Layer-wise linear probing
Token-level activations are mean-pooled, and an L1-regularized harmful-versus-safe probe is fit at each layer.
Motivation
Guard models are typically fine-tuned from general-purpose LLMs and generate safety verdicts from the terminal layer. We ask whether safety-relevant information distributed across intermediate layers can support a more accurate harmfulness detector while the underlying model remains frozen.
Method: safety neuron identification and adaptive aggregation
SIREN (Safeguard with Internal REpresentatioN) selects task-relevant coordinates within each layer and combines them according to layer-wise validation performance.
Safety neuron selection
Coordinates are ranked by probe-weight magnitude, and the smallest set that reaches the cumulative threshold is retained.
Adaptive neuron aggregation
Selected activations are weighted by each layer’s validation F1, concatenated, and passed to an MLP classifier.
Experiments and results
We compare SIREN with Qwen3Guard and LlamaGuard3 models built from the corresponding Qwen and Llama backbones. Values are mean macro-F1 over seven prompt- and response-level safety benchmarks.
4 / 4
higher mean F1 in all four backbone pairs
+15.0
largest macro-F1 point gain
250×
fewer trainable parameters on 4B
>4×
fewer inference FLOPs
Each comparison uses the same base model architecture: the published guard is safety fine-tuned and generates a verdict, whereas SIREN fits a compact classifier over the frozen base model’s internal representations. SIREN achieves the higher mean macro-F1 in every pair, with the largest gain on Llama-3.2-1B.
View full benchmark table
| Backbone | Method | ToxiC | OpenAI Mod | Aegis | Aegis 2.0 | WildGuard | SafeRLHF | BeaverTails | Avg. |
|---|---|---|---|---|---|---|---|---|---|
| Qwen3-0.6B | SIREN | 81.6 | 91.3 | 82.4 | 82.1 | 86.5 | 91.6 | 83.5 | 85.6 |
| Guard | 82.0 | 75.9 | 78.8 | 82.0 | 89.1 | 86.9 | 77.1 | 81.7 | |
| Llama3.2-1B | SIREN | 80.0 | 92.9 | 82.1 | 82.7 | 86.5 | 92.0 | 83.7 | 85.7 |
| Guard | 63.3 | 67.5 | 59.5 | 72.6 | 78.6 | 83.3 | 70.0 | 70.7 | |
| Qwen3-4B | SIREN | 83.5 | 91.2 | 82.9 | 83.4 | 88.3 | 93.2 | 84.3 | 86.7 |
| Guard | 84.9 | 78.3 | 78.2 | 82.5 | 90.6 | 89.2 | 80.1 | 83.4 | |
| Llama3.1-8B | SIREN | 83.1 | 92.0 | 82.9 | 82.9 | 86.7 | 92.5 | 83.8 | 86.3 |
| Guard | 72.2 | 85.3 | 67.1 | 78.0 | 81.3 | 86.2 | 68.8 | 77.0 |
Inference cost
Generative guards process the input and then decode a verdict token by token. SIREN uses one forward pass through the frozen base model, followed by its lightweight classifier.
Qwen3 0.6B
SIREN155B
Guard785B
Llama3.2 1B
SIREN257B
Guard1.31T
Qwen3 4B
SIREN1.03T
Guard5.22T
Llama3.1 8B
SIREN2.05T
Guard10.4T
FLOPs per sample · 128-token input · four-token guard verdict · each pair normalized to its matched guard
Generalization and streaming detection
We evaluate SIREN on unseen reasoning traces and apply the same complete-sequence classifier to every prefix of a response, without streaming-specific training.
for the 8B models
Response prefix
Let’sinspecttherequest.Itasksforrestrictedinstructions.Iwillprovidethem.
Harmful signal detected in the current prefix.
Illustrative example; scores are not a measured trace.