S afe S witch: Steering Unsafe LLM Behavior via Internal Activation Signals (2025)

Abstract: Large language models (LLMs) exhibit exceptional capabilities across various tasks but also pose risks by generating harmful content. Existing safety mechanisms, while improving model safety, often lead to overly cautious behavior and fail to fully leverage LLMs’ internal cognitive processes. Inspired by humans’ reflective thinking capability, we first show that LLMs can similarly perform internal assessments about safety in their internal states. Building on this insight, we propose **SafeSwitch**, a dynamic framework that regulates unsafe outputs by utilizing the prober-based internal state monitor that actively detects harmful intentions, and activates a safety head that leads to safer and more conservative responses only when necessary. SafeSwitch reduces harmful outputs by approximately 80% on harmful queries while maintaining strong utility, reaching a Pareto optimal among several methods. Our method is also advantageous over traditional methods in offering more informative, context-aware refusals, and achieves these benefits while only tuning less than 6% of the original parameters. SafeSwitch demonstrates large language models’ capacity for self-awareness and reflection regarding safety, offering a promising approach to more nuanced and effective safety controls.

## introduction large language models (llms) have demonstrated remarkable capabilities in planning @xcite , coding @xcite and reasoning @xcite @xcite , making them powerful tools for a wide range of tasks. however, their potential to generate harmful content, such as misinformation @xcite and hate speech @xcite , has sparked growing societal concern. mitigating these risks is essential to ensure that llms operate ethically and align with societal values. current safety paradigms, while effective, often overlook the importance of pre-generation thought processes in llms. instead, models are typically tuned in an end-to-end manner through alignment techniques like reinforcement learning @xcite or safety prompt optimization @xcite . although these methods have achieved notable safety improvements, they also come with a significant drawback of biasing llms uniformly toward refusal @xcite , which results in the over-rejection of benign queries and reduced utility. for instance, @xcite found that over-optimization in rlhf leads to a performance decline of up to 45% across a wide range of tasks, including knowledge, reading comprehension, and translation. this phenomenon, known as alignment tax, is an intrinsic limitation of the current one-for-all llms. the reason may be that, unlike humans, who self-evaluate planned behaviors and deliberate before acting @xcite , traditional alignment approaches treat all outputs as end-to-end optimization targets. this neglects the model's internal reasoning process, making pre-decoding introspection and dynamic model switching infeasible. motivated by these limitations, our work first investigates the relationship between llm internal states and safety of model responses. preliminary experiments reveal that llms inherently encode signals within their internal states that reflect their recognition of unsafe instructions and intent to respond, suggesting it's possible to harness "internal signals" to regulate model behavior in a more adaptive and context-aware manner. building upon it, we introduce safeswitch, a novel framework designed to dynamically regulate unsafe llm behavior by leveraging these model's unlike traditional alignment methods that tune the model on all queries, safeswitch dynamically regulates safety through a safety prober that monitors the model's internal states. the computational cost of obtaining the state and the prober's performance are both positively correlated with layer depth. when unsafe content is predicted by the prober, a specialized refusal head will be activated to generate informative refusals, making the response safe and helpful. further studies show that safeswitch could promote more informative and context-aware refusals and is resilient to malicious queries unseen during training. additionally, by utilizing only 6% of the original parameters, our design enables seamless integration into a wide range of llms with minimal overhead, providing a scalable and efficient solution. these advantages position safeswitch as a promising step forward in achieving nuanced, dynamic, and effective safety controls for llms, paving the way for more ethical ai applications. ## preliminary experiment: internal state contains safety information dense vectors passed between transformer layers, known as internal states, encapsulate the model's contextual knowledge accumulated layer by layer, similar to human brain's internal signals. to understand how llms process safety-related information, we conduct a preliminary experiment by visualizing llms' internal states for different types of queries. we use the llama-3.1-8b model to generate responses for a set of safe and unsafe queries (see appendix i for mode models). each input-output pair is categorized into three types: i) the input is safe; ii) the input is unsafe, and the model appropriately refuses to respond; or iii) the input is unsafe, and the model complies with the request. we extract the model's internal states across layers for each query and project them into a 2d space using pca to visualize safety-related encoding. to quantify the distinction between categories, we train support vector machines (svm) to draw two boundaries: one separating safe and unsafe queries, and another separating complied and refused queries. as shown in figure 2 , internal states are intermixed in the early layers but begin to diverge in later layers, becoming more distinct across categories. these results serve as an indicator of the model's safety awareness and intent to generate unsafe outputs. overall, we gain the following insights: ## methodology this section first introduces safety probers that extract internal states and predict unsafe behaviors (section 4.1), and then introduces safeswitch, a method to steer llm behavior toward safer outputs when it may generate unsafe responses (section 4.2). ## safety prober experiments in this section, we present experimental results demonstrating that safety probers can efficiently predict unsafe behavior, reaching an f1 score of over 90% (section 5.2). we then analyze the scaling law of their inference-time cost and performance (section 5.3). ## safeswitch experiments in this section, we present extensive experiments across 5 benchmarks. the results demonstrate that safeswitch significantly enhances llm safety while preserving utility. additionally, we show that safeswitch leads to more interpretable refusals and generalizes well to unseen queries. ## conclusion this work presents safeswitch, a dynamic safety enhancement approach that proactively addresses safety concerns in language models by leveraging internal state signals. we decompose harmful response prediction into two stages and train probers to effectively predict unsafe behavior prior to generation. if potential harm is predicted, we activate a fine-tuned decoding head that prioritizes safety to ensure compliance with safety standards and informative refusal. our experiments show that safeswitch effectively differentiates between benign and harmful outputs, reaching a pareto optimal in balancing safety and utility. further experiments validate safeswitch's strengths in promoting helpful, context-aware refusals and generalizing to unseen harmful queries. as a novel method inspired by human cognitive processes, safeswitch advances dynamic safety control for llms, paving the way for more adaptable and context-aware safety alignment strategies.