LLM Safety From Within: Detecting Harmful Content with Internal Representations

2026-04-20

AI Summary

Current safety detection methods for large language models rely solely on terminal-layer representations, overlooking the rich safety signals embedded in internal layers, which limits their generalization and efficiency. This work proposes SIREN—a lightweight framework for harmful content detection that systematically leverages multi-layer internal representations for the first time. SIREN identifies safety-relevant neurons via linear probes and introduces an adaptive layer-weighting strategy to fuse features across layers, enabling the construction of an efficient detector without modifying the original model. Notably, SIREN operates without requiring text generation and supports streaming inference. It substantially outperforms existing open-source safety classifiers across multiple benchmarks, achieving 250× fewer parameters while demonstrating superior generalization to unseen data and higher inference efficiency.

Technology Category

• Natural Language Processing: Safety and Robustness
• Machine Learning: Large Multimodal Models (LMMs)
• Computer Vision: Large Vision Models

Application Category

• Search and Retrieval-Augmented AI: Large language models for search
• Web Mining and Content Analysis: Large pretrained models with web data
• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs

Abstract

Guard models are widely used to detect harmful content in user prompts and LLM responses. However, state-of-the-art guard models rely solely on terminal-layer representations and overlook the rich safety-relevant features distributed across internal layers. We present SIREN, a lightweight guard model that harnesses these internal features. By identifying safety neurons via linear probing and combining them through an adaptive layer-weighted strategy, SIREN builds a harmfulness detector from LLM internals without modifying the underlying model. Our comprehensive evaluation shows that SIREN substantially outperforms state-of-the-art open-source guard models across multiple benchmarks while using 250 times fewer trainable parameters. Moreover, SIREN exhibits superior generalization to unseen benchmarks, naturally enables real-time streaming detection, and significantly improves inference efficiency compared to generative guard models. Overall, our results highlight LLM internal states as a promising foundation for practical, high-performance harmfulness detection.

Problem

• LLM safety
• harmful content detection
• internal representations
• guard models
• safety neurons

Innovation

• internal representations
• safety detection
• linear probing
• adaptive layer weighting
• lightweight guard model