One classification line after the user turn lifts activation-probe detection by up to about 4 AUC points across 13 safety benchmarks
Synopsis
LLM agents use activation probes as runtime monitors for prompt injection, jailbreaks and unsafe requests, reading the model's own hidden state. A cheap move appends a short classification instruction after the user's turn so the model represents the request as a class, concentrating the signal the probe must separate. Under strict leave-one-dataset-out evaluation across 13 safety benchmarks and three open-weight model families, a classification suffix consistently beats no suffix on a single-position probe, improving out-of-distribution detection by up to about 4 AUC points, and the gain comes from the classification format rather than the named criterion.
Interpretation
Appending a classification instruction after the user's turn makes an activation probe better at separating malicious from benign inputs on attack types it never saw in training. Without a suffix, the probe reads the hidden state at the user turn; such suffixes were treated as an optional sharpening step, and whether their wording matters or their benefit holds out of distribution had not been systematically tested. Across 13 safety benchmarks covering jailbreak, injection and benign chat, and three open-weight model families (Llama-3.1-8B, Qwen3.5-9B, Gemma-4-12B), strict leave-one-dataset-out evaluation shows a classification suffix improving a single-position probe by up to about 4 AUC points over no suffix.
What helps is the classification format itself, not the criterion named in the suffix. An off-topic suffix, or one that merely directs attention, helps little, so the gain cannot be attributed to having an extra instruction or extra attention. A content-free suffix matches the real malicious/benign criterion, with the named criterion adding precision only at strict thresholds.
The benefit is not confined to single-position reads and carries over to the multi-position pooling probes used in production. A single-position probe reads the hidden state at one location, whereas attention, multi-max and MLP pooling aggregate several positions, and the two need not behave alike. The gain appears on attention, multi-max and MLP pooling probes, though the best-performing suffix there is readout-dependent.
Perspective
The findings rest on 13 safety benchmarks covering jailbreak, injection and benign chat, and on three open-weight model families (Llama-3.1-8B, Qwen3.5-9B, Gemma-4-12B), evaluated with strict leave-one-dataset-out splits against attack types unseen in training. The intended users are agent deployers running activation-probe monitors, with the suffix served through a KV-cache fork.
The gain is not automatic: which suffix helps, and by how much, depends on the model and the readout, and on multi-position pooling probes the best-performing suffix varies with the readout. The named criterion adds precision only at strict thresholds and otherwise matches a content-free label.