Autonomous systems are increasingly built on large language models (LLMs), yet the safety layers that surround these models add latency and computational overhead, limiting their use in resource‑constrained, time‑critical scenarios. Existing external guardrails only see inputs and outputs, leaving a fundamental assurance gap because they cannot access the model’s internal state. We ask whether the model itself already knows when its output is harmful.
To answer this, we extract hidden‑layer activations from LLaMA‑3.1‑8B and train a lightweight MLP probe (12.6 M parameters) to classify harmful prompts. The probe is trained on publicly available safe/unsafe datasets without modifying the base model. We evaluate on three benchmarks—WildJailbreak, Beavertails, and AEGIS 2.0. The probe achieves F1 scores of 99% on WildJailbreak and 83%/84% on Beavertails and AEGIS 2.0, respectively, matching the performance of guard models that are up to 1000× larger while drastically reducing latency and compute cost.
These results demonstrate that LLMs already embed latent signals for harmful content detection, and that a small probe can exploit these signals for efficient safety monitoring, offering a practical solution for constrained deployments.
Review