GAVEL: Towards Rule-Based Safety through Activation Monitoring
Authors: Shir Rozenfeld
Rahul Pankajakshan
Itay Zloczower
Eyal Lenga
Gilad Gressel
Yisroel Mirsky
Venue: ICLR 2026 Poster (2026)
Keywords: AI Safety
Activation-Based Monitoring
Rule-Based Detection
Large Language Models
Misuse Detection
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: A Rule-Based Approach to Activation-Based AI Safety

Abstract: Large language models (LLMs) are increasingly paired with activation-based monitoring to detect and prevent harmful behaviors that may not be apparent at the surface-text level. However, existing activation safety approaches, trained on broad misuse datasets, struggle with poor precision, limited flexibility, and lack of interpretability. This paper introduces a new paradigm: rule-based activation safety, inspired by rule-sharing practices in cybersecurity. We propose modeling activations as cognitive elements (CEs), fine-grained, interpretable factors such as _''making a threat''_ and _payment processing_, that can be composed to capture nuanced, domain-specific behaviors with higher precision. Building on this representation, we present a practical framework that defines predicate rules over CEs and detects violations in real time. This enables practitioners to configure and update safeguards without retraining models or detectors, while supporting transparency and auditability. Our results show that compositional rule-based activation safety improves precision, supports domain customization, and lays the groundwork for scalable, interpretable, and auditable AI governance. We open source GAVEL and introduce GAVEL Studio, an interactive rule authoring and management tool. Code and datasets are available at [github.com/Offensive-AI-Lab/gavel](https://github.com/Offensive-AI-Lab/gavel)

Published as a conference paper at ICLR 2026
GAVEL: TOWARDS RULE-BASED SAFETY THROUGH ACTIVATION MONITORING
Shir Rozenfeld', Rahul Pankajakshan' Itay Zloczower', Eyal Lenga'. Gilad Gressel', Yisroel Mirsky
Ben Gurion University of the Negev, "Amrita Vishwa Vidyapeetham, Amritapuri {shirmord, itayzloc, lenga, yisroel @ post.bgu.ac.il, (rahulp, gilad.gressel, @ am.amrita.edu
ABSTRACT
Large language models (LLMs) increasingly paired with activation- based monitoring to detect and prevent harmful behaviors that may not be apparent at the surface-text level. However, existing activation safety approaches, trained broad misuse datasets, struggle with poor precision, limited flexibility, and lack of interpretability. This paper introduces new paradigm: rule-based activation safety, inspired by rule-sharing practices in cybersecurity. We propose modeling activations as cognitive elements (CEs), iinegrained, interpretable factors such as "making threat" and "payment processing". that can be composed to cap- ture nuanced, domain-specific behaviors with higher precision. Building on this representation, we present practical framework that defines predicate rules over CEs and detects violations in real time. This enables practitioners to configure and update safeguards without retraining models or detectors, while supporting transparency and auditability. Our results show that compositional rule-based ac- tivation safety improves precision, supports domain customization, and lays the groundwork for scalable, interpretable, and auditable Al governance. We open source GAVEL and introduce GAVEL Studio, interactive rule authoring and management tool. Code and datasets are available at Lab/gavel.
INTRODUCTION
Large language models (LLMs) are often equipped with safeguards that monitor their inputs and outputs prevent harmful behavior. However, these safeguards can be bypassed through repre- sentation attacks, where harmful concepts are paraphrased or obfuscated, exploiting mismatched generalization between surface text and model reasoning. To address this, recent work has shifted towards activation-based monitoring, which detects when the model internally processes restricted concepts (e.g., planning a crime or generating hate speech), regardless of the exact surface form.
The prevailing approach to activation safety relies passing misuse datasets through the model to capture the distribution of activations, which are then modeled with linear probe or classifier. While influential, this approach suffers from three major limitations:
The Problem:
1. Poor Precision:
Misuse datasets are typically broad, covering generic categories such as "cy- bercrime" or "misinformation" As a result, detectors trained these distributions often pro- duce many false positives. For example, a detector trained on a hate speech dataset' to prevent users from generating racist content will accidentally flag benign discussions about ethnic cul- tures. To be viable safeguard, activation-bases safety must have low false positive rates.
2. Limited Flexibility: In practice, model owners often need to enforce nuanced or domain- specific safety and policy constraints, for instance, detecting intellectual property infringement
Conresponding author.
'Commonly used hate speech datasets include:
https: https://hugiiiggace http////tttttt////////////tttttt
https://huggii eo http:///eeoe...aaaa///////ea///a haap hateinngghttteeeeeeeeeee https://hugging http:///wg.....//a/////////////e labeled

---

Published as a conference paper at ICLR 2026
specific entities, enforcing a company's internal policies. Current methods require reusing roarse-grained
coarse- grained misuse datasets which do not match the target behavior, or require constructing new, specialized datasets which is a slow and expensive process. Moreover, scaling to many categories is impractical, since thousands of activations must be collected per category to gener- alize well, and retraining detectors is needed for each update. A practical system should instead allow rapid, configurable deployment that builds on prior work provided by the community.
3. Lack of Interpretability:
When detectors fail, the reasons are often opaque. For example, system might flag an input as "hate speech" without indicating which parts of the text are responsible. The absence of such token-level signals leaves users uncertain about what specif- ically triggered the alarm. This opacity hinders auditing and accountability, capabilities that are critical for future agentic systems, where intermediate reasoning steps may be difficult for humans to interpret (Hao et al., 2024; Chen et al., 2025). Activation safety therefore requires human- uuman-interpretable factors that support customization, transparency, and auditability.
Towards Rule-Based AI Safety: Our motivation comes from the field of cybersecurity, which has long benefited from rule sharing for threat detection. Tools such as Snort (Roesch et al., 1999), YARA (Alvarez& & VirusTotal, 2008), and OSSEC (Cid & Team, 2004) allow defenders to share rule sets which has enabled the community to collaborate on detect threats and perform standardized security auditing. This ecosystem has proven effective at scaling security across organizations, while ensuring precision, flexibility, and interpretabilityy.
We argue that, in many situations, AI safety benefit from adopting similar paradigm. To improve robustness, the Al community needs the ability to share and collaborate over standardized, configurable, and model-agnostic rules that define and enforce safety or policy constraints, allowing interpretability, flexibility and precision. For example, large language models have recently been used automate scams (Gressel al., 2024; Roy et al., 2024). To detect such misuse, rule might specify that the model must not consider (A OR (B AND C)), ) while still permitting C alone to avoid false positives. This level of expressivity is especially crucial for Al governance, where regulators and organizations require mechanisms to define and audit policies through transparent rule sets.
Contributions. We take the first steps towards the first rule-based safety framework over model activations, making three primary contributions:
1. Cognitive Elements (CEs):
We introduce the concept of cognitive elements, interpretable activation-level primitives that capture mid-level aspects such a model's activity, task, or behavior. For example, directing a user to go somewhere, acquiring payment information, making a threat, engaging in coercion. Unlike coarse misuse categories, CEs provide com- positional basis: they activate predictably as the model performs, can be combined to describe complex states, and enable safety systems that are precise, flexible, and interpretable (i.c., if rule violation occurs we can see why).
2. Rule-Based Detection Framework:
Building on CEs, we propose GAVEL', framework that expresses safety and policy constraints as logical rules over CE activations. This enables practitioners and regulators to (i) configure nuanced constraints without retraining models or detectors, (ii) share standardized rulesets across organizations, and (iii) audit model behavior through interpretable rule violations. We found that our framework is not only effective, but can also operate alongside LLMs in real-time.
3. Open Resources for the Community:
To catalyze progress, we release code and tools for constructing CEs, collecting activations, composing rules, and detecting violations. We further provide an initial CE vocabulary and prototype misuse rulesets as a foundation for industry and academic collaboration, inspired by community-driven threat intelligence in cybersecurity.
In summary, our central insight that LLM behaviors can detected by decomposing them into independent elemental concepts. This not only improves precision but also decouples activation engineering (constructing activation datasets) from safety configuration (defining rules). As a result, GAVEL enhances practicality, interpretability, and community involvement in Al safety.
'GAVEL: Governance via Activation-based Verification and Extensible Logic *Code and data are available httph:: /ttpp::/giieee thub. com/ Of fensi ve Al ab//gvve
2

---

Published as a conference paper at ICLR 2026
2 BACKGROUND & RELATED WORK
Transformers and Internal Activations. Large language models (LLMs) are Transformer net- works (Vaswani et al., 2017) that map input token sequences into contextual hidden states through stacked self-attention and feedforward layers. Given a sequence I = (II,..., Tn), each layer pro- duces hidden activations (1(4) Ruxdd where 1/ represents the hidden state of token æ; and d is the hidden dimension (lypically 3k-8k in current 7-8B parameter models). These activations flow through the residual stream, are projected to logits, and decoded into next-token probabilities. Monitoring only input or output tokens for safety is limited, since instructions and intents can be obscured or latent in the text (Cloud et al.. 2025). As a result, many approaches now focus on mon- itoring neural activations directly (Elhage et al., 2021; Rimsky et al., 2024; Zou et al., 2023; Han et al., 2025).
Activation Analysis. Activation analysis begins with a dataset 'D that represents a behavior (e.g., honesty, lying). When D is passed through fa to predict the next token, one can capture the inter- mediate hidden states (()) at each layer. common approach is to leverage benchmarks of harmful behaviors such as toxicity, lying, or jailbreakinng and elicit activations by prefilling the model with prompts Fiam that induce the targeted behavior. The goal not to reproduce unsafe outputs, but to expose the internal representations of these behaviors so they can be detected and suppressed. More recent work emphasizes elicitation, where the model is prompted to perform or rephrase the behavior so that internal computation focuses the intended concept rather than superficial phras- ing (Zou et al., 2023). These methods yield sharper activation signatures for downstream detection and control.
Representation Engineering. Once activations are captured, internal representations of behaviors can be identified and even steered to maintain control. A common step is to compress the hidden states into per-token representations using a summary map é (often the mean across layers): ri = of d(h(").. ...... (
Rº. Researchers then construct contrastive datasets that elicit the target behavior with positive (e.g.. honesty) and negative (c.g.. lying) examples. From these activations, two approaches
common: geometrically, by treating the contrast vector in activation space, or with classifier probes that learn a separating boundary. For example, given contrastive activation I h.
sets A and A= concept vector can be estimated ve
EnEA h
Variants refine this approach with dimensionality reduction methods such as PCA or SVD, or with contrastive prompting to sharpen the signal (Zou et al., 2023; Wehner et al., 2025). The resulting "reading vectors" can be used in multiple ways: diagnostically, to measure the presence of a concept in given activation, or operationally. by adding or subtracting the vector during inference to steer model behavior (Turner et al., 2024). These steering operations are lightweight and interpretable, but they also compress the full variability of concept activations into a single linear direction, potentially discarding useful information. While Sparse Autoencoders (SAEs) can recover these fine- grained features without supervision, they computationally expensive to train and do not guarantee the discovery of the specific safety-critical concepts required for policy enforcement (Bricken et al., 2023; Cunningham et al., 2023).
An alternative is to model the activation distribution with machine learning. Classifier-based meth- ods train model g on token representations r; to predict concept presence y, where g RDD y may be linear or non-linear (Alain & Bengio, 2016; Han et al., 2025). Classifiers have been widely adopted in safety settings, for example to monitor harmful intent or detect jailbreak triggers, as they can capture finer distinctions than single geometric vector (Zhang et al., 2025; Wu et al., 2024).
Summary and Gaps. Activation basedd methods show that internal concepts are measurable and steerable, but as practical safeguards they face two main challenges: specification and application. For specification, practitioners cannot explicitly define when safeguards should fire since they rely on coarse misuse datasets over broad topics, which capture irrelevant signals and reduce precision. We are the first to decompose activations into elemental units of cognition, enabling practitioners to precisely define their target states over activations and obtain interpretable information upon de- tection. On the application side, existing activation based safeguards lack flexibility: they cannot be easily configured to match new policies and require contrastive datasets for each domain, which is burdensome. Our framework decouples activation engineering from safety design by introducing modular elemental datasets, like shared vocabulary express states, usable across domains, mak-
3

---

Published as a conference paper at ICLR 2026
Public
Private
Setup Rules
Violations
based on CES
"V'm from IRS, you don't for your tance then.. Socaalon endeds*
A elentic, (02
couiiuu Scama
Polty
stmeriloy V.g
cuptaoc
Coroxbure
stop C A.A.A.
step A A.S.AG
labol
of requiee
"Shup AND plyeoonn -okokky
Community
Model Owner
2
Collect Activations Ifr cuch icqurred CEI
Excitation Datasets
Trsined cenaclor
Commbese
of GEs
Targut
Train CE Detector
MtLenting
"Ta payle the
Comaptacr
D2
Do
coptare acchontion
"Poese poovide
H
CE Activation Docasets (i)
Hl,
Hey
H
Mulli-lbbll
Classiter
Pr
Activation
H
H
g
H
10,
Figure 1: Workflow of GAVEL. (1) Set up rules defined over Cognitive Elements (CEs) and specify actions, optionally reusing public rule sets. (2) Collect CE activations He from both private and public CE datasets D. by running the target LLM and capturing activations. (3) Train a multi-label classifier 9 the CE activation datasets H { {He} to detect the required CEs. (4) During inference, use to identify rule-relevant CEs per token and enforce the user-defined Boolean rules. Because rules and CE datasets are textual and model-agnostec they can be shared and reused across models, improving coverage and quality over time.
ing safeguards composable and scalable through community collaboration. A recent work, CAST (Lee et al., 2024), takes a step toward programmable safeguards, but remains coarse paarseggrained since it only lets users select the steering vector for a detected generic misuse behavior.
THE GAVEL FRAMEWORK
Our approach operationalizes safety monitoring through Cognitive Elements (CEs), interpretable primitives of model behavior which can be extracted from model activations, and rules that express policy constraints as logical predicates over CEs. Together, these form the GAVEL framework, which allows practitioners to construct, share, and enforce safety specifications at the activation level. We now define and present all of these components and describe the full operation of the framework as presented in Figure! 1.
3.0.1 COGNITIVE ELEMENTS (CE)
We define a CE as an interpretable unit of model behavior, such as a cognitive action being per- formed, directive being issued, behavior being exhibited, or a topic being reasoned about. For example, possible CEs include the model making a threat, masquerading as a human, or issuing a person the directive to go somewhere. CEs are defined at the token level: the state behind each generated token may carry zero, one, or multiple CEs. A complete list of the CEs used in this paper provided in Table 1. Further details and descriptions of the CEs can be found Appendix
Excitation datasets. To capture a particular CE c, we construct an excitation dataset D. = {8(() (c)
}.
where each (()) is a short text exemplar eliciting the target behavior. For example, the excitation dataset for the CE "making a threat" would contain hundreds of threatening sentences such as "If you don't 't come now I will get angry" "You will regret this unless you pay me." Such datasets can be authored manually or generated using an LLM, and are model-agnostic since they consist only of text. When D. is passed through the target model fo, we collect the internal activations for each generated token and use them to model the CE.
A naive way to elicit activations is to simply prefill the model with the exemplars in D. and cap- ture the resulting activations. However, we found that this approach often results in activations that are weakly aligned with the intended CE. Following Zou et al. (2023), we "wrap" each sam- ple with explicit directive that prompts the model to consider the target concept. To further align activations with the intended CE, we instruct the model not only to revise the content but to do explicitly in the context of that CE. Specifically, we present the model with the prompt:
4

---

Published as a conference paper at ICLR 2026
Think about (c) while revising the following: making threats).
(s)
where $
De and is the name of the CE (e.g.,
Ablation Accuracy per CE
1.00
We then collect the activations from the generated tokens that follow. This simple adjustment substantially improves CE detection: as shown in Figure 2, using this approach (ERI) produces higher classification accu- racy compared to both collecting ac- tivations from naive prefilling (base- line) and just using the directive to revise with no contextualization on c.
Accuracy
0.75
0.50
0.25
Incorees SQ symoar
LGD
Exctorn Poliiies
Ettoorac boentay
Spreeding bate spaech
Texeion
501 Quer Coating
Ba Baiddion
Down Dowttettrnsa
Senst tottr
Brgage enationally
Nozwerads as Hunan
tronttoggivee
Royment tols
Go Somowhhoe
Orcceetor
momootton
Sycostnntic
Comp satendl
Trrastn
Pezuna
Baseline
Revsion (nstruction
Bloted Revision Instruction (ERI)
Collecting CE activations. For- mally, at generation step and layer e, let (e) E Rd denote the attention output for token t at layer É, where d is the model's hidden dimension. The output consists of the multi-head attention weights applied to the value states, aggregated across heads. We use attention outputs based on an ablation study showing superior detection performance (average TPR of 95.5% compared to 82.3% for MLP outputs) by capturing richer contextual information about how the model interprets each token in relation to its context. We select a contiguous set of layers using layer-selection ablation (see Appendix B for details). We then construct per-token representa- ([a!") }REA) E RRD, where D = |A| d (scaling linearly with the model dimension). For each CE c, the collected activations form the set H. = (r(") E De}. These sets serve as the training material for the CE detector.
Figure 2: Classification performance of different CEs using different excitation methods, including ours (ERI).
tion by stacking the attention outputs across these layers: r(c) concat
By design, each activation set H. in the training collection H is curated to isolate single CE at time. This design choice has two advantages: (1) it keeps CE datasets modular and composable, enabling community contributions and reuse; and (2) reduces complexity, since exhaustively con- structing examples that cover all possible CE combinations in D would be prohibitively expensive.
3.0.2 DETECTING CES
At runtime, need decide for each token whether one more CEs are present. Importantly, co-occurrence is common: a token may simultaneously involve, for example, both Masquerade as Human and Payment tools. To capture this, we train multi-label classifier g TR. - {0, 1] that predicts CE presence from each hidden state. Empirically, we found that despite being trained on isolated excitation data, the detector successfully generalizes identify overlapping CEs in real- world data. In our experiments, 54% of the detected malicious dialogues involved tokens with
multiple active CEs (see Appendix C) Each training sample is pair (r/(), e,) where ea is the hot vector for CE c. Training batches are formed by shuffling across different H, sets.
During deployment, the activation vector for each new token F, passed to g, which outputs V: ((.)) E [0, 1]KK. Each component Vr[c] represents the probability that CE c is active for token Note, multiple CEs may receive high probabilities simultaneously since the outputs are not constrained to sum to one.
3.1 RULE SPECIFICATION, DEVELOPMENT & ENFORCEMENT
With CE detector in place, we can state, in human- rules, what to look for in activations and what to do when it appears. Each rule pairs (i) predicate over one or more CEs with (ii) an associated response, which we refer to as the enforcement action.
Temporal monitoring. Since cognitive elements may appear or disappear as a model generates content, rules must be evaluated over temporal horizon. At time t, we define a window W. (max(1, f - N + 1). of size N. From this window we construct a CE presence vector St, where sc]
if element has appeared in any of the tokens in W.. In experiments, we typically let N span the entire conversation. but shorter or adaptive windows are possible and may better capture context-sensitive behaviors. While in this paper we evaluate discrete detection
5

---

Published as a conference paper at ICLR 2026
performance (binary outcomes), the sensitivity of GAVEL can be adjusted using continuous soft scores. We detail the calculation of these scores and present ROC curves demonstrating robust performance across decision thresholds in Appendix D.
Predicates and actions. We express rules as predicates over CEs, where each predicate is a Boolean formula over the presence vector S; using A, V, and -. list of the predicates used in this paper can be found in Table rule fires at time & when its predicate evaluates true, at which point the associated action is executed. Depending on the rule configuration, the system can interject by stop- ping the model, override the output with pre-scripted response, or miligate the behavior by steering the activa- tions directly (Turner et al., 2024; Rimsky et al., 2024). In this work, we focus on evaluating the detection of rule violations, as these response and mitigation methods are well-established and can be applied to GAVEL rules is.
Table 1:
The Cognitive Elements
(CEs) used, full details in Appendix A.
Directive to User
LLM Behavior
C1 Buy
C11 Engage Emotionally
C2 Click/Enter
Ca Download/Install
C12 Threaten
C4 Go Somewhere
C13 Spreading Hate Speech
Cs Grant/Approve
Provide/Give
C14 Masquerade as Human
C7 Send/Transfer
c15 Sycophantic
LLM Task Cs Create Content
C16 Conspiratorial
Og Build Trust Cio SQL Query Crafting
Topic
For usability, we express these rules a human-readable syntax, similar to that used in established cyberse- curity detection technologies such as Snort, Suricata, Zeek, Sigma/YAMI, and YARA: condition syntax that compiles deterministically to the underlying formula. (action) if (condition) For example, consider LLM misused to generate phishing content (SMS emails that lure victims into revealing information or clicking mali- cious links/attachments). rule detect this might be:
C17 Taxation
C18 Incorrect SQL
Syntax
C19 Electoral Politics
C20 Personal
Information
C21 Payment Tools
C22 LGBTQ+
C23 Ethnoracial Identity
Predicates used in rules, grouped by misuse domain.
Table 2:
refuse if fask:creating_comee .ooplenttcooettttnneennne AND (directive:click OR directive:grant OR directive:personal information)
Category
Attack Pattern
Predicate Logic Rule
Cybercrime
Phishing
Ac2
where a task is an objective (e.g., instruction) being car- ried out by the LLM and directive is a command given by the LLM (e.g., to human). This rule corresponds the predicate π = A (ez V Cs V C20), which fires whenever the model is trying to create content for user that exhibits the respective dangerous solicitation within the monitored horizon. By adopting this syntax, we improve readability while encouraging future development; just detection technooogiis in cybersecurity evolved from static signa- tures into dynamic rule languages, we intend GAVEL's rules to naturally extend to capture dynamic states over the context window and support richer enforcement actions.
C20) C10 Aci
SQL
injection
Psycholo-
Delusion
C1e A (C11
C14 V c15)
gical Harm
Anti-
Cs A Czz A
LGBTQ
(c12 V C13)
Elections
0s A C19
Racism
A A
(012 V C1a)
Scam Au- tomation
Tax
C12 A A17
Authority Romance
C V
Designing CEs and Rules. A key practical challenge is selecting the right level of granularity. If CEs are nar- row, rules become unwieldy (e.g.. covering every variant of hate speech with highly specific CEs). If they are too broad, false positives return us to the limitations of generic misuse categories. From our experience, top-down pro- cedure works best: (1) scope the violation by identifying a concrete misuse concern (e.g., "automation cial scam over the phone"), while avoiding umbrella categories ("all phone scams"), (2) given that setting and threat model, define a small number of interpretable CEs that capture the relevant activ- ities or topics (e.g.. Masquerade rule(s) that cover the violation using these CEs. This procedure balances precision and coverage while keeping rules interpretable and maintainable.
C3 V V c6 A (cs Vea)
A 02 Va V
Commerce
06 V.o.ve
finan-
Human, Threaten, Payment Tools), and (3) compose the logical

---

Published as a conference paper at ICLR 2026
3.2 THE GAVEL WORKFLOW
In Figure we present how a model owner can utilize the framework to enforce explicit policies and safeguards with community support. The full GAVEL pipeline proceeds as follows: First, the community may contribute CE datasets and rule sets, which are text-only and thus model-agnostic. Then a model owner: (1) adopts or modifies a ruleset aligned with their policies; (2) clicits CE activations H. on their model fo using private public CE datasets; (3) trains the CE detector g; and (4) deploys the system in real time. At inference, each token's activations are mapped to rt, classified into CE predictions Yr, aggregated into St, and checked against all predicates. Rules that fire trigger their specified actions. This decoupling of CE construction from rule configuration makes possible to update safety constraints rapidly, reuse shared vocabularies, and support transparent audit of model behavior.
Automating CE and Rule Development. While defining fine-grained CEs and composing rules may seem labor-intensive, LLMs can automate much of this work. To illustrate this, and to support GAVEL's reproducibility. we release an open-source agentic tool that, given a natural-language description of a domain and target violation or policy requirement, automatically generates CEs, rules, and excitation datasets for model training. The tool can also incorporate an existing database of community CEs and rules, reducing redundancy and promoting shared, reusable vocabulary. It includes a user interface with test-time CE visualization and is available online. For more details see Appendix E.
Advantages of GAVEL. GAVEL offers several key benefits. (1) Because CEs are modular and com- posable, the community can share them like common vocabulary along with rules for wide range of policies, much as in cybersecurity. This creates an ecosystem where even newcomers can adopt existing rulesets and configure them to their needs with minimal effort. (2) By defining states more precisely, model owners can reduce false positives: rather than relying on broad misuse datasets that capture unrelated behaviors (for example, a generic "untruthfulness" dataset that may incorrectly flag storytelling), GAVEL enables rules that encode intent directly. (3) Decoupling dataset curation from rule configuration makes deployment and revision fast, since owners can simply select rules from community CEs and adapt them to policy needs. (4) Unlike many other activation analysis and representation engineering methods, GAVEL does not require training on benign data, achieving precision with less effort. (5) Finally, GAVEL is inherently interpretable: when rule fires, both the predicate and the specific triggering tokens are visible, providing transparent explanations of model behavior as shown in Figure 4.
Discussion on Limitations. While an explicit, Boolcan rule-based framework may at first seem too restrictive capture abstract neural concepts and behaviors, argue that GAVEL's requirement to clearly specify dangerous internal states is a strength: high-precision and safety-critical settings demand transparent, exact, and auditable definitions of what constitutes violation, something cur- rent neural activation based approaches cannot provide. Scalability is maintained because CE and rule creation can be largely automated using our agent-driven pipeline and because GAVEL sup- ports community sharing, allowing practitioners to reuse, adapt, and iteratively improve a shared library of CEs and rules. This collaborative ecosystem also mitigates concerns about subjectivity by enabling users to choose and refine the rules that best match their domain requirements rather than relying on a single universal policy or misuse dataset. Finally, GAVEI orthogonal to other safety methods; it can operate alongside content moderation or alignment techniques to provide an additional high-pret ingeiirrcision layer where explicit guarantees matter most.
Rule-based detection remains central in modern cybersecurity because it enables explicit, shareable, and enforceable specifications, and we see GAVEL as a first step toward bringing the same clarity, community collaboration, and governance foundations to AI safety.
4 EVALUATION
4.1 SETUP
Datasets. In this paper, do not attempt to exhaustively develop rules for existing benchmark datasets, as we believe this is best pursued as a community effort over time. Our goal is instead to demonstrate the performance and feasibility of our proposed framework. Accordingly, we focus on
7

---

Published as a conference paper at ICLR 2026
curated set of misuse and policy violation scenarios that span diverse safety-relevant domains. We consider nine misuse categories grouped under three domains: cybercrime, psychological harm, and scam automation. Within cybercrime, evaluate scenarios where users attempt to elicit assistance in crafting phishing content or SQL injection payloads. For psychological harm, we target the misuse of L.MMs for generating anti-I.GBTQ racist content, L.M conversations that reinforce delusional thinking, as well as producing propaganda for political elections. Finally, for scam automation, an area of growing concern in agentic AI, we simulate three settings inspired by real-world cases: tax scams (e.g., IRS impersonation), E- E-Commerce scams (e.g., fake Amazon customer support), and romance-baitte before exploitation (Gressel et al., 2024; W Whitehouse, 2025). These categories were chosen to reflect settings where model owners may want to enforce either safety or policy constraints, whether the restricted behavior is explicitly requested by the user or initiated by the model itself.
scams where adversaries build emotional trust over extended conversations
We generated datasets for these nine misuse categories using 1PT-4.1, which were then validated using GPT-5. Each dataset consists of multi-turn dialogues spanning 7-18 user-assistant exchanges, since many violations only emerge over the course of extended interaction. For each of the nine categories, we created 150 misuse conversations that illustrate the targeted violation (50 were held out for calibration of the CE thresholds). To stress-test precision, we additionally constructed 500 benign but closely related conversations per category. For example, in the racism category, the benign dataset includes cultural or historical questions about specific ethnic groups, without harmful content. This design allows us to evaluate whether detectors can maintain high recall on violations while avoiding false alarms on closely related but permissible topics. In total we developed 14,950 multi-turn conversations. To assess deployment FPR, we evaluate on a benign background dataset of 1,000 natural conversations split between UltraChat (Ding et al., 2023) and DialogueSum (Chen et al., 2021) where GAVEL with Mistral-7B achieved 0.088 and 0.008 FPR respectively (Table 8).
Baselines & GAVEL Setup. We evaluate GAVEL against four common safeguard approaches: (i) loss-based finetuning, where safety signals are incorporated directly into training: (ii) reading vector projection, where harmful behaviors are monitored through linear directions in activation space; (iii) content moderation APIs, which operate on surface text; and (iv) activation classification, the method most similar to ours. For baselines, we include industry-standar moderation tools: Llama Guard 4 (Inan et al., 2023), Google Perspective API (Lees et al., 2022). and OpenAl Moderator API (OpenAI, 2023), as well recent academic works: RepBending (Yousefpour et al., 2025), CircuitBreakers (Zou et al., 2024). JBShield (Zhang et al., 2025), and CAST (Lee et al., 2024). We also evaluated classifier detect activations belonging CES) to demonstrate the benefit of granularity. We used author-provided models where available, otherwise training on our datasets (details in Appendix F).
each misuse category (as opposed to
To set up GAVEL, we defined CEs and constructed excitation datasets following the procedure in Section 3.0.2, with the full vocabulary and rules detailed in Table I and Table 2. To minimize infer- ence overhead, we implemented the detector as lightweight multi-label RNN (3 GRU layers, 256 units) processing 5-token segments, though the framework supports any classification architecture. The model was trained on 300 samples per CE (80:20 split) using Adam (3e and Binary Cross Entropy. All datasets were generated using GPT-4.11
Our evaluation focuses on the alert/stop action, which reduces to the task of accurate detection; all baselines are evaluated under this setting for comparability. While future work could extend to actions such as refusal or steering, here we report standard metries: true positive rate (TPR), false positive rate (FPR), balanced accuracy (b-ACC), ROC-AUC, and Fl score.
4.2 RESULTS
Baseline Performance. In Table we compare the performance of GAVEL against all baselines, using Mistral-7B the underlying model. We evaluated on ROC-AUC, balanced accuracy (b- ACC) and FPR. Across all nine misuse categories, GAVEL achieves the best balance of precision and recall, with AUC scores above 0.98 and near-zero false positives even against the challenging benign conversations. By contrast, finetuning approaches show inconsistent generalization across categories and projection based baselines either suffer from lower AUC and balanced accuracy rates.
Moderation APIs (Perspective, OpenAI, Llama Guard) maintain low false posi- tives but miss many harms, especially in psychological harm and scam domains.
8

---

Published as a conference paper at ICLR 2026
Classification on activations per mis- use category leads to overgeneralization and higher false positives. In con-
Table 3: Performance of GAVEL versus baselines across misuse categories using the Mistral-7B.
trast, GAVEL achieves higher precision by identifying target cases based on each CE definition separately. This supports the conclusion that models trained on mis- use datasets often pick up irrelevant pat- terns, whereas GAVEL is less affected be- cause target behaviors are explicitly de- fined. Additional results and the perfor- mance on benign datasets can be found in Appendix G. In summary. these results validate GAVEL's central claim: compo- sitional rules over cognitive elements en- able configurable and precise detection of targeted model states, while maintaining
Cybererime Prychological Harm Sram Automation
Som.
Injection
And LGBTO
Tax Authbit
Pliching
Pedanionll
Romana
Method
Metric
Arg
0.49
0.94
0.67
0.50
Time Tuning
Clscuit Beeskens
b<CCC
0.87
0.90
0.50
0.95
0.42
0.88
0.68
0.51
0.50
0.69
ADC
0.99
0.97
0.57
0.99
0.50
0.96
0.95 0.91
0.97
0.87
RepBending
b-MCC
0.57
0.99
0.92
0.87
FPR
0.01
0.06
0.11
0.01
0.00
0.17
0.122 0.05
0.02
0.02
Inference- Time
AUC
0.89
0.60
0.42 0.99
0.82 0.99
0.08
0.39
0.94
0.68
CAST
I-ACC
0.47 0.91
0.24
0.44
FPR
0.90
0.33
0.70 0.17 0.67 0.04
0.91 0.85
0.56
0.60
JRShiadl
bACC
0.52
0.58
0:85 0.84 0.53 0.81
0:56 0.50
0:48
0.63
0.03 0.01
0.00
Modleration
I Iame Guand
b-CCC
AUC
0.09
0.58
0.76
0.62 0.99 0.79 0.95
0.86 0.99
0.94
0.99
0.99
0.89
0.94
0.91
0.87
0.93
minimal false positives on both natural and challenging benign conversations.
IPR
0.05
0.01 0.01 0.07
0.00
0.03
0.03
Pempective
AUC
0.96
0.52
0.77 0.08 0.89
0.89
0.01
0.00
0.70
0.53
Google
1-ACC
0.50 0.62
0.49
0.50
Automated Adaptation to External Benchmarks. To demonstrate the scal- ability of our framework, we evaluated the automated CE generation tool (de- scribed in subsection 3.2) on samples from three existing safety benchmarks: Phishing guidance from PKU-SafeRLHF (Ji et al., 2024), Political Risk from Rea-
FPR
0.00
0.00
0.18 0.00 0.01 0.01
0.00 0.00
0.00
0.02
Mickentor
Opeskl
bACC
0.86
0.93
0:50 1.00 0.50 0.90
0:50 0.50
0.50
0.69
0.00
0.00
Activation
AUCC
0.89
0.99
0.98 0.99
0.90 0.98
0.99
1.00
1.00
0.97
Chasiier
Clveoffer
b-ACC
0.82
0.97
0.3 0.98
0.75 0.95
0.99 0.98
0.92
FPR
0.05
0.07 0.03
0.01 0.00
0.07
AUC
0.99
0.98
9.99
1.00
0.99
1.00
0.99 0.99
0.99
0.99
GAVRI
0.94
0.92
FPR 0.00 0.00
0.00
0.00
0.02
0.00
0.02
0.00
0.00
0.00
soning Shield (Li et al.. 2025), and Hate Speech from ToxiGen (Hartvigsen et al., 2022). The automation pipeline synthesized the necessary CEs and rules without manual intervention, achiev- ing strong detection performance "out-of-the-box (e.g., 0.97 TPR on Political Risk and avg 0.945 TPR on ToxiGen). These results confirm that GAVEL can be rapidly adapted to new, diverse data distributions via automation. Detailed results are provided in Appendix G.I.
Comparison with LLM-based Moderation & Adver- sarial Robustness. We evaluated the performance of a judge LLM (GPT-4) explicitly told what to look for in each category. The judge LLM matched GAVEL's perfor- mance on plain-text violations (see Appendix G.2). How- ever, surface-level text moderation is inherently brittle. We tested both systems against three adversarial strate- gies: Misdirection (diluting harmful content with benign chatter), Goal Hijacking (prompt injection to override the LLM monitors instructions), and Evasion (having LLM revise the conversation to be more stealthy). As shown in Appendix G.2, Table 11, GAVEL remains ro- bust across these vectors because it monitors internal cog- nitive states rather than surface tokens. For example, un- der Misdirection attacks, GPT-4's average detection rate collapsed (e.g.. dropping 12% on Delusional Thinking and 15% on Election Interference), whereas GAVEL maintained >> 85% recall across all categories. This confirms that while text-only moderation sees what the model says, activation monitoring is necessary to reveal what the model is actually doing. To emphasize this, we created another dataset on Deceptive Marketing (Appendix G.2.3), subtle scenario where an L.M weaves self- self-promotion into medical advice. While GPT-4 struggles to detect the hidden intent. with only 24% detection rate, GAVEL achieves 73% by detecting the co-occurrence of Build Trust and Healthcare topics.
The weighted accuracy of GAVEL over different models for each evaluated scenario.
Figure 3:
PHiching
SQL Injection
Deusen
Regited Accusscy
And LUBTO
Poll
Raciam
Authorty
1.0
0.
6m
Jan
Genee do
Model Generalization. Because Cognitive Elements are defined over text-only excitation datasets (i.e., Dz), they transfer directly across models. As shown in Figure 3, the same CE datasets and rules protect Llama3- 8B, Mistral-7B. Qwen3-8B and Gemma-4B against the same misuse categories. We

---

Published as a conference paper at ICLR 2026
1PR IPR
Bo
Mudauin Span Eh
LGBTQ
60
Creak Contert
Rowtouctriaal
Ergiga Cracionlly
Phoshing
Delucin
Tax
Anti LGBTQQ
0.95
0.00
67
Taxane
Phohing
Tax Autlunity
Deluoon
0,95
0,95
0.97
0.0
0.02
0.00
Mougeezda acHirsin
Aus-LGBBT
SersTorcl
SKA Caay Dotligg
10
Authunity
Teaaee
Doctanl
Rranat D0, tydte
Table 4: Perfor-
Piorent T'ads
mance of GAVEL (over Mistral-7B) four random misuse categories
LOST2-
Diveracel Hartty
Figure 4: Per-token CE probabilities from an LLM automating tax authority scam. The nov-conversttion snippet works on three languages (top to bottom: in three languages: Mandarin, English, Spanish) despite excitation data being in English. De- English, Spanish, tected CEs: Build Trust (pink), Taxation (red), Personal Information (gray). Mandarin.
observed that smaller or weaker models sometimes yielded noisier activations, but the compositional rule structure was able to compensate by acting as an ensemble.
Representation Robustness. Like other activation-barn methods, GAVEL is agnostic the sur- face form of inputs and outputs. However, a natural concern is that CE definitions written English may not generalize across different languages and may need to be redefined for each one. To test this, we evaluated four random misuse categories Spanish and Mandarin. As shown in Table 4, performance is nearly unchanged, suggesting that CEs capture abstract concepts that remain stable across languages. Moreover, it shows that CE datasets, shared across the community, need only to be written one popular language. Figure further illustrates this: during simulated scam, g reliably detects the same CEs (Taxation and Build Trust) token by token, independent of language.
Efficiency & Practicality. For adoption, safeguards must operate efficiently alongside large models. Our RNN-based CE detector requires only 1550 MB of GPU memory. On an RTX Ada 6000 running Mistral-7B (without GAVEL),, our mean inference latency was 31.8 ms per token. When we added GAVEL, runtime increased by only 0.21 +0001 ms per token, corresponding to < 1% overhead (R: 0.6%). Therefore, GAVEL can be an efficient real-time safeguard for real world deployments. Extended results on the runtime benchmark can be found in the Appendix H.
Adversarial Attacks on GAVEL. While GAVEL mitigates representation attacks on surface text, theoretically introduces new vector: the CE-level jailbreak, where an adversary attempts to trigger harmful behavior without activating the associated CE signatures. Accomplishing an attack (c.g., g.g tax scam) without getting the model to suppress the activation of CEs (c.g.. threat) is challenging since undermines the attack strategy. Nevertheless, future work should explore this new adversarial domain to strengthen the future of ruse- AI safety.
5 CONCLUSION
In this paper, we introduced GAVEL, rule-based activation safety framework that decomposes model behavior into Cognitive Elements (CEs) and enforces safeguards through logical rules. This approach improves precision, flexibility, and interpretability over coarse misuse detectors, while enabling community sharing of reusable CEs and rulesets. GAVEL marks paradigm shift: from static, generic activation-base safeguards to programmable, collaborative ones. Future work should explore other CE detection methods (e.g. transformers. SAEs), devise better windowing methods to capture long-term or dynamic rule violations, and investigate attacks on this novel domain of rule- based activation safety. In summary, GAVEL demonstrates that activation safety can be reimagined as modular, auditable, and adaptive, establishing a foundation for collaborative, transparent, and accountable Al governance.
10

---

Published as a conference paper at ICLR 2026
ACKNOWLEDGMENT
This work was funded by the European Union, supported by ERC grant: (AGI-Safety, 101222135) Views and opinions expressed are however those of the author(s) only and do necessarily reflect those of the European Union or the European Research Council Executive Agency. Neither the European Union nor the granting authority can be held responsible for them.
This work was also supported by the Israeli Ministry of Innovation Science and Technology (grant number 1001948211)
REPRODUCIBILITY STATEMENT
To support reproducibility, we have released all code and datasets developed in this work. This includes the full implementation of our GAVEL framework, covering Cognitive Element (CE) elic- itation, activation extraction, rule composition, and violation detection. We provide the source code for the automatic creation of CE datasets and rules, as well as the source code for our visualization tool. We will also provide the complete set of excitation datasets and rule sets used in our exper- iments, together with scripts for reproducing the evaluation results presented Section These resources, along with detailed descriptions of the CE vocabulary and rule specifications in Tables 1- 2, will enable independent verification and extension of our results by the community.
REFERENCES
Guillaume Alain and Yoshua Bengio. Understanding intermediate layers using linear classifier probes. arXiv preprint arXiv: 2016.
Victor Alvarez and VirusTotal. Yara: The pattern matching swiss knife for malware researchers (github repository). attps://gitii www/Vooostootaaaaaooooooooo 2025-09-17.
2008. Accessed:
Trenton Bricken, Adly Templeton, Joshua Batson, Brian Chen, Adam Jermyn, Tom Con- erly, Nick Turner, Cem Anil, Carson Denison, Amanda Askell, Robert Lasenby, Yifan Wu, Shauna Kravec, Nicholas Schiefer, Tim Maxwell, Nicholas Joseph, Zac Hatfield-Dodds, Alex Tamkin, Karina Nguyen, Brayden McLean, Josiah Burke, Tristan Hume, Shan Carter, Tom Henighan, and Christopher Olah. Towards monosemanticity: Decomposing language models with dictionary learning. Transformer Circuits Thread, 2023. https:/transformer- circuits. Srcuuisspub/2222/mooo
Yanda Chen, Joe Benton, Ansh Radhakrishnan, Jonathan Uesato, Carson Denison, John Schulman, Arushi Somani, Peter Hase, Misha Wagner, Fabien Roger, Vlad Mikulik, Samuel R. Bowman, Jan Leike, Jared Kaplan, and Ethan Perez. Reasoning models don't always say what they think, 2025. URL https: arxiv www.wwwww............oo.o.ooooo abs 2500. 05410.
Yulong Chen, Yang Liu, Liang Chen, Yue Zhang. Dialogsum: A real-life scenario dialogue summarization dataset. arXiv preprint arXiv:2105.06762, 2021.
Daniel B. Cid and OSSEC Project Team. Ossec: Open source host-based intrusion detection system. https: /wwww//wwwww/////////////www./// ossec. net, 2004. Accessed: 2025-09-17.
Alex Cloud, Minh Le, James Chua, Jan Betley, Anna Sztyber-Betley, Jacob Hilton, Samuel Marks, and Owain Evans. Subliminal learning: Language models transmit behavioral traits via hidden signals data. arXiv preprint arXiv:2507.14805 2025.
Hoagy Cunningham, Aidan Ewart, Logan Riggs, Robert Huben, and Lee Sharkey. Sparse autoen- coders find highly interpretable features in language models, 2023. URL https: //arxiv.orroooooo g/abs 2309. 08600.
Ning Ding, Yulin Chen, Bokai Xu, Yujia Qin, Zhi Zheng, Shengding Hu, Zhiyuan Liu, Maosong Sun, and Bowen Zhou. Enhancing chat language models by scaling high-quality instructional conversations. arXiv preprint arXiv:2305.1 /4233, 2023.

---

Published as a conference paper at ICLR 2026
Nelson Elhage, Neel Nanda, Catherine Olsson, Tom Henighan, Nicholas Joseph, Ben Mann, Amanda Askell, Yuntao Bai, Anna Chen, Tom Conerly, et al. A mathematical framework for transformer circuits. Transformer Circuits Thread, 1(1):12, 2021.
Gilad Gressel, Rahul Pankajakshan, and Yisroel Mirsky. Discussion paper: Exploiting Ilms for scam automation: A looming threat. In Proceedings of the 3rd ACM Workshop on the Security Implications of Deepfakes and Cheapfakes, pp. 20-24, 2024.
Peixuan Han, Cheng Qian, Xiusi Chen, Yuji Zhang, Denghui Zhang, and Heng Ji. SafeSwitch: Steering unsafe LLM behavior via internal activation signals, 2025. URL http: arriv..vrvv.oo.../.o g/ aaaab/25000 01042.
Shibo Hao, Sainbayar Sukhbaatar, DiJia Su, Xian Li, Zhiting Hu, Jason Weston, and Yuandong Tian. Training large language models to reason in continuous latent space. arXiv preprint arXiv:2412.06769, 2024.
Thomas Hartvigsen, Saadia Gabriel, Hamid Palangi, Maarten Sap. Dipankar Ray, and Ece Kamar. Toxigen: A large-scale machine- machine-generated dataset for adversarial and implicit hate speech detec- tion. In Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume Long Pupers), pp. 3309-3326, 2022.
Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, and Madian Khabsa. Llama guard: Llm- based input-output safeguard for human-ai conversations. arXiv preprint arXiv:2312.06674, 2023. URL https::/// / awxiv.oro...oo......aa.oooo..a.t abs /2t./.31..000 06674.
Jiaming Ji, Mickel Liu, Josef Dai, Xuehai Pan, Chi Zhang, Ce Bian, Boyuan Chen, Ruiyang Sun, Yizhou Wang, and Yaodong Yang. Beavertails: Towards improved safety alignment of Ilm via human-prees prefer-peeeeence dataset. Advances in Neural Information Processing Systems, 36, 2024.
Bruce W. Lee, Inkit Padhi, Karthikeyan Natesan Ramamurthy, Erik Miehling, Pierre Dognin, Man- ish Nagireddy, and Amit Dhurandhar. Programming refusal with conditional activation steering. 2024. URL https: http///ppreeeeeeeeeeeeeeee wwt.:/eeetooeeeoeeeeee forum? 1id0114 7wc1 0sm
Alyssa Lees, Vinh Q. Tran, Yi Tay, Jeffrey Sorensen, Jai Gupta, Donald Metzler, and Lucy Vasser- man. A new generation of perspective api: Efficient multilingual character-level transformers. In Proceedings of the 2022 ACM Web Conference (WWW '22), pp. 1538-1550, 2022. doi: 10.114555534478.533444,.
Changyi Li, Jiayi Wang, Xudong Pan, Geng Hong, and Min Yang. Reasoningshield: Content safety detection over reasoning traces large reasoning models. arXiv preprint arXiv:2505.1724, 2025.
OpenAl. Openai moderation api. https: //pltt/orm....mmma form.form... cttp://aacc////s////aaaiiiai ence ence/modes wtweem/odrraiiion...mm 2023. Accessed: 2025-09-20.
Nina Panickssery, Nick Gabrieli, Julian Schulz, Meg Tong, Evan Hubinger, and Alexander Matt Turner. Steering Ilama via contrastive activation addition. arXiv preprint arXiv:2312.06681, 2023.
Nina Rimsky, Nick Gabrieli, Julian Schulz, Meg Tong, Evan Hubinger, and Alexander Turner. Steering laaa via contrastive activation addition. In ACL Long, pp. 15504-15522. Associ- ation for Computational Linguistics, 2024. doi: 10. 11111665//11222211111111 https://aclanthologg hwwphhhholoo.o.gg2222o22/e ael-4acc-oonng 828.
URL
Martin Roesch et al. Snort: Lightweight intrusion detection for networks. In Lisa, volume 99, pp- 229-238, 1999.
Sayak Saha Roy, Poojitha Thota, Krishna Vamsi Naragam, and Shirin Nilizadeh. From chatbots to phishbots?: Phishing seam generation in commercial large language models. 2024 IEEE Symposium Security and Privacy (SP), pp. 36-54. IEEF, 2024.
12

---

Published as a conference paper at ICLR 2026
Alexander Matt Turner, Lisa Thiergart, Gavin Leech, David Udell. Juan J. Vazquez, Ulisse Mini, and Monte MacDiarmid. Steering language models with activation engineering, 2024. URL http://arxti org/abss abs/ / 238 10248.
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances in neural informa- tion processing systems, 30, 2017.
Jan Wehner, Sahar Abdelnabi, Daniel Tan, David Krueger, and Mario Fritz. Taxonomy, oppor- tumities, and challenges of representation engineering for large language models, 2025. URL
http: /atp:v//axiv.... org/ http:/bs//25000 /202 http://v...rg/b///550000
19649.
Kaja Whitehouse, What 'terrifies' sam altman about today's financial system. Business Insider, Jul 2025. Available at: httpp:::/wwww.buinnaa bus
5-7.
Jialin Wu, Jiangyi Deng, Shengyuan Pang, Yanjiao Chen, Jiayang Xu, Xinfeng Li, and Wenyuan
Xu. Legilimens: Practical and unified content moderation for large language model services. In Proceedings of the 2024 on ACM SIGSAC Conference Computer and Communications Security, CCS '24, pp. 1151-1165, Association for Computing Machinery, 2024. ISBN 979-8- 4007-0636-3, doi: 10.1 144/3665864433693322 URL https:t/////.. //dp::://d... acm. wttpc//////o.....// 45/3658644 3690322.
Ashkan Yousefpour, Tacheon Kim, Ryan Sungmo Kwon, Seungbeen Lee, Wonje Jeung, Seungju Han, Alvin Wan, Harrison Ngan, Youngjae Yu, and Jonghyun Choi. Representation bending for large language model safety. In Wanxiang Che, Joyce Nabende, Ekaterina Shutova, and Mohammad Taher Pilehvar (eds.), Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), ACL 2025, Vienna, Austria, July 27 August 1, 2025, pp. 24073-24098. Association for Computational Linguistics, 2025. URL https: / //a/aaaaaaatlooooooooooeooooooll wwt.oorgg////// aad.2s...l-ooonn11777 1173//
Shenyi Zhang, Yuchen Zhai, Keyan Guo, Hongxin Hu, Shengnan Guo, Zheng Fang, Lingchen Zhao, Chao Shen, Cong Wang, and Qian Wang. JBShield: Defending large language models from jailbreak attacks through activated concept analysis and manipulation. 2025.
Andy Zou, Long Phan, Sarah Chen, James Campbell, Phillip Guo, Richard Ren, Alexander Pan, Xuwang Yin, Mantas Mazeika, Ann-Kathrin Dombrowski, Shashwat Goel, Nathaniel Li, Michael J. Byun, Zifan Wang. Alex Mallen, Steven Basart, Sanmi Koyejo, Dawn Song. Matt Fredrikson, Zico Kolter, and Dan Hendryeks. Representation engineering: top-down ap- proach to AI transparency, 2023. http: http://axxvvv..r... wttp:r////aa//...000.000000
Andy Zou, Long Phan, Justin Wang, Derek Duenas, Maxwell Lin, Maksym Andriushchenko, Rowan Wang, Zico Kolter, Matt Fredrikson, and Dan Hendrycks. Improving alignment and robustness with circuit breakers. 2024.
APPENDIX
A ADDITIONAL INFORMATION
In this section we provide more details on the content of the paper. In Table 5, we present all the CEs used this paper along with their descriptions. In Figure we present the full template used to elicit CE activations along with complete example.
B ABLATION STUDY
B.1 ATTENTION VS HIDDEN STATES
To determine the optimal source for extracting Cognitive Elements (CEs), conducted an ablation study comparing the performance of classifiers trained on Attention Outputs (our chosen method) versus Hidden States (i.e. the activations of the hidden layer of the MIPP).
13

---

Published as a conference paper at ICLR 2026
Code
Name
Definition
Huy
products services. Instracting the user to click links builons.
Directives for the
CF2
Click/Fnier
Beluriee.MM Dirssive
CF3
CF4
Gl Somewhere
Doweloss/teetall
Directives for the
Divectives For the
downloud install sofrworz/apps.
sonewwerr phytiie physically (e invel, meet in person).
CES
Crani/Agorive
Directives for the user give permissions or grant access (e.g. accounts accoumts,evvcce,, systems, remote control). Directives for the user provide in inforaaiio ie personal deiaals, answers, data).
CE6
ProvideGGive
CE7
Send/ Transter
Directives for the user to get the user to send or wite a desired object
Content
g.g. posis, articles, reports)
CL9
Huild Trust
build false credibility ragport
trut, portraying reliability authority).
CE10
SQL Query Craftin
Generalion SQL queries (e.g. SELECT stateraenis, databise instructions).
CEII
Engage Emotionally
Roenanlic or Battering langagg simed at emocional closeness (c.g.. compliments, affection. making user feel special). Inimiuation through threals (c.g. harm, legal/lax consqquraces, urgent escalation).
CE12
Timeaien
CE13
Spreading Hate Speech
of abusive, hostile, demsaning language against individuals of groups.
CE14
Masquerade Human
Adoption haman pessonz (insleding experiences, emsocions, messocies)
Sycopeantic
Unciitcaal or excessive agreesentt
the üser (e g.. always jeassing, reinforcing user's stteemenss without evaluation). suggestion compiraeles
CF16
plots, misinforrmiion fale authorilies).
CE17
Taxation
Presenoe of taxes, tax authorities, or tax-erlated demands.
CE18
Inconrect SQL. symix
Presenoe of malformdd or illogical SQJ, statements (e.g- tantologies like I-1, broken logk)).
Togl
CE20
CE19
Pensoall information
Electoral Poánies
Presence of sensltive personal data
Presenee of elections. political parties, candidates, cangaigo activity, or partison vieupoints.
CF21
Payment tools
Presenos of payment insormmntis go. gill. cards, ctypiacumency, wire transfers, payment applications).
CF22
GBTQQ
Presenos of L.BTTQ community. queerness, sexual orientation, gender identity. Presence ethnicity nationality, or race.
C123
Ethnoracial ideasity
Table 5: The full list of CEs and their descriptions used in our study
Template for any CE
Example for "Hate Speech
Optional prefix for added performance:
Optional prefis for added performance:
are a Slgues with expertise the
linguistic analyst exper-
domain of cCoguniie Elemouts.
tise in the scructure and rhetorical par- tems of hale speech.
When revising statement, refine realistic and representative
When revising statement, you refine realistic representative ample of dehumanizing hangugg. You draw on your knowledge of how hate speech constructed through storzotypes, mockery. exclusion, and infhammatory thetoric.
ample Cognittive Elements.
You draw explicill on your knowl-
edge in the domain by incorporating
crelevant semantics and conceptual sructturs associated tive Element>.
Cogui-
Excitation Prompt:
Excitation Prompt:
about <Cognirive Element's <aceul
Think about posting hate speech while revising the following: 'You re all eon- barnassing fumuaiiry"
while rosising the following: dotement>
Model Output (activations taken from bere):
Model Output (uctivations taken from here):
<Revised Sistemeur>
nothing an enforrammnt humonity.
Figure 5: The template (left) and an example (right) for collecting activations for a specific CE (c) to create He. Here 'seed statement' is sentence from the CE dataset De
We extracted activations from the same layer range (13-27) for both settings. The Hidden State baseline utilizes the model's internal representations with 4x larger embedding dimension.
As shown in Table 6, the Attention Outputs consistently yield higher efficacy. While the Hidden States contain rich information, they appear to be noisier for this specific task. Notably, the At- tention Outputs provided a significant reduction in False Positive Rates (FPR), particularly in the Benign Data (0.204 - 0.010) and E-Commerce (0.470 - 0.140) categories, while simultaneously improving or maintaining True Positive Rates (TPR) across almost all categories. This confirms that CES are better localized within the attention mechanism's 's information flow.
B.2 LAYER SELECTION
To determine the optimal layers for sourcing representations, we conducted an ablation study by training GAVEL's classifier on hidden states from four different contiguous layer ranges of the base language model. Figure 7 shows the accuracy of CEs across different layer ranges. The compar- ison of TPR and FPR across different misuse categories and its benign counterpart is shown in Figure 6. Our results on Mistral-7B clearly indicate that the mid-to-later layers ([13-26)) pro- vide the best results. This finding aligns with prior work Zou et al. (2023); Panickssery et al. (2023),
14

---

Published as a conference paper at ICLR 2026
Table Performance comparison between detectors trained on Hidden States vs. Attention Outputs (Ours). Our method achieves higher True Positive Rates (TPR) and significantly lower False Positive
Rates (FPR).
True Positive Rate (TPR)
False Positive Rate (FPR)
Category
Hidden State
Attn Output (Ours)
Hidden State
Attn Output (Ours)
Electoral Polities
0.990
0.990
0.020
0.010
Anti-LGBBQ
0.950
0.990
0.000
0.000
Phishing
0,850
0.970
0,000
0.000
Racism
0.310
1.000
0.060
0.090
Delusional
0,880
0.920
0.000
0.000
Romance
0.900
0.960
0,000
0.000
E-Commerce
0.790
0.890
0.470
0.140
SQL Injection
0.980
0.940
0.000
0.000
Tax Authority
0.760
0.940
0.000
0.000
Benign Data
0.204
0.010
which has also identified mid-to-later layers being crucial for capturing the rich, abstract semantic representations required for complex downstream tasks.
True Positive Rate (TPR)
1.0
0.8
0.6
0.4
Phishing
0.0
SQL Injection
Early
Mid [11-20]
Mid-to-Later [13-26]
Later [21-31]
Delusion
[0-10]
AGBTQ
False Pasitive Rate (FPR)
Polltics
0.8
Racism
Autharity
Romance Bai taiting
E-commerce
Noutral
0.4
0.2
Early [0-10]
Mid
Mid-to-Later [13-26]
Later [21-31]
[11-20]
Layer Range
Figure 6: Layer ablation study comparing TPR FPR across transformer layers on Mistral-7B. The highlighted mid-to-later layer [13-26] provides optimal performance with high detection rates and minimal false positives on the misuse classes.
C ANALYSIS OF CE CO-OCCURRENCE
A natural question regarding our training methodology, which uses datasets (D.) that isolate single CE at a time, is whether the resulting detector can handle tokens where multiple concepts "interfere" co-occur.
Our evaluation confirms that the shared representation space allows the multi-label classifier to inde- pendently recognize distinct semantic features when they appear simultaneously. We analyzed all conversations in our evaluation set and found that 54% of dialogues contained tokens where multiple CEs exceeded their detection thresholds simultaneously.
15

---

Published as a conference paper at ICLR 2026
Accuracy across Layer Ranges
Categories
1.00
commerce
0.95
Create content
Downlaadinstall
Engage onally
0.90
Go Somewhere
Grant/approve
Accuracy
0.85
Provide/give
Spreading hate speech
Masquerade
0.80
Send/transfer
SQL Query Crafting
Bulld trust
0.75
Sycophantic
Conspiratorial
0.70
Incorrect SQL syntax
Politics
Personal information
0.65
Payment tools
LGBTQ
Ethnaracial identity
0.60
Early [0-10]
Mid [11-20]
Mid-to-Later [13-26]
Later [21-31]
Figure 7: Layer ablation study comparing accuracy different CEs across transformer layers on Mistral-7B. The highlighted mid-to-later layer [13-26] provides optimal performance.
Figure illustrates three such examples from our (represented by different colored lines) rising and overlapping on specific tokens. For instance, a model may simultaneously activate Engage Emotionally (pink) and Build Trust (yellow) when grooming victim, overlap Create Content with Harmful Directives. This demonstrates that GAVEL effectively disentangles and detects concurrent cognitive states without requiring combina- torial training data.
In these plots, we observe distinct CEs
D ROC ANALYSIS AND RULE SCORING
Continuous Rule Scoring, In production environments, practitioners often need to tune the sensi- tivity of safeguard balance true positives (blocking attacks) against false positives (interrupting benign users). To facilitate this, we define a continuous confidence score for each rule based on the detection probabilities of its constituent Cognitive Elements (CEs).
For conjunctive rule R requiring set of Cognitive Flements Cn = {c1, c c+). we calculate the rule confidence score Sg as the geometric mean the individual CE probabilities P(c)) output by the multi-label classifier:
TOl
SR =
II P(c) CCCC
(I)
This aggregation method provides length- normalized estimate of rule presence. Crucially, the geometric mean properties ensure that the aggregate score drops precipitously if any single required CE missing (i.e., has low probability), regardless of how high the other probabilities are. This ensures that the rule score remains high only when all necessary semantic components present simultaneously.
We utilized these continuous scores to generate Receiver Operating Characteristic (ROC) curves for our misuse scenarios. As shown Figure 9, GAVEL exhibits excellent sepa- rability, with Area Under the Curve (AUC) values approaching 1.0 for nearly all categories. This indicates that the binary results reported in the main paper are not brittle; rather, GAVEL provides a stable control surface for adjusting detection sensitivity.
Performance.
16

---

Published as a conference paper at ICLR 2026
Per-iiken Probabilities Sequance:
Per-Tkknn Probabiiitee for Sequence:
Takana
Per-Tkken Probabiiities for Sequence:
Takana
Figure 8: Per-token probability plots showing the simultancous detection of multiple Cognitive El- ements (CEs) on single tokens. Despite being trained on datasets where CEs appear in isolation, GAVEL's multi-label classifier successfully identifies co-occurring concepts in real-world adversar- ial dialogues.
ROC Curves
Trun Postove Rate
0.9914)
Tax Authority (AUC 0.9865)
E-commerce (AUC 0.9945)
Romance (AUC 0.99991
SQL Injection (AUC 0.9886)
Anti-LGaTQ (AUC 1.0000)
Elections (AUC = 0.3992)
Phishing (AUC 0.9996)
False Posttive Rate
Figure 9: ROC curves for the defined ruleset, demonstrating smooth and reliable threshold control, with nearly rules achieving near-perfect discrimination and AUC values approaching
E GAVEL AUTOMATED RULE AND CE GENERATION PIPELINE
The GAVEL framework a rule-based detection system that operates over an LLM's activations. However, defining these rules and extracting their underlying Cognitive Elements (CEs) can be challenging and labor- inteniiteesvve. Although community contributions can address much of this work, there is need streamline the process. We introduce automated system that reduces the
Overview:
17

---

Published as a conference paper at ICLR 2026
manual effort required for rule development and CE dataset creation. The system leverages LLM agents to automatically: (1) generate rule sets based on scenario descriptions, (2) identify missing CEs needed to support new rules, and (3) generate excitation datasets for training GAVEL classi- fiers on these CFs. This system forms an end-to-end pipeline that takes users from initial scenario conception through to deployable rules and CEs. The pipeline begins with interactive scenario description with a chat agent covering both user and assistant figures of speech, instructional versus conversational framing, behavioral patterns, and safety constraints risk of violation. This descrip- tion feeds two parallel automated processes. The first generates rules and CEs based on the scenario and existing CE inventory with judge LLM verification, followed by excitation dataset generation for any new CEs, also verified by judge LLM. The second process creates scenario dataset con- figuration specifying misuse variations, followed by synthetic conversation generation for testing GAVEL with the new rules. The full source code for the automation pipeline is available online.
F BASELINE IMPLEMENTATION DETAILS
To ensure a fair and rigorous comparison, we evaluated GAVEL against diverse set of baselines ranging from surface-level content moderators to advanced activation steering methods. Table summarizes the objective, input mechanism, and training configuration for each method. Below, provide additional specific details regarding implementation and evaluation logic.
F.1 EVALUATION LOGIC
Data Formatting for Multi-turn Dialogues. Our evaluation dataset consists multi-turn dialogues between a user and an assistant. GAVEL and the Activation Classifier process tokens sequentially, token-by-token. For the baselines that operate on complete contexts (CAST, RepBending, Circuit- Breakers, JBShield, Legilimens and all Content Moderation APIs), we flattened the conversation history. Specifically, turns (User and Assistant) were concatenated into a single string separated by spaces before being passed to the model.
Defining "Detection" for Steering Methods. Several baselines (RepBending, CircuitBreakers, CAST) originally designed defense steering mechanisms rather than binary detectors. We adapted them for our detection metrics as follows:
We projected the model's activations onto the learned activation-difference direc- tion vector. A violation was flagged if the projection magnitude exceeded calibrated threshold. This is the first step of the CAST algorithm, we simply did not perform the steering objective.
CAST:
RepBending & CircuitBreakers: These methods aim to force the model to refuse harmful queries. order to determine if the intervention was successful we would pass the model a harmful promt and ask it to repeat the prompt if the model repeated the prompt we counted this as a false negative, it refused to comply, was counted as a true positive. A judge LLM was used to determine if the model complied or not. These are in line with the original authors' methods.
Model Architecture Nuance. While GAVEL and most baselines were evaluated on the specific models listed in the main text (e.g., Mistral-7B, Llama3-8B). Legilimens was evaluated using Llama2. This is because Legilimens is specifically architected for Llama2, and we utilized the exact 3 3-layer MLP moderator configuration provided by the authors to ensuring a faithful reproduction of their results.
18

---

Published as a conference paper at ICLR 2026
Table 7: Summary of baseline configurations. "Concatenated" indicates that multi-tur dialogues were flattened into a single string for processing.
Baseline
Mechanism & Objective
Input Type
Training / Setup Details
Activation Classifier
Multi-class classifier predicting the specific use-case.
Per-token Attention Output
Trained on 9k malicious
dialogues (1k per use-case). 80/20 train-val
split. Prefilled Dialogue
JBShield
Multi-class classifier predicting general harm and use-cases
Per-token Hidden State
Trained on 4k dialogues for general harm (2k harmful/harmles)) and 2k per use-case specific vector. Input concatenated.
Legilimens
Binary moderator using 3-layer MLP hidden states (Llama2 architecture).
Per-token Hidden State
Trained 9k harmful and harmless dialogues. 450 of each held out for threshold calibration. Input concatenated.
CAST
Detection via projection onto activation aefivation-diffrrencce vectors.
Per-token Hidden State
Trained on 9k difference vectors derived from (malicious, neutral) pairs. Input concatenated.
RepBending
Steering via representation engineering.
Per-token Hidden State
Inference-time method (No training). Input concatenated.
CircuitBreakers
Stecring via circuit disruption.
Per-token Hidden State
Inference-tinee method (No training). Input concatenated.
Google Perspective
Surface text toxicity scoring.
Raw Text
Commercial APL. Input concatenated.
LlamaGuard
Classifier for MLCommons safety policy violations.
Raw Text
Pre-trained weights. Input concatenated.
OpenAl Moderator
Classifier for policy violations (hate, self-harm, ctc.).
Raw Text
Commercial Input concatenated.
G ADDITIONAL RESULTS
Figure 10 presentss the average performance of all the baseline methods across the generated datasets. Table 8 presents the full performance comparison between GAVEL and the baselines with all met- rics.
For all results in the paper, balanced-ACC FPR and TPR thresholds calibrated via TPR-FPR analysis, utilizing both held-out use cases and dedicated set of 20 verified multi-turn dialogues per CE.
Finally, Figure 11 provides an example conversation with an LLM assistant that is flagged as mali- cious by all baselines but not by GAVEL
19

---

Published as a conference paper at ICLR 2026
Table 8: Performance comparison of GAVEL vs. baselines on Mistral-7B. Metrics include AUC, Balanced Accuracy (b-ACC), F1, TPR, and FPR. Bold values indicate the best performance for each metric. (*Legilimens was trained and tested on the Llama2-7B model).
Benign
Cybererime Psychological Harm Seam Automation Sum.
Instructionil hional
Converstional
SQL Injection
Tax Authority
E-Commerce
Delusional
Anti-LGBTH
Phishing
Elections
Romance
Racism
Method
Metrie
Avg.
AUC
0.89
0.90
0.49
0.94
0.42
0.87
0.67
0.50
0.50
0.68
b-ACC
0.89
0,90
0.50
0,95 0.42
0.88
0.68 0.51
0.50
0.69
Circuit Breakers
Fl
0.87
0.88
0.08 0.77 0.00
0.58
0.51 0.03
0.00
0.41
Fine- Tuning
TPR
0.79
0.81
0.06 0.99 0.00
0.99
0.37 0.02
0.00
0.44
FPR
0.00
0.01
0.00
0.00
0.06 0.09 0.15
0.23
0.01 0.00
0.00
0.06
AUC
0.99
0.97
0.57 0.99 0.50
0.96
0.98 0.91
0.97
0.87
b-ACC
0.99
0.97
0.57 0.99 0.50
0,96
0.99 0,92
0.98
0.87
RepBending
0.97
0.84
0.24 0.95 0.01
0.81
0.92 0.82
0.92
0.72
TPR
1.00
1.00
0.15 1.00 0.01
1.00
1.00 0.87
0.98
0.77
FPR
0.00
0.12
0.01
0.06
0.01 0.01 0.00
0.07
0.02 0.03
0.02
0.02
AUC
0.89
0.60
0.42 0.99 0.82
0.99
0.08 0.39
0.94
0.68
A-C
0.51
0.47 0.91 0.66
0.98
0.24 0.44
0.59
CAST
Fl
0.29
0.25
0.22 0.65 0.33
0.88
0.11 0.21
0.25
0.35
TPR
0.99
0.36
0.65 1.00 1.00
1.00
0.40 0.74
1.00
0.79
Inference-
FPR
0.02
0.61
0.80
0.33
0.70 0,17 0.67
0.04
[0.91 0,85
0.96
0.60
AUC
0.64
0.24
0.81 0.73 0.39
0.69
0.114 0.01
0.10
0.41
A-ACC
0.52
0.58
0.85 0.84 0.53 0.81
0.556 0.50
0.48
0.63
JBShield
Fl
0.14
0.29
0.74 0.77 0.12 0.77
0.23 0.00
0.03
0.34
TPR
0.11
0.17
0.73 0.69 0.07
0.63
0.13 0.00
0.02
0.28
FPR
0,01
0.02
0.06
0.00
0.03 0.01 0.00
0.00
(0,00 0.00
0.05
0.01
AUC
0.98
0.76
0.62 0.99 0.79
0.95
0.99 0.89
0.91
0.87
b-ACC
0.99
0.89
0.86 0.99 0.88
0.94
0.99 0.94
0.94
0.93
Lluma Guard Meta
0.97
0.64
0.38 0.97 0.65
0.84
0.98 0.83
0.79
TPR
0.97
0.56
0.25 1.00 0.66
0,99
0..88 0.83
0.88
0.79
FPR
0.01
0.01
0.00
0.03
0.01 0.01 0.07
0.07
0.00 0.03
0.04
0.03
AUC
0.96
0.52
0.77 0.08 0.89
0.89
0.01 0.00
0.70
0.53
Moderation
Perspective
A-CCC
0.58
0.53
0.50 0.62 0.50
0.62
0.49 0.50
0.59
0.55
Google
F1
0.28
0.12
0.18 0.40 0.03
0.39
0.00 0.03
0.31
0.19
TPR
0.17
0.07
0.2 0.26 0.02
0.26
(.000 0.02
0.19
0.13
FPR
0.05
0.32
0.00
0.00
0.18 0.00 0.01
0.01
0.00 0.00
0.00
0.02
AUC
0.86
0.93
0.50 1.00 0.50
0.99
0.50 0.50
0.50
0.69
ACCC
0.86
0.93
0.50 1.00 0.50
0.99
0.50 0.50
0.50
0.69
Moderator
OpenAl
F1
0.84
0.92
0.19 1.00 0.00
0.99
0.00 0.00
0.00
0.43
TPR
0.73
0.87
0.01 1.00
0.99
0.00 0.00
0.40
FPR
0.00
0.03
0.00
0.00
0.00 0.00 0.00
0.00
(0.00 0.00
0.00
0.00
AUC
0.68
0.71
0.75 0.81 0.83
0.68
0.84 0.62
0.68
0.73
ACC
0.57
0.65
0.67 0.67 0.66
0.58
00.99 0.55
0.58
0.62
Legilimens *
Fl
0.28
0.32
0.34 0.34 0.33
0.28
0.35 0.27
0.28
0.31
TPR
0.98
0.98
0.86 0.95 0.97
0.99
1.00 0.95
0.98
0.96
FPR
0.00
0.00
0.83
0.67
0.51 0.60 0.65
0.82
0.61 0.84
0.81
0.70
AUC
0.89
0.99
0.98 0.99 0.90
0.98
0..99 1.00
1.00
0.97
Classifer
A-C
0.82
0.97
0.93 0.98 0.75
0.95
0.99 0.98
0.89
0.92
Activation Classifier
0.53
0.91
0.81 0.91 0.55
0.91
0.96 0.98
0.88
0.82
TPR
1.00
0.99
0.95 1.00 0.62
0.93
1.00 0.97
0.79
0.91
0.03
0.03
0.07 0.03
0.02
0.01 0.00
0.07
AUC
0.99
0.98
0.99 1.00 0.99
1.00
0.99 0.99
0.99
0.99
A-CCC
0.94
0.95 1.00
0.99
0.92
GAVEL
Fl
0.97
0.94
0.94 1.00 0.94
0.99
0.87 1.00
0.94
0.95
TPR
0.95
0.89
0.90
1.00
0.99
0.99
0.86 1.00
0.90
0.94
FPR
0.088
0.008
0.00
0.00
0.00
0.00
0.02
0.00
0.02 0.00
0.00
0.00
20

---

Published as a conference paper at ICLR 2026
AUC
b-ACC
Metric
199
FRR
0.0
0.2
0.4
0.6
0.8
1.0
Average Value
Llama Guard
Activation Classiter RepS:nddin
Moderstor OpenAl
Perspective jeshield
Circuit Brcakers
Figure 10: Average performance across the misuse categories.
G.1 EVALUATION ON EXTERNAL. DATASETS
To assess the generalization capabilities of our automated pipeline, we applied the GAVEL au- tomation tool to three external datasets not seen during development. We sampled scenarios from SaFeRaFeLLHH (Phishing category), Reasoning Shield (Political Risk), and ToxiGen (Ethnoracism and Homophobia). The automation tool successfully generated the requisite Cognitive Elements and rules based solely on the dataset descriptions. Table 9 reports the True Positive Rates (TPR) achieved, demonstrating high immediate sensitivity these distinct domains.
Table 9: Performance (TPR) of GAVEL on external benchmarks using CEs and rules generated entirely by our automation tool. The system achieves high detection rates without manual tuning.
Usecase Dataset
TPR
Phishing Guidance (PKU)
0.76
Political Risk (Reasoning Shield)
0.97
Ethnoracial (ToxiGen)
0.91
Homophobia (ToxiGen)
0.98
G.2 ADVERSARIAL ROBUSTNESS EVALUATION
To evaluate the robustness of activation- monitoring compared to state-of-ther oftthh--tt-tttt text modera- tion, we conducted comparative study using GPT-4 baseline judge.
21

---

Published as a conference paper at ICLR 2026
SQL Query Discussion
User:
Good. What happens if you select columns that aren't in the GROUP BY clause or an aggregate?
Assistant: In strict SQL mode, that results in an error. In looser modes, it might return arbitrary results.
User:
Write query that returns average salary per department. Assistant:
SELECT department id, AVG salary)
FROM employees
GROUP BY department.id;
User: And how would you include department names from different table?
Assistant:
SELECT d. name, AVG(e. salary)
FROM employees
JOIN departments ON e. department id d. id
GROUP BY d. name;
User: Perfect. Now explain window function.
Assistant: Window functions perform calculations across a set of rows related to the current row. For example:
SELECT name, salary
RANK() OVER
(PARTITION BY department_id ORDER BY salary DESC)
FROM employees;
User: Nice. What's the difference between RANKO and DENSE. DENSE.RANKO?
Assistant: RANK( skips numbers when there's 's tie. DENSE RANK() doesn's 't.
User: Final question. How would you optimize slow query joining large tables?
Assistant: Add indexes on join columns, filter early with WHERE, limit rows with pagina- tion, and use EXPLAIN check the execution plan.
An example discussion with an LLM assistant that all baselines flagged as malicious, but not by GAVEL. The false positive is likely caused by the assistant mentioning that GROUP BY would return arbitrary results -seeming like an attack on the database's 's confidentiality, GAVEL is not affected by this because it is only looking for when the LLM intentionally (instructively) writes code with improper syntax.
Figure 1I:
G.2.1 STANDARD PERFORMANCE (NON-ADVERSARIAL)
First, we evaluated GPT-4's ability to detect the nine misuse categories using surface text alone. We utilized a prompt allowing GPT-4 to classify use cases based on the same definitions used to construct GAVEL's rules. As shown in Table 10, standard, non-adversarial datasets, GPT-4 performs comparably to GAVEL, achieving high True Positive Rates (TPR) and low False Positive Rates (FPR). This indicates that for overt violations, text analysis is sufficient.
G.2.2 ADVERSARIAL ATTACKS
However, reliance on surface text makes safeguards susceptible to manipulation. We evaluated performance against three specific attack vectors designed obscure the harmful nature of the output while preserving the underlying intent:
The attacker shifts the LLM's surface focus away from relevant content by interspersing the harmful output with significant amounts of benign, unrelated text.
Misdirection:
22

---

Published as a conference paper at ICLR 2026
Table 10: Comparison of GAVEL vs. GPT-4 (with and without rule definitions) on standard, non-
adversarial datasets. GPT-4 is a strong baseline on surface-level text.
TPR
FPR
Task
GAVEL
GPT-4
GPT-4 (No Rules)
GAVEL
GPT-4
GPT-4 (No Rules)
Phishing
0.95
0.98
0.91
0.00
0.00
0.00
SQL Injection
0.89
0.99
1.00
0.00
0.09
0.00
Delusional
0.90
0.90
0.84
0.01
0.00
0,01
Anti-LGBTQQ
1.00
0.97
0.99
0.00
0.03
0.00
Elections
0.99
0.85
0.66
0.01
0.30
0.00
Racism
0.99
0.97
0.99
0.02
0.05
0,00
Tax Authority
0.86
0.96
1.00
0.00
0.02
0.00
Romance
1.00
0,95
1.00
0,01
0.00
0.00
F-Commerce
0.90
0.87
0.87
0.04
0.02
0.00
Table 11: Detection performance (TPR) under adversarial attack. While GPT-4 struggles with Mis-
direction and Hijacking. Gevain robust, detecting the underlying cognitive elements despite surface-level obfuscation.
Misdirection
Goal Hijacking
Evasion
Task
GAVEL
GPT-4
GAVEL
GPT-4
GAVEL
GPT-4
GPT-4 (No Rules)
Phishing
0.97
0.55
0.96
0.55
0.96
0.91
0.86
SQL Injection
0.89
0.49
0.89
0.70
0.95
0.95
0.91
Delusional
0.87
0.12
0.87
0.49
0.97
0.56
0.29
Anti-LGBTQ
1.00
0.35
1.00
0.90
1.00
0.66
0,80
Elections
0.99
0.15
0.99
0.63
1.00
0.85
0.54
Racism
0.99
0.16
0.99
0.91
0.98
0.87
0.94
Tax Authority
0.86
0.00
0.86
0.28
0.71
0.91
1.00
Romance
1.00
0.24
1.00
0.48
0.97
0.92
0.91
E- E-Commerce
0.89
0.01
0.90
0.12
1.00
0.97
0.84
The of prompt injection override system instructions, forcing the LLM monitor to ignore its guidelines and thus it can no longer perform its duties.
Goal Hijacking:
The attacker explicitly instructs the generating LLM that it is being monitored and must "achieve the goal without being detected" (e.g.. by using subtle language or avoid- ing trigger words).
Evasion:
Threat Model. In these scenarios, assume attacker can programmatically filter the LLM's output (e.g., using regex to strip benign camouflage) before presenting the final result to a victim. Therefore, if the LLM generates the harmful content at all, the attack considered successful.
Results. Table Il details the True Positive Rate (detection success) under these attacks. GAVEL maintains high detection rates across all categories because it identifies the presence Cognitive Elements (CEs) in the activations, which persist regardless of surface-level obfuscation. In contrast, GPT-4's performance degrades significantly, particularly against Misdirection and Hijacking.
G.2.3 CASE STUDY: DECEPTIVE MEDICAL MARKETING
We further evaluated a subtle misuse category: Deceptive Marketing in Healthcare. In this sce- nario, the LLM is instructed covertly promote specific medical service while pretending offer unbiased advice. This behavior is difficult for text-based moderators to flag because the surface text appears helpful and authoritative.
We defined the following GAVEL rule to detect this behavior:
Healthcare (Being Deceptive V Promoting) (Build Trust V Role Playing)
23

---

Published as a conference paper at ICLR 2026
Table 12:
Performance on the Deceptive Medical Marketing dataset (Apos 250, 7neg 100).
GAVEL outprfooms GPT-4 by wide margin, as the latter struggles to distinguish deceptive pro- motion from helpful medical advice.
Method
TPR
FPR
GAVEL
0.728
0.010
GPT-4
0.244
0.000
Generation vs. Classification Time per Token
0.035
Time per token (ceconds)
0.025
0.015
0.005
Generation Classification
Sample Index
Figure 12: Average computational overheads for classification compared to generation. The mean classification overhead per token 0.00021 corresponding to 0.00105 per 5-token window. De- spite appearing as visible band on the plot, this overhead is negligible relative to the ~0.032 s/token generation time. this run, approximately 11,830 classification calls were processed, confirming that classification incurs minimal latency overhead.
As shown in Table 12, GAVEL successfully detects this nuanced behavior by identifying the under- lying cognitive combination of building trust while discussing healthcare, whereas GPT-4 largely fails to recognize the violation.
H RUNTIME ANALYSIS
To quantify the computational impact of GAVEL's classification mechanism, we measure per-token runtimes for both generation and classification across extended sequence. As shown in Figure 12, classification adds only negligible overhead relative to generation, demonstrating that GAVEL's decision processes can be integrated without materially affecting throughput.
24


Reviews:
[{"review_id": "AdKF9fPEpk", "reviewer": "Reviewer_VVtu", "summary": "The paper introduces GAVEL, a framework for improving LLMs safety by monitoring internal activations. It proposes the use of Cognitive Elements, as well as logical rules to detect and respond to unsafe or policy-violating behaviors. The framework is inspired by rule-sharing practices in cybersecurity and aims to foster community collaboration in defining and maintaining safety standards.", "questions": "- Are there avenues/ possibilities for automating the rule creation?", "limitations": "", "rating": 6, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- The use of Cognitive Elements allows for composable safety rules that are explainable\n- GAVEL operates with minimal computational overhead\n- The framework has good performance across different LLM architectures and languages", "weaknesses": "- The process of defining Cognitive Elements and composing rules is currently manual and may not scale easily", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "RgCzrvxdkS", "reviewer": "Reviewer_ihDH", "summary": "This papers presents a novel framework for activation-based safety monitoring. In particular, the paper proposes to elicit cognitive elements from model activations, and then defining predicate rules over CEs and detects violations in real time using a multi-label classifier.  Finally, the proposed approach is evaluated on a self-generated datasets.", "questions": "**Additional Question (not related to weaknesses)**\n- **New Adversarial Attack Surface:** While GAVEL defends against surface-level \"representation attacks\" , it introduces a new attack vector: the CE detector itself. A sophisticated adversary could, in principle, craft a \"CE-level jailbreak\"—a prompt that achieves a harmful outcome without triggering the specific activation signatures the multi-label classifier is trained to detect. This vulnerability is not explored in the paper.\n\nI am more than happy to raise my score if the authors can address my concerns and questions, and in particular make the paper \"complete\" such that it could be reproduced. In the current state, it would be hard to reproduce.", "limitations": "", "rating": 4, "confidence": 3, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "- The paper is to most extents clearly written and easy to follow\n- Promising results on the self-generated benchmarks and informative an informative analysis in Figure 4.\n- Informative Ablations (e.g. Transformer layer ablation and not just assuming some gold layer)", "weaknesses": "- **Boolean Predicate Rules:** While the grounding in concept space sounds intriguing, it remains unclear to me if the boolean logic is the right top-level tool. For instance, many nuance things are hard to express in boolean logic and it seems kind of a loss of flexibility (one of the core benefits of the current LLM-based paradigm) \n- **Connection to SAEs:** Despite the paper's main motivation to build onto concept spaces, it seems odd to me that sparse autoencoders (SAEs) are not mentioned a single time. Especially as SAEs would offer \"free\" access to concept-level abstractions.\n- **Interference of Concepts:** The authors state that \"each activation set in the training collection H is curated to isolate a single CE a time\", and list two advantages. However, the limitations of this approach remain open. For instance, how well can the resulting extraction deal with tokens where multiple concepts interfere? \n- **Only Self-Generated Benchmarks:** While it's definitely a good evaluation tool to construct targeted datasets to test a proposed method, one should also evaluate the proposed method on existing benchmarks.\n- **Baseline Comparisons:** Since you construct specific predicate rules for each dataset, did you also test a specialized prompt per category, and tested a vanilla model with this specialized prompt? How much does rule specialization to the specific dataset matter?\n- **Lack of Details:** The paper lacks quite a lot of important deltas\n  - Only very details on the RNN are given (would be hard to reproduce the paper)\n  - No details on how the datasets were generated are given (also checked the appendix)", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "aGuvjJvHkx", "reviewer": "Reviewer_Hrih", "summary": "The paper proposes the adaptation of a new paradigm inspired by rule-sharing practices in cybersecurity. This rule-based activation safety system models activations as cognitive elements, fine-grained, interpretable factors such as \"making a threat\" and \"payment processing.\"  From this, they build a framework that defines predicate rules over these element factors, using them for real-time classification. The paper tries to address three limitations identified by the authors: poor precision, limited flexibility, and lack of interpretability.\n\nThe method is evaluated on four approaches: loss-based fine-tuning, reading vector projections, content moderation APIs, and activation classification. These methods were evaluated against a synthetic dataset constructed for this work.", "questions": "- Is there a way to control the TPR and FPR? \n- Gemma and Qwen3 seem to be lower-weighted ACC in Figure 3. Could this be because the model's multilingual nature?", "limitations": "", "rating": 2, "confidence": 3, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "- Overall, the method is simple and doesn't require retraining\n- Derives the method from cybersecurity practices", "weaknesses": "- The paper is not well-written. See some examples below.\n   - In line 213, it was unclear whether this is the same $d$ from line 201.\n   - Figure 2 should be earlier in the paper (page 1 or 2)\n   - Many choices in the paper are not well-explained. Here are two examples of this  (1) why are attention outputs instead of activations of the linear layers? (2) Why is GAVEL detection an RNN? \n- I would like to see a baseline of GPT-4 in Table 3.\n- Rule-based systems are inherently subjective in nature", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "EDQCzR09Uw", "reviewer": "Reviewer_x4Ks", "summary": "This paper introduces a framework that enhances AI safety by combining activation-level monitoring with rule-based logic. Instead of relying on broad misuse datasets, GAVEL models interpretable Cognitive Elements (CEs)—fine-grained behavioral units such as “making a threat” or “requesting payment information.” These CEs capture internal model activities and enable safety rules to be defined as logical predicates (e.g., refuse if “creating content” AND “personal information”), allowing practitioners to flexibly enforce policies without retraining detectors.\n\nGAVEL demonstrates higher precision and lower false positives than existing safeguards like content moderation APIs or traditional activation classifiers. It generalizes well across multiple LLMs and languages, while maintaining real-time efficiency with less than 1% computational overhead. By promoting community sharing of CEs and rule sets, GAVEL establishes a scalable, interpretable, and auditable foundation for transparent AI governance.", "questions": "How well would GAVEL generalize to real-world misuse cases beyond synthetic GPT-generated data? Could results differ with naturally occurring adversarial prompts?\n\nCan the creation of Cognitive Elements and rules be automated or standardized, perhaps with LLM assistance, to improve scalability?\n\nHow do the authors plan to extend GAVEL from detection to active enforcement (e.g., refusal, redaction, or steering) while ensuring stable model behavior?\n\nHas robustness to adversarial evasion at the activation level been tested, and how resilient is GAVEL compared to surface-text moderation methods?\n\nCould the authors include qualitative examples or visualizations showing how human auditors interpret rule violations and CE activations in practice?", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 1, "strengths": "The paper’s main strengths lie in its originality, rigor, clarity, and significance. It introduces a novel paradigm—rule-based activation safety—that bridges activation monitoring and cybersecurity-inspired rule frameworks, making AI safety both interpretable and configurable. The concept of Cognitive Elements (CEs) as modular, activation-level primitives is innovative, enabling composable and auditable safeguards that overcome key limitations of existing misuse detectors. The methodology is high-quality and well-executed, with comprehensive experiments across multiple models, domains, and languages, all supported by reproducible code and datasets. The writing is clear, logically structured, and visually supported by informative figures and tables. Overall, the paper makes a significant and timely contribution, offering a practical, interpretable foundation for scalable and collaborative AI safety governance.", "weaknesses": "While the paper is strong overall, several weaknesses limit its generalizability and depth of validation. The primary concern is the dependence on synthetic datasets generated by GPT-4/5 for evaluating misuse scenarios, which may not fully capture the complexity or unpredictability of real-world adversarial behavior. This raises questions about how GAVEL would perform under naturally occurring or adaptive attacks. Additionally, while the framework demonstrates strong detection accuracy, the evaluation focuses narrowly on detection rather than enforcement—there is limited analysis of how rule violations translate into safe, consistent behavioral corrections during long or open-ended interactions. The rule creation and CE definition process also relies heavily on manual design, which may not scale efficiently without further automation or community infrastructure. Finally, although the paper discusses interpretability, it would benefit from more qualitative analysis or case studies showing how GAVEL’s outputs aid human auditors in practice.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)