AIAI safetyStory 04
Internal safety monitors miss rewritten harm
What changedResearchers tested 38 activation readers across 15 instruction-tuned models on harmful requests rewritten with persuasive and jailbreak-style language. The internal signals weakened under that shift, and a simple word-based classifier ranked harm better than the original Latent Guard in every tested model.
The useful part
Why it matters
Looking inside a model does not automatically make a safety check robust to new wording.
Keep in mind
Good to know
This evaluation covers selected readers and prompt shifts, not every possible form of latent monitoring.
Evidence