Elad David

LLM agents use activation probes as runtime monitors for prompt injection, jailbreaks and unsafe requests, reading the model's own hidden state. A cheap move appends a short classification instruction after the user's turn so the model represents the request as a class, concentrating the signal the probe must separate. Under strict leave-one-dataset-out evaluation across 13 safety benchmarks and three open-weight model families, a classification suffix consistently beats no suffix on a single-position probe, improving out-of-distribution detection by up to about 4 AUC points, and the gain comes from the classification format rather than the named criterion.

LLM agents use activation probes as runtime monitors for prompt injection, jailbreaks and unsafe requests, reading the model's own hidden state. A cheap move appends a short classification instruction after the user's turn so the model represents the request as a class, concentrating the signal the probe must separate. Under strict leave-one-dataset-out evaluation across 13 safety benchmarks and three open-weight model families, a classification suffix consistently beats no suffix on a single-position probe, improving out-of-distribution detection by up to about 4 AUC points, and the gain comes from the classification format rather than the named criterion.