to Posterior Attack
  4. 2026Safe responses matter: Output-aware safety guardrail mitigate over-refusal in MLLMs
  5. 2026Trust The Typical
  6. 2026TraceSafe: A Systematic Assessment of LLM Guardrails on Multi-Step Tool-Calling Trajectories
  7. 2026Benchmarking Open-Source Safety Guard Models: A Comprehensive Evaluation
  8. 2025SGuard-v1: Safety Guardrail for Large Language Models