Adnan KhanAdnanProduct & AI
San Francisco Bay Area
Get in touch

Source note3 min read

Silent Alarm: A J-Space Protocol for Comparing Danger Recognition Across Models and Quantization Levels

Source

arXiv

arxiv.org/abs/2607.12792v1

Read the source

Source

Plain-Language Brief

The research proposes JADR, a protocol for measuring the internal safety mechanisms of language models before their first response is generated. It uses Jacobian space to record top-k J-space tokens from prompts and layers for six behavioral scenario axes. The method does not require an external judge model and can compare different models and modifications like quantization and fine-tuning on the same terms. The research applies the protocol to six models across three weight-representation regimes and checks it against an independent evaluation.

What the Document Says

  • The research introduces JADR, a protocol for evaluating safety of language models through their internal representations in Jacobian space.
  • JADR records top-k J-space tokens for every prompt and layer, grouped into six behavioral scenario axes.
  • Comparisons are made between danger samples based on StrongREJECT and safe controls from XSTest and OKTest.
  • The method does not use an external judge model and runs locally on the evaluated model's activations.
  • The protocol allows comparison of different models, quantization, and fine-tuning modifications.
  • The final comparison is based on the SafetyAUC metric with bootstrap confidence intervals.
  • The research applies JADR to six models across three weight-representation regimes: Qwen3-1.7B, Qwen3-4B, Qwen3-8B, Qwen3-Uncensored-4B, Qwen3-SafeRL-4B, Gemma 2 9B
  • The findings are checked against an independent behavioral evaluation with the StrongREJECT grader.

Key Concepts Mentioned

  • JADR protocol
  • Jacobian space
  • top-k J-space tokens
  • six behavioral scenario axes
  • StrongREJECT
  • XSTest
  • OKTest
  • SafetyAUC metric
  • quantization
  • fine-tuning

Claims Made by the Document

  • JADR can evaluate the internal safety mechanisms of language models.
  • The method does not require an external judge model.

Evidence Used

  • Introduction of JADR protocol
  • Explanation of how JADR works

Methods / Approach

UNKNOWN

Limitations Stated by the Authors

UNKNOWN

Limitations Noted by the Agent

Agent interpretation — not from the source.

UNKNOWN

Open Questions

UNKNOWN

Notes for Future Q&A

May include interpretation. Labeled where it does.

UNKNOWN

Raw Abstract / Excerpt

Jailbreak-robustness research typically evaluates safety through generated responses using an LLM-as-judge approach. Such evaluations, however, are sensitive to the benchmark's grading procedure and capture only observed behavior on a given set of attacks, without directly revealing the hidden fragility of the underlying safety mechanisms. This work proposes JADR (Jacobian Assessment of Danger Recognition), a protocol that measures a model's internal representation through Jacobian space (J-space, a recently proposed workspace of verbalizable concepts) before the first response token is generated. For every prompt and layer we record the top-k J-space tokens; these are grouped into six behavioral scenario axes and compared between a danger sample based on StrongREJECT and a safe control drawn from XSTest and OKTest. The method does not call on an external judge model: the computation runs entirely locally, on the activations of the model under evaluation, which lets us compare both different models against each other and modifications of a single model -- quantization and fine-tuning in particular -- on the same terms. The final comparison rests on the proposed SafetyAUC metric, complemented with bootstrap confidence intervals. The protocol is applied to six models (Qwen3-1.7B, Qwen3-4B, Qwen3-8B, Qwen3-Uncensored-4B, Qwen3-SafeRL-4B, Gemma 2 9B) across three weight-representation regimes -- BF16, INT8, and INT4 -- and checked against an independent behavioral evaluation with the StrongREJECT grader. The metric separates models with a strong versus a weak internal safety mechanism with statistical significance and captures substantively different effects across quantization regimes.