mlsanityData to 14 Oct 2026

CG-Probes: Recovering Guardrail Directions from Patient Query Embeddings

arXiv 2609.31062 ↗First posted 25 Sep 2026cs.CL cs.IRcited by 0

On the map: LLM safety and security → Safety alignment, refusal and guardrails

Abstract (arXiv)

Patient-facing AI assistants promise valuable support to patients, but incoming queries can pose medical risks. To create guardrails, we work with oncologists to define three ordinal risk axes: Medical Urgency, Psychological Urgency, and Topic Sensitivity. We propose Clinical Guardrail Probes (CG-Probes) to measure the risks from query embeddings. We probe for each axis in the normalized embedding space of frozen embedders via the difference-in-means method, treating each axis as a potential linear direction. To train the probes, we cluster 79,658 Czech oncology search queries with BERTopic and use these clusters to generate pairs of queries with contrastive risk levels via few-shot prompting. We evaluate the approach on 200 queries (90 real, 110 synthetic), each graded by two oncologists, against two open-weight LLMs and a frontier LLM. We find that urgency-based axes are recoverable as linear directions, and the probes are competitive with open-weight LLMs (no significant differences in quadratic-weighted kappa) at a fraction of the latency. Each axis yields a scalar score that clinicians can inspect and use to set escalation thresholds. The pipeline requires only search logs, axis definitions, and black-box access to the embedding model, suggesting transferability across healthcare domains. Robust validation on new queries and axes remains future work.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Safety alignment, refusal and guardrails, one of 12 directions in LLM safety and security. Builds on 22 of its 58 references that are in the map. First posted on arXiv 25 Sep 2026.

Builds on

22 of 58 references.

Closest ancestors · 2

Same direction, newest first

  1. 2025Large Language Models Encode Semantics and Alignment in Linearly Separable Representations13 Jul
  2. 2024Refusal in Language Models Is Mediated by a Single Direction17 Jun

Other references · 20

  1. 2018UMAP: Uniform Manifold Approximation and Projection for Dimension Reductioncited by 2,898
  2. 2022Self-Instruct: Aligning Language Models with Self-Generated Instructionscited by 2,724
  3. 2022Large Language Models Encode Clinical Knowledgecited by 1,830
  4. 2016Understanding intermediate layers using linear classifier probescited by 1,353
  5. 2023Representation Engineering: A Top-Down Approach to AI Transparencycited by 1,336
  6. 2016Man is to Computer Programmer as Woman is to Homemaker? Debiasing Word Embeddingscited by 1,312
  7. 2021Probing Classifiers: Promises, Shortcomings, and Advancescited by 876
  8. 2019How Contextual are Contextualized Word Representations? Comparing the Geometry of BERT, ELMo, and GPT-2 Embeddingscited by 784
  9. 2019Designing and Interpreting Probes with Control Taskscited by 640
  10. 2018What you can cram into a single vector: Probing sentence embeddings for linguistic propertiescited by 457
  11. 2024LLM2Vec: Large Language Models Are Secretly Powerful Text Encoderscited by 404
  12. 2022A Holistic Approach to Undesired Content Detection in the Real Worldcited by 356
8 more
  1. 2025Persona Vectors: Monitoring and Controlling Character Traits in Language Modelscited by 345
  2. 2023How is ChatGPT's behavior changing over time?cited by 270
  3. 2025Refusal Direction is Universal Across Safety-Aligned Languagescited by 38
  4. 2024LLMs are Also Effective Embedding Models: An In-depth Overviewcited by 32
  5. 2023NevIR: Negation in Neural Information Retrievalcited by 29
  6. 2024Answer is All You Need: Instruction-following Text Embedding via Answering the Questioncited by 27
  7. 2020Query Understanding via Intent Description Generationcited by 8
  8. 2026Harmful Intent as a Geometrically Recoverable Feature of LLM Residual Streamscited by 4

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026Listwise Cross-Encoder Fine-Tuning vs. Agentic Instruction Tuning for LLM Rerankers: A Systematic Study in Medical Procedure Reranking
  2. 2026CareGuardAI: Context-Aware Multi-Agent Guardrails for Clinical Safety & Hallucination Mitigation in Patient-Facing LLMs
  3. 2024Reinforcement of Explainability of ChatGPT Prompts by Embedding Breast Cancer Self-Screening Rules into AI Responses
  4. 2025Unlocking Electronic Health Records: A Hybrid Graph RAG Approach to Safe Clinical AI for Patient QA
  5. 2025CARES: Comprehensive Evaluation of Safety and Adversarial Robustness in Medical LLMs
  6. 2026Counterfactual Evaluation Reveals Hidden Capability Profiles in Clinical LLMs and Agents
  7. 2023Can-SAVE: Deploying Low-Cost and Population-Scale Cancer Screening via Survival Analysis Variables and EHR
  8. 2026MindGuard: Guardrail Classifiers for Multi-Turn Mental Health Support