No Training Needed to Catch Policy Breaks: Whitened Activations Give Qwen2.5-7B 86.0% F1 on DynaBench
Synopsis
Organizations checking whether an LLM reply breaks internal policy have relied on fine-tuned detectors or a second LLM judging each exchange, both costly to train and to run. The new approach recasts violation detection as out-of-distribution detection in activation space: a whitening transform estimated from policy text and a few examples standardizes compliant hidden states, and the Euclidean norm of the whitened vector is compared with a calibrated threshold. On the DynaBench test set with a Qwen2.5-7B-Instruct backbone, F1 reaches 86.0%, above the fine-tuned detectors and LLM-as-a-judge baselines listed in the comparison table.
Interpretation
Policy compliance is checked in the model's internal hidden states during generation rather than only in the text it writes. Earlier guardrail mechanisms target predefined safety categories and do not scale to custom, context-sensitive organizational rules, while LLM-as-a-judge and fine-tuned compliance detectors add substantial training and inference latency. On the DynaBench test set, the method with a Qwen2.5-7B-Instruct backbone reaches 86.0% F1, above the fine-tuned DynaGuard-8B at 73.1% and the LLM-as-a-judge GPT-4o-mini at 70.1% in the same table.
The detector treats compliant replies as one distribution and violations as samples that depart from it. Whitening estimates the mean and covariance of in-policy activations, decorrelates and standardizes them so dimensions are comparable, and scores the Euclidean norm over the top-K principal components. Across the twelve DynaBench policy categories, 100 contrastive examples per category are split 80/20, whitening statistics use only the in-policy samples, and the mixed remainder selects the layer and threshold; on Llama-3.1-8B, 100 samples per category give 75.6% F1 and 750 samples raise it only to 79.1%.
The same whitening score can be applied to the hidden states of an already fine-tuned detector instead of reading its generated label. The DynaGuard models normally classify through generated output, and switching to their internal activations raises the score. DynaGuard-1.7B rises from 65.2% with generation to 77.6% with whitening, DynaGuard-4B from 72.0% to 78.5%, and DynaGuard-8B from 73.1% to 80.6%.
Perspective
The demonstrated setting is the DynaBench multi-turn dialogue test set and airline-domain policies from τ-bench, with backbones Mistral-7B-Instruct-v0.2, Llama-3.1-8B-Instruct, Gemma-2-9B-it, Qwen3-8B and Qwen2.5-7B-Instruct; DynaBench interactions are processed by an observable surrogate model because the original generators' activations are unavailable. The authors propose using activation signals to steer generation toward compliant behavior as future work.
The authors state that training-free means no gradient optimization or parameter updates, yet a small labeled set is still needed to select the layer and set the threshold, and performance may degrade when calibration data does not represent the deployment setting. On real τ-bench trajectories the automatically calibrated threshold gives F1 of 0.67 with AUC of 0.87, and recalibrating the threshold with about 14 labeled trajectories raises F1 to 0.86. A systematic evaluation of low-false-positive operating regimes is left as future work.