The BaseResearcharXiv
Faithful Latent Harm Monitors Work No Better Than the Models Own Behaviour at a Matched False Alarm Rate
A preprint by Abhishek Mishra, Sagnik Chatterjee and Suyash Maniyar tests latent safety monitors, which read a model's internal activations to flag harmful prompts, on reworded and jailbreak-style requests across 15 models. The authors report that simple text classifiers match or beat them and that gains track the model's own refusals.
Why it matters
The same thing, for different readers.
What it means for you
Tools meant to catch harmful AI requests by looking inside the model may add little beyond what the model already refuses, according to this preprint.
For lawmakers
Safety claims resting on internal-activation monitors may need comparison against simple baselines and the model's own behaviour before regulators treat them as independent safeguards.
For researchers
The authors find that activations at the end of the instruction degrade under distribution shift, and the pre-reply gain over refusal follows the model's refusal decision.
In their own words
Every quotation was found, word for word, in the text we saved from the source. That shows the words are there; it does not make them true, or prove the speaker meant them as quoted.
From the source’s own text.
“a TF-IDF classifier ranks harm better than the original Latent Guard in every model we test, and linear and MLP probes do about as well as sentence-embedding classifiers trained on the same examples.”
“The representation just before generation detects more, catching 44 percent of harmful prompts at a matched false-alarm rate against 32 percent for the refusal of the model, but that gain follows the refusal decision itself”
How the finding was reached
In our words, from the source. Weigh the finding by how it was made.
- What was done
- Out-of-distribution prompts made by rewording harmful and benign requests with surface rewording, persuasive framing and jailbreak-style wrappers; 15 instruction-tuned LLMs and 38 activation-based readers compared with TF-IDF and sentence-embedding classifiers, independently trained safety classifiers, and each model's own refusal.
- What it found
- At the end of the instruction, the representation is largely independent of refusal but degrades under shift, so a TF-IDF classifier ranks harm better than the original Latent Guard in every model tested. Just before generation, readers catch 44 percent of harmful prompts at a matched false-alarm rate against 32 percent for refusal, but the gain follows the refusal decision.
- What it does not show
- Only the abstract was read; the paper's own limits were not seen. Results concern the tested prompt rewrites and models.
- Status
- A preprint: not yet peer reviewed
The record
- Questions
- Are AI companies putting stronger safeguards into practice? · Can AI systems act beyond what people intended or allowed?
- People
- Abhishek Mishra (Wrote it) · Sagnik Chatterjee (Wrote it) · Suyash Maniyar (Wrote it)
- What we read
- We read the abstract.
- Found by
- The Radar, run of October 23, 2026, via
arxiv-ai-safety-query(tier 1: the source’s own channel or an official record) - Cite this
- arXiv, “Faithful Latent Harm Monitors Work No Better Than the Models Own Behaviour at a Matched False Alarm Rate”, October 22, 2026. Entry in the Ctrl AI Base, https://ctrlai.com/base/arxiv-2026-10-22-latent-harm-monitors-refusal