Paper deep dive

TRACE: Temporal Risk Assessment and Concept Editing for Safer Language Generation

Ankur Garg, Xuemin Yu, Hassan Sajjad, Samira Ebrahimi Kahou

Year: 2026Venue: arXiv preprintArea: cs.AIType: PreprintEmbeddings: 109

Intelligence

Status: not_run | Model: - | Prompt: - | Confidence: 0%

Entities (0)

No extracted entities yet.

Relation Signals (0)

No relation signals yet.

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:Large language models (LLMs) can produce harmful content while generating a response. A useful safeguard should not only detect this risk during generation but also intervene while leaving safe responses largely unchanged and provide an auditable record of the internal patterns supporting its decisions. We propose TRACE (Temporal Risk Assessment and Concept Editing), a framework that tracks harmful-response risk during generation, selectively edits token activations, and leaves an auditable trace of its detection and steering decisions. TRACE learns a codebook of recurring activation patterns, with each codebook vector representing a latent concept. At inference time, it assigns each token activation to the nearest codebook vector to obtain the corresponding concept. A gated recurrent unit (GRU) processes the activations and their assigned concept features to predict completed-response harmfulness and a monotone cumulative streaming risk. During steering, activations assigned to harmful concepts are steered along directions defined by nearby benign targets. An external LLM labels the learned concepts post hoc, making detection sequences and harmful-to-benign edit records interpretable. Experiments across three generators and the WildGuard and S-Eval benchmarks show that TRACE improves streaming F1 over Kelp in five of six comparisons while remaining competitive on completed-response detection. TRACE's selective steering reduces Harmbench attack success with little change in refusal on originally safe responses. The post-hoc audit reveals recurring semantic structure in the learned concepts and distinct traces associated with harmful detection, safe generation, and activation edits.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

105,509 characters extracted from source content.

Expand or collapse full text

TRACE:TEMPORALRISKASSESSMENTAND CONCEPT EDITING FOR SAFER LANGUAGE GEN- ERATION Ankur Garg University of Calgary ankur.garg1@ucalgary.ca Xuemin Yu Dalhousie University xuemin.yu@dal.ca Hassan Sajjad Dalhousie University hsajjad@dal.ca Samira Ebrahimi Kahou University of Calgary Mila - Quebec AI Institute samira.ebrahimikahou@ucalgary.ca ABSTRACT Large language models (LLMs) can produce harmful content while generating a response. A useful safeguard should not only detect this risk during generation but also intervene while leaving safe responses largely unchanged and provide an auditable record of the internal patterns supporting its decisions. We propose TRACE (Temporal Risk Assessment and Concept Editing), a framework that tracks harmful-response risk during generation, selectively edits token activations, and leaves an auditable trace of its detection and steering decisions. TRACE learns a codebook of recurring activation patterns, with each codebook vector representing a latent concept. At inference time, it assigns each token activation to the nearest codebook vector to obtain the corresponding concept. A gated recurrent unit (GRU) processes the activations and their assigned concept features to predict completed- response harmfulness and a monotone cumulative streaming risk. During steering, activations assigned to harmful concepts are steered along directions defined by nearby benign targets. An external LLM labels the learned concepts post hoc, making detection sequences and harmful-to-benign edit records interpretable. Ex- periments across three generators and the WildGuard and S-Eval benchmarks show that TRACE improves streaming F1 over Kelp in five of six comparisons while re- maining competitive on completed-response detection. TRACE’s selective steering reduces Harmbench attack success with little change in refusal on originally safe responses. The post-hoc audit reveals recurring semantic structure in the learned concepts and distinct traces associated with harmful detection, safe generation, and activation edits. 1 2 1 Code repository: https://github.com/agarg-dev/TRACE 2 An extended abstract version was accepted and presented at Symposium on Model Accountability, Sustain- ability and Healthcare (SMASH) 2026. 1 arXiv:2610.15365v1 [cs.AI] 11 Oct 2026 1INTRODUCTION Language models can still produce harmful instructions after being trained to refuse unsafe requests (Mazeika et al., 2024; Zou et al., 2024). Restricting generation too strongly, however, can lead models to refuse legitimate requests simply because they mention sensitive topics (R ̈ ottger et al., 2024). Hence, it is necessary for a safeguard to distinguish harmful assistance from safe discussion of these topics. When responses are streamed directly to users, it must make this distinction during generation, since checking a completed response may be too late to prevent harmful details from being released. Text moderators such as Llama Guard and WildGuard classify prompts and responses for safety risks (Inan et al., 2023; Han et al., 2024), while streaming detectors such as Kelp monitor the generator’s hidden states as a response is generated (Li et al., 2025). Intervention methods aim to change the generation itself through safety reminders in the prompt (Xie et al., 2023), trained adapters (Zou et al., 2024), or activation edits (Arditi et al., 2024). Conditional activation steering (CAST) makes activation steering selective by applying a refusal direction only when a learned condition on the prompt is met (Lee et al., 2025). When a safeguard blocks a safe response or changes it unexpectedly, its score and output do not tell us which activation patterns were present or which ones an edit targeted. Marks et al. (2025) used learned activation features in an alignment audit to help uncover a hidden objective in a model trained to conceal it. For safeguards, retaining the patterns encountered during detection and the targets chosen during steering would support similar inspection of false alarms and unwanted changes to safe responses. To represent these patterns, we build on discrete concept discovery with learned codebooks (Yu et al., 2026). The cross-layer vector-quantized variational autoencoder (CLVQ-VAE) learns a codebook from activations at one layer and uses it to reconstruct activations at a later layer (Garg et al., 2026). Each codebook entry represents a recurring activation pattern, so assigning token activations to entries gives a concept sequence for the response. These sequences can be compared across responses and inspected around detector decisions. Associating the concepts with harmful and safe training responses can tell which patterns might need an edit and which benign concepts could serve as targets. We propose TRACE (Temporal Risk Assessment and Concept Editing), which uses this codebook as a shared discrete representation connecting detection, steering, and auditing. At each generation step, TRACE assigns the current activation to a concept. TRACE also introduces a causal detector that processes the activation together with features of its assigned concept and jointly predicts completed- response harmfulness and a monotone cumulative streaming risk from response-level labels. For steering, the same assignment determines whether the activation is edited. When it belongs to a harmful concept, TRACE pairs that concept with a nearby benign one and uses the difference between their mean activations to guide an edit that preserves the activation norm. We record the detector’s concept sequence and the source and target concepts for each steering edit. An external large language model (LLM) assigns semantic descriptions after training so that these records can be inspected, with the descriptions used only for this purpose. Across Qwen, Llama, and InternLM on WildGuard and S-Eval, TRACE achieves higher streaming F1 than our layer-matched Kelp baseline in five of six comparisons and nearly matches Kelp’s streaming F1 on InternLM/WildGuard. It remains competitive on completed-response detection. TRACE’s steering substantially reduces harmful generation with little aggregate change in refusal on originally safe responses. On Qwen/WildGuard, the audit finds consistent semantic descriptions for about half of the concepts with enough training responses for evaluation. These descriptions reveal recurring instructional, refusal, and redirection patterns in the detection and edit records, providing a semantic context for what the safeguard encountered and targeted. 2METHODOLOGY TRACE consists of a cross-layer discrete representation, a causal detector, and a concept-conditioned intervention. Figure 1 summarizes the three components. 2.1CROSS-LAYER DISCRETE CONCEPTS We adopt the cross-layer vector quantization (VQ) training scheme of CLVQ-VAE (Garg et al., 2026). For a response ofTtokens, letx ℓ t ∈ R d be the residual-stream activation at tokentand layerℓ. 2 Shared representation: learning discrete concepts through cross-layer reconstruction benign conceptsharmful concepts L AY E R - 2 0 A C T I VAT I O N S Layer 20 one activation per token Encoder project activations Shared codebook nearest vector per token Concept sequence · order is preserved Causal decoder codebook vectors only Layer-24 reconstruction decoded from concepts Layer-24 target activations Response labels and activations grouped by assigned concept Concept statistics harmfulness score, concept mean, response support Detection: tracking cumulative streaming risk token by token RE SPO NSE TO KEN S script 202 is 203 ** 204 not 205 for 206 malicious 207 remaining response SSH brute-force code DE TEC TOR IN PUT token activation + concept statistics +++++++ CA USA L G RU GRU h₂₀₂ GRU h₂₀₃ GRU h₂₀₄ GRU h₂₀₅ GRU h₂₀₆ GRU h₂₀₇ GRU h T ... Response prediction offline final token CU MUL ATIV E ST REA MIN G R ISK q₂₀₂...q₂₀₆q₂₀₇q T WildGuard ground-truth label: harmful 12061,468 threshold = 0.605 not generated online STOP generation stops Steering: editing only activations assigned to harmful concepts Prompt unchanged Layer-20 activation current token Later layers continue generation Next token Assign concept current activation harmful concept? yes Activation edit harmful meanbenign mean no Continue generation without an edit edit direction Figure 1: TRACE architecture. Learned discrete concepts support causal detection and concept- conditioned activation editing. The example uses Qwen layers and a Qwen/WildGuard trajectory. We learn a codebookE =e j K j=1 from these activations by using the assigned codebook vectors to reconstruct the corresponding activationsx u t at a later layeru. An encoder first combines each activation with a learned transformation of it. At inference, we assign the encoded activation to the nearest codebook vector: z t = (1− ρ)x ℓ t + ρ LN(Wx ℓ t + b enc ), c t = arg min j ∥z t − e j ∥ 2 2 .(1) Here, layer normalization (LN) denotes layer normalization, andW,b enc , and the mixing weight ρ∈ (0, 0.5)are learned. Each codebook vector represents a concept (Yu et al., 2026), andc t identifies the concept assigned to tokent. A causal decoder uses the assigned vectorse c 1 ,...,e c t to reconstruct x u t . This trains the concepts to retain information needed to predict activations at the later layer. The training objective has four terms: L VQ =L rec + βL commit + ηL util + γL region .(2) The reconstruction loss measures the relative error in predicting the later-layer activation. The commitment loss keeps encoder outputs close to their assigned vectors, while the utilization loss discourages reliance on only a few codebook entries. The region loss encourages tokens from harmful and safe responses to use different groups of concepts. We useβ = 0.1,η = 0.01, andγ = 5. Appendix C.1 gives the full definitions and training details. 2.2CONCEPT HARMFULNESS AND ACTIVATION MEANS We estimate a concept’s harmfulness from the VQ training responses in which it appears. For concept c, letN c be the number of such responses andH c the number labeled harmful. A response counts once even if the concept appears multiple times. BecauseH c /N c can be unstable whenN c is small, we smooth it toward the overall harmful-response raterto obtainp c . We then mapp c to a score s c ∈ [−1, 1], where zero denotes the overall rate and positive or negative values indicate association with harmful or safe responses, respectively: p c = H c + ar N c + a , s c = (p c − r)/(1− r), p c ≥ r, (p c − r)/r,p c < r. (3) 3 wherea = 10. We call a concept harmful whens c > 0and benign otherwise. These groups describe associations with response labels. During VQ training, the region loss penalizes soft assignments to the opposite group: harmful concepts for safe responses and benign concepts for harmful responses. We recompute the groups after each epoch. We compute two mean activations at layerℓfor each concept. The detector meanμ det c uses assigned tokens from the detector-training partition, while the steering mean μ vq c uses assigned tokens from the VQ training partition. 2.3CAUSAL RESPONSE-LEVEL AND STREAMING DETECTION At each tokent, the detector forms an input vectorv t by combining the current activation with the mean and statistics of its assigned concept: v t = h P x (x ℓ t );P μ (μ det c t );s c t ; e N c t i .(4) Here,P x andP μ project the two vectors into smaller spaces, and e N c is the normalized count of detector-training responses containing conceptc. A causal gated recurrent unit (GRU) processes these inputs in token order. The response head produces the completed-response predictionby T from the final GRU state. The streaming head produces a conditional token hazardq t ∈ [0, 1], which is accumulated into the streaming risk: R t = 1− t Y i=1 (1− q i ).(5) The risk cannot decrease as more tokens arrive. Generation can be stopped when it crosses a threshold. Both heads learn from the response labely. We use cross-entropy for response prediction and binary cross-entropy for the final cumulative risk: L det = w resp CE(y,by T ) + w stream BCE(y,R T ).(6) The coefficientsw resp andw stream weight the response and streaming terms, respectively. Both terms also use class weights. Since training does not use token-level onset annotations (as they are unavailable), a threshold crossing does not establish the exact token where harmful content begins. 2.4CONCEPT-CONDITIONED INTERVENTION For each harmful concepth, we choose the benign concept with the closest mean activation. Candi- dates must appear in at least ten VQ training responses: b(h) = argmin b:s b ≤0,N b ≥10 ∥μ vq h − μ vq b ∥ 2 ,∆ h = μ vq b(h) − μ vq h .(7) The difference∆ h defines the steering direction. We scale the edit using the harmfulness score, normalized by the largest positive score: g h = s h max j s j , s h > 0.(8) When a generated-token activation is assigned toh, we rotate it toward∆ h by a fractionλg h of the angle between them, whereλis the intervention strength, while preserving the activation norm. Concepts with higher harmfulness scores receive larger edits. Activations assigned to benign concepts receive no edit. We repeat the assignment after each generated token, and the resulting edit affects the next-token prediction. Hence steering responds directly to the current concept and does not wait for the detector’s risk to cross a threshold. Appendix C.4 gives the interpolation formula and how we select the intervention strength. For detection, we record the concept sequencec t alongside the running riskR t . Each steering edit records its harmful source concepthand benign targetb(h). After training, an external LLM assigns semantic descriptions by examining response contexts associated with each concept. These descriptions are used only to interpret the records. 4 3EXPERIMENTAL SETUP Data and models.We use the WildGuard (Han et al., 2024) and S-Eval (Yuan et al., 2025) subsets of StreamGuardBench (Li et al., 2025). They contain responses from Qwen3-8B (Yang et al., 2025), Llama-3.1-8B-Instruct (Grattafiori et al., 2024), and InternLM3-8B-Instruct (Team, 2025), with a safety label for each response. We train and evaluate TRACE separately for all six combinations of model and dataset. Appendix A describes the splits and filtering. Model selection. For each model, we use linear probes to measure how well each layer separates harmful from safe responses in the WildGuard training data. Following Li et al. (2023), we select the layer with the highest cross-validated probe accuracy and use it for both datasets. The target layer is four blocks later. The read/target pairs are 20/24 for Qwen, 14/18 for Llama, and 34/38 for InternLM. All models useK = 800concepts and select detector settings on held-out validation data. Appendices B and C give the full selection and training details. Baselines. For detection, we compare against the WildGuard classifier, DiffMean adapted from AxBench (Wu et al., 2025), and Kelp (Li et al., 2025). DiffMean and Kelp use the same model layer as TRACE. Some of our reproduced Kelp results differ from those in the original paper. As discussed in Appendix H, the paper and released code disagree on some implementation details. We follow the paper in these cases, which may partly explain the mismatch. For steering, we compare against Self-Reminder (Xie et al., 2023), refusal-direction activation addition (Arditi et al., 2024), and CAST (Lee et al., 2025). Appendix H gives the implementation details for both sets of baselines. We reimplement all baselines as faithfully as possible. Metrics.For detection, we report harmful-class F1, false-positive rate (FPR), area under the receiver operating characteristic curve (AUROC), and average precision (AP) for completed responses and during generation. In the streaming evaluation, a response counts as detected if its score crosses the detector’s threshold at any token. We express the first detection position as a fraction of the response length. TRACE and Kelp use threshold 0.5, while DiffMean’s threshold is selected on validation data. For steering, we report HarmBench attack success rate (ASR) (Mazeika et al., 2024) for prompts whose original responses are harmful, and the change in refusal rate for prompts whose original responses are safe. Steering strength is selected on validation data using ASR and response-quality criteria detailed in Appendices D and C.4. Concept audit. We label the final Qwen/WildGuard codebook with Gemini-3.1-Flash-Lite. For each sufficiently common concept, three independent runs examine 25 sampled training responses and propose a label from the context preceding its assigned tokens. We keep labels that agree across at least two runs. These labels are added after training and are used only to read the detection sequences and steering records. Appendix E gives the full protocol. 4RESULTS AND ANALYSIS We evaluate detection, intervention, and the concept traces left by both operations. Detector ablations and compute measurements are reported in Appendices F.1.5 and G. 4.1DETECTING HARMFUL GENERATION Table 1 compares the methods at their reported thresholds. TRACE has the highest streaming F1 in five of six settings and the highest response F1 in four. Kelp has higher response F1 on Qwen/WildGuard and InternLM/WildGuard. On InternLM/WildGuard, TRACE performs almost the same as Kelp in streaming F1. TRACE also has higher response and streaming F1 than DiffMean. Threshold-independent results. Appendix Table 7 reports AUROC and AP, which compare methods without fixing a threshold. TRACE has higher scores than Kelp on both Llama datasets, Qwen/S-Eval, and InternLM/S-Eval. Results on Qwen/WildGuard and InternLM/WildGuard are mixed, with each method leading on different metrics. 5 Table 1: Harmful-class F1/FPR. Bold marks the highest F1 for each generator–dataset pair. WildGuardS-Eval GeneratorMethodResponse F1/FPRStreaming F1/FPRResponse F1/FPRStreaming F1/FPR Qwen3-8B WildGuard0.571/0.004–0.093/0.000– DiffMean0.525/0.2550.525/0.2550.820/0.3620.820/0.362 Kelp0.839/0.0260.803/0.0750.900/0.0920.896/0.109 TRACE0.835/0.0500.837/0.0450.933/0.0880.935/0.079 Llama-3.1-8B WildGuard0.520/0.001–0.328/0.000– DiffMean0.487/0.2320.487/0.2320.886/0.0750.886/0.075 Kelp0.764/0.0300.693/0.0840.916/0.0770.919/0.122 TRACE0.794/0.0320.789/0.0360.966/0.0290.961/0.027 InternLM3-8B WildGuard0.393/0.001–0.136/0.000– DiffMean0.486/0.2580.486/0.2580.819/0.0940.819/0.094 Kelp0.749/0.0370.735/0.0670.906/0.0360.904/0.078 TRACE0.720/0.0880.734/0.0810.925/0.0500.918/0.042 0 20 40 60 WildGuard lower is better Qwen3-8BLlama-3.1-8BInternLM3-8B 0204060 0 20 40 60 S-Eval 02040600204060 Detection latency–false-positive trade-off False-positive rate (%) Median detection position (% of response) TRACEKelpDiffMean Figure 2: Median first-detection position and FPR at each method’s reported threshold. Detection position.Figure 2 compares the first detection position and false-positive rate. An earlier detection is useful only when recall and false-positive rates are also considered. At the thresholds used in Table 1, TRACE has a lower false-positive rate than Kelp in five of six settings, although Kelp detects harmful responses earlier in some cases. On InternLM/WildGuard, TRACE detects 87.0% of harmful responses, compared with 82.4% for Kelp. Its false-positive rate is higher (8.1% versus 6.7%), and Kelp has an earlier median detection point (10.8% versus 17.0% of the response). Appendix Figure 9 compares the full detection distributions using validation-selected thresholds. Detection across response lengths.Appendix Figure 10 examines how TRACE and Kelp perform on responses of different lengths. For each method, harmful and safe responses are sorted separately from shortest to longest and divided into five roughly equal groups, or length quintiles. Across the 30 generator–dataset–quintile comparisons, TRACE has higher harmful-response recall than Kelp in 24 and ties in two. Its safe-response false-positive rate is equal or lower in 22, and both methods make most of their S-Eval false positives in the longest quintile. Cross-generator training. Training a detector for a new generator usually requires labeled re- sponses from that model. Appendix Table 8 tests whether labeled responses from another generator can be used instead. Across all six transfer directions, TRACE’s response and streaming F1 remain within 0.055 of the corresponding results from same-generator training. TRACE also has higher F1 than Kelp on both outputs in five directions. 6 Table 2: Steering results. Safe refusal shows matched unsteered→ steered refusal rates. WildGuardS-Eval GeneratorMethodASR↓Safe refusal(%)ASR↓Safe refusal(%) Qwen3-8B Unsteered0.87324.80.63455.7 Self-Reminder0.28925.0→ 32.60.18255.5→ 65.7 Refusal-direction addition0.00024.9→ 96.50.00055.7→ 99.6 CAST0.27824.9→ 49.00.16756.1→ 82.4 TRACE0.30624.8→ 25.40.06255.7→ 55.5 Llama-3.1-8B Unsteered0.85430.70.76684.8 Self-Reminder0.59230.9→ 35.60.45084.6→ 83.9 Refusal-direction addition0.00031.0→ 92.70.00084.6→ 97.3 CAST0.70930.5→ 42.70.21984.3→ 93.1 TRACE0.59230.7→ 31.30.11084.8→ 85.6 InternLM3-8B Unsteered0.84123.30.79550.2 Self-Reminder0.56123.2→ 24.00.52250.2→ 41.3 Refusal-direction addition0.00023.3→ 99.90.00050.2→ 100.0 CAST0.29723.5→ 46.60.35350.9→ 85.2 TRACE0.43523.3→ 23.40.24950.2→ 51.4 4.2INTERVENING DURING HARMFUL GENERATION Table 2 shows that the lowest ASR does not always correspond to the most selective intervention. Refusal-direction addition reduces ASR to zero, but it also turns almost every originally safe response into a refusal. Self-Reminder and CAST reduce ASR, but usually change safe-response refusal more than TRACE. Across all six settings, TRACE reduces ASR while keeping refusal on originally safe responses close to its unsteered rate. Quality of steered responses. We check whether lower ASR comes with degraded text by mea- suring non-repetition of text, the change in response-token negative log-likelihood (NLL), the edited-token fraction, and failures on originally safe responses. The selected settings pass all four validation limits on both Qwen datasets and Llama/S-Eval. Each of the other three settings misses one of the limits. Appendix F.2 reports the full strength sweeps and quality results. 4.3AUDITING DETECTION AND INTERVENTION TRACE records the concept assigned to each token during detection and the source and target concepts used for each steering edit. To interpret these records, we label the Qwen/WildGuard codebook after training with Gemini. For each codebook entry found in at least 25 training responses, we draw three independent samples of 25 response excerpts, each ending at a token assigned to that entry. Gemini names the recurring pattern and labels it harmful, benign, or neutral in each sample. We retain a name when at least two runs agree on the pattern, and retain a safety label when the agreeing runs have a majority. This gives names for 422 of the 796 supported entries (53.0%) and safety labels for 392. The named entries cover 46.4% of test-set token assignments. Appendix E gives the complete procedure and prompts. 4.3.1DETECTION Figure 3 compares concept traces for correctly detected harmful responses and correctly classified safe responses. For harmful responses, we use the trace up to the first detection. For safe responses, we use the full trace. We first merge consecutive repetitions of the same concept. Refusal and non-refusal concepts represent different forms of benign behavior, so we show them separately. This also prevents frequent refusal concepts from obscuring the non-refusal group. On average, concepts labeled as harmful make up 5.95% of a harmful-response trace and 0.23% of a safe-response trace. Concepts labeled as benign show the opposite pattern, accounting for 1.01% and 26.60%, respectively. Appendix Figure 7 shows the corresponding false-positive and false-negative traces. 7 Top concepts across 251 test responses Fictional or Role- play Narrative Framing Narrative framing for content delivery Narrative Framing for Harmful or Dystopian Scenarios Narrative framing of harmful or illicit activities Instructional framing for harmful content Narrative framing for harmful content Educational Simulation Framework Narrative framing of harmful or controversial content Fictional Narrative Framing for Harmful Content Instructional guides for illicit or unethical activities True positives Top refusal-related benign concepts across 1,376 test responses Refusal of harmful requests Refusal and redirection Refusal and Pivot Refusal of harmful content Refusal and Warning of Harmful Content Refusal and safety disclaimer Refusal of requests Refusal of harmful or unethical requests Refusal and Educational Pivot Ethical and constructive refusal framing Top non-refusal benign concepts across 1,376 test responses Offer of further assistance Structured Instructional Guidance Structured Instructional or Narrative Formatting References to external legal or professional resources Legal and ethical disclaimer Structured informational guidance Helpful transition phrase Assistance offer Standardized transition to further assistance Harmful consequence warning True negatives HarmfulBenignSafety ambiguous Figure 3: Ten most frequently named concepts in Qwen/WildGuard true-positive and true-negative traces. True-negative benign concepts are separated into refusal-related and non-refusal groups. 020406080100 Edited harmful responses (%) Fictional or Educational Framing of Harmful Activities Step-by-step instructional guides Narrative framing of harmful or illicit activities Step-by-step instructional planning Educational or simulated cyberattack scenarios 62/283 70/283 99/283 146/283 165/283 Harmful concept triggering edit 020406080100 Edited harmful responses (%) Hypothetical or fictional framing Refusal and Warning of Harmful Content Refusal of harmful requests Structured Instructional or Narrative Formatting Refusal and redirection 81/283 131/283 189/283 194/283 233/283 Benign concept used as target Figure 4: Most frequent named source and target concepts in the 283 edited harmful Qwen/WildGuard responses. Each concept is counted once per response. 4.3.2STEERING We also audit the edits made by the selected Qwen/WildGuard setting on the official test set. Of the 284 harmful responses, 283 receive at least one edit. Across these responses, we find 30 named harmful source concepts and 14 named benign target concepts. Figure 4 shows the five most frequent in each group. A named harmful source appears in 235 responses, and a named benign target appears in 256. Repeated edits involving the same concept are counted once per response. Among the edited harmful responses, 79 contain an edit whose source has an agreed harmful label and whose target has an agreed benign label. These edits comprise five distinct source–target pairs. Appendix Table 6 lists all five pairs and their response counts. The most frequent maps Instructional guides for cyberattacks and data exploitation to Information request refusal (30 responses). Figure 5 compares concept trajectories before and after steering. Unsteered outputs contain harmful narrative and instructional concepts throughout. After intervention, refusal and redirection concepts appear from the first quarter onward, although harmful cyberattack-simulation concepts remain common. The mean edited-token fraction stays near 63% across intervals of harmful responses. For safe responses it stays near 11%, while the unsteered and steered trajectories remain dominated by benign refusal concepts. Appendix Figure 8 shows the corresponding safe-response trajectories. 8 Unsteered responses ( n =284 ) Fictional or Role-play Narrative Framing Narrative Framing for Harmful or Dystopian Scenarios Narrative framing of harmful or controversial content Narrative framing of harmful or illicit activities Narrative framing for content delivery 0–25% Narrative framing for content delivery Instructional framing for harmful content Narrative framing of harmful or illicit activities Fictional Narrative Framing for Harmful Content Narrative framing of harmful or controversial content 25–50% Narrative framing of harmful or illicit activities Instructional framing for harmful content Step-by-step instructional planning Narrative framing of harmful or controversial content Narrative Framing for Harmful or Dystopian Scenarios 50–75% Fictional framing of harmful content Narrative framing of harmful or illicit activities Narrative Framing for Harmful or Dystopian Scenarios Narrative framing of harmful or controversial content Fictional or Role-play Narrative Framing 75–100% TRACE-steered responses ( n =284 ) Refusal and redirection Refusal of harmful requests Educational or simulated cyberattack scenarios Step-by-step instructional planning Fictional or Role-play Narrative Framing Mean tokens edited: 62.8% Educational or simulated cyberattack scenarios Structured instructional narrative Refusal of harmful requests Refusal and redirection Step-by-step instructional planning Mean tokens edited: 62.4% Educational or simulated cyberattack scenarios Structured instructional narrative Refusal of harmful requests Refusal and redirection Step-by-step instructional planning Mean tokens edited: 63.2% Educational or simulated cyberattack scenarios Structured instructional narrative Refusal and redirection Refusal of harmful requests Refusal and Pivot Mean tokens edited: 62.2% How steering changes the concept trajectory Top named concepts in each interval for paired responses to the same prompts HarmfulBenignSafety ambiguous Figure 5: Concept trajectories before and after intervention for harmful Qwen/WildGuard prompts. Responses are divided into four token intervals, with the mean edited-token fraction shown for each. 5RELATED WORK Harmfulness and streaming detection. Llama Guard and WildGuard are text moderators that classify prompts and responses for safety risks (Inan et al., 2023; Han et al., 2024). AxBench evaluates concept detectors based on internal representations and identifies difference-in-means as a strong baseline; we adapt its DiffMean method to harmful-response detection (Wu et al., 2025). ShieldHead classifies the generator’s last-layer hidden states (Xuan et al., 2025), while other hidden- state probes learn token scores from sequence labels and aggregate them for online detection (Shu et al., 2026). Kelp models how risk changes across intermediate-layer hidden states during generation (Li et al., 2025). NExT-Guard monitors safety-related sparse-autoencoder features without token-level supervision (Fang et al., 2026). Kelp is the closest comparison to our detector: both methods read hidden states at each token, train from response-level labels, and carry information forward through the sequence. TRACE differs by jointly predicting completed-response harmfulness and a monotone cumulative streaming risk while associating each token with a discrete concept. Intervention during generation. Refusal-direction steering adds a single direction to model acti- vations to elicit refusal (Arditi et al., 2024). CAST applies a behavior direction when the prompt activation matches a condition vector (Lee et al., 2025). SCAR uses a sparse conditioned autoen- coder to detect and steer concepts such as toxicity (H ̈ arle et al., 2024), while Breaking Bad Tokens uses sparse-autoencoder decoder directions for constant, input-conditioned, and token-conditioned detoxification (Goyal et al., 2025). Self-Reminder instead prompts the model to respond responsibly (Xie et al., 2023). In TRACE, the current token’s concept determines whether an edit is made, and a nearby benign concept defines the harmful-to-benign direction used for the edit. Discrete concepts and auditing. VQ-VAE learns discrete latent codes through vector quantization (Van Den Oord et al., 2017). Codebook Features inserts vector-quantization bottlenecks into a language model and controls generation by activating selected codes (Tamkin et al., 2023). VQLC learns latent concepts from frozen hidden states (Yu et al., 2026), while CLVQ-VAE uses a discrete bottleneck to reconstruct higher-layer representations from lower-layer ones (Garg et al., 2026). Building on CLVQ-VAE, TRACE learns a codebook from a frozen generator, unlike Codebook Features, which fine-tunes the transformer. The same codebook supports detection, steering, and auditing. Sparse-autoencoder features have also supported alignment audits (Marks et al., 2025), and language models have been used to label clusters of contextual representations (Mousi et al., 2023). We similarly label the codebook after training so that recorded concept sequences and steering edits can be read semantically. 9 6CONCLUSION A useful safeguard should detect harmful generation early, intervene without broadly suppressing safe responses, and leave enough information to examine its behavior afterwards. TRACE brings these goals into one framework through a shared discrete representation: learned concepts support streaming detection, determine the source and target of activation edits, and form the records used in the post-hoc audit. Across three generators and two datasets, TRACE improves streaming F1 over Kelp in five of six comparisons. It also reduces HarmBench ASR across all three generators with little aggregate change in refusal on originally safe responses. The audit gives consistent names to roughly half of the sufficiently supported concepts and finds different patterns in harmful detections, safe generation, and steering edits. By preserving a record of the concept patterns it observes and edits, TRACE makes its behavior easier to review when safety decisions have serious consequences. 7LIMITATIONS TRACE requires access to a model’s internal activations, which limits its use with closed models served only through an API. Our evaluation covers three 8B instruction-tuned models and two english-language safety benchmarks, so performance may differ for larger models, other languages, and other forms of harmful content. The concept names are assigned by an external LLM after training and describe recurring patterns, but they do not establish that a concept caused a prediction or edit. Steering can also reduce fluency or increase repetition, so part of an observed reduction in ASR may come from degraded generation rather than a useful shift toward benign behavior. ETHICS STATEMENT This work evaluates safeguards against harmful language-model generations and therefore uses existing safety benchmarks containing harmful or offensive prompts and responses. We did not collect new human-subject data. TRACE is intended for defensive use, but neither its detector nor its intervention guarantees that every output is safe. Activation interventions could also be used to change model behavior for harmful purposes. We therefore present TRACE as one component of a broader safety system rather than a complete safeguard. ACKNOWLEDGEMENT We acknowledge the support and funding of CIFAR, Natural Sciences and Engineering Research Council of Canada (NSERC), the Canada Foundation for Innovation (CFI), and Research Nova Scotia. This research was enabled through computational resources provided by the Research Computing Services group at the University of Calgary, ACENET, the regional partner in Atlantic Canada and the Digital Research Alliance of Canada. REFERENCES Andy Arditi, Oscar Obeso, Aaquib Syed, Daniel Paleka, Nina Panickssery, Wes Gurnee, and Neel Nanda. Refusal in language models is mediated by a single direction. Advances in Neural Information Processing Systems, 37:136037–136083, 2024. Junfeng Fang, Nachuan Chen, Houcheng Jiang, Dan Zhang, Fei Shen, Xiang Wang, Xiangnan He, and Tat-Seng Chua. Next-guard: Training-free streaming safeguard without token-level labels. arXiv preprint arXiv:2603.02219, 2026. Ankur Garg, Xuemin Yu, Hassan Sajjad, and Samira Ebrahimi Kahou. Cross-layer discrete concept discovery for interpreting language models. Transactions on Machine Learning Research, 2026. ISSN 2835-8856. URL https://openreview.net/forum?id=XbBvGKSoEG. Agam Goyal, Vedant Rathi, William Yeh, Yian Wang, Yuen Chen, and Hari Sundaram. Breaking bad tokens: Detoxification of llms using sparse autoencoders. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, p. 12691–12709, 2025. 10 Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, et al. The llama 3 herd of models. arXiv preprint arXiv:2407.21783, 2024. Seungju Han, Kavel Rao, Allyson Ettinger, Liwei Jiang, Bill Yuchen Lin, Nathan Lambert, Yejin Choi, and Nouha Dziri. Wildguard: Open one-stop moderation tools for safety risks, jailbreaks, and refusals of llms. Advances in neural information processing systems, 37:8093–8131, 2024. Ruben H ̈ arle, Felix Friedrich, Manuel Brack, Bj ̈ orn Deiseroth, Patrick Schramowski, and Kristian Kersting. Scar: Sparse conditioned autoencoders for concept detection and steering in llms. arXiv preprint arXiv:2411.07122, 2024. Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, et al. Llama guard: Llm-based input-output safeguard for human-ai conversations. arXiv preprint arXiv:2312.06674, 2023. Bruce W Lee, Inkit Padhi, Karthikeyan Natesan Ramamurthy, Erik Miehling, Pierre Dognin, Manish Nagireddy, and Amit Dhurandhar. Programming refusal with conditional activation steering. In International conference on learning representations, volume 2025, p. 90960–90985, 2025. Kenneth Li, Oam Patel, Fernanda Vi ́ egas, Hanspeter Pfister, and Martin Wattenberg. Inference-time intervention: Eliciting truthful answers from a language model. Advances in neural information processing systems, 36:41451–41530, 2023. Xiaodan Li, Mengjie Wu, Yao Zhu, Yunna Lv, YueFeng Chen, Cen Chen, Jianmei Guo, and Hui Xue. Kelp: A streaming safeguard for large models via latent dynamics-guided risk detection. arXiv preprint arXiv:2510.09694, 2025. Samuel Marks, Johannes Treutlein, Trenton Bricken, Jack Lindsey, Jonathan Marcus, Siddharth Mishra-Sharma, Daniel Ziegler, Emmanuel Ameisen, Joshua Batson, Tim Belonax, et al. Auditing language models for hidden objectives. arXiv preprint arXiv:2503.10965, 2025. Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, et al. Harmbench: A standardized evaluation framework for automated red teaming and robust refusal. arXiv preprint arXiv:2402.04249, 2024. Basel Mousi, Nadir Durrani, and Fahim Dalvi. Can llms facilitate interpretation of pre-trained language models? In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, p. 3248–3268, 2023. Paul R ̈ ottger, Hannah Kirk, Bertie Vidgen, Giuseppe Attanasio, Federico Bianchi, and Dirk Hovy. Xstest: A test suite for identifying exaggerated safety behaviours in large language models. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), p. 5377– 5400, 2024. Huizhen Shu, Xuying Li, and Piao Xue. Stop early, spend less: Hidden-state probes as a practical recipe for streaming moderation of llm outputs. arXiv preprint arXiv:2606.10487, 2026. Alex Tamkin, Mohammad Taufeeque, and Noah D Goodman. Codebook features: Sparse and discrete interpretability for neural networks. arXiv preprint arXiv:2310.17230, 2023. InternLM Team.Internlm3:Open-source 8b instruction model for general-purpose usageandadvancedreasoning.https://huggingface.co/internlm/ internlm3-8b-instruct, 2025. Aaron Van Den Oord, Oriol Vinyals, et al. Neural discrete representation learning. Advances in neural information processing systems, 30, 2017. Zhengxuan Wu, Aryaman Arora, Atticus Geiger, Zheng Wang, Jing Huang, Dan Jurafsky, Christo- pher D Manning, and Christopher Potts. Axbench: Steering llms? even simple baselines outperform sparse autoencoders. arXiv preprint arXiv:2501.17148, 2025. 11 Yueqi Xie, Jingwei Yi, Jiawei Shao, Justin Curl, Lingjuan Lyu, Qifeng Chen, Xing Xie, and Fangzhao Wu. Defending chatgpt against jailbreak attack via self-reminders. Nature Machine Intelligence, 5 (12):1486–1496, 2023. Zitao Xuan, Xiaofeng Mao, Da Chen, Xin Zhang, Yuhan Dong, and Jun Zhou. Shieldhead: Decoding- time safeguard for large language models. In Findings of the Association for Computational Linguistics: ACL 2025, p. 18129–18143, 2025. An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, et al. Qwen3 technical report. arXiv preprint arXiv:2505.09388, 2025. Xuemin Yu, Ankur Garg, Samira Ebrahimi Kahou, and Hassan Sajjad. Vector quantized la- tent concepts: A scalable alternative to clustering-based concept discovery. arXiv preprint arXiv:2602.02726, 2026. Xiaohan Yuan, Jinfeng Li, Dongxia Wang, Yuefeng Chen, Xiaofeng Mao, Longtao Huang, Jialuo Chen, Hui Xue, Xiaoxia Liu, Wenhai Wang, et al. S-eval: Towards automated and comprehensive safety evaluation for large language models. Proceedings of the ACM on Software Engineering, 2 (ISSTA):2136–2157, 2025. Andy Zou, Long Phan, Justin Wang, Derek Duenas, Maxwell Lin, Maksym Andriushchenko, Rowan Wang, Zico Kolter, Matt Fredrikson, and Dan Hendrycks. Improving alignment and robustness with circuit breakers. Advances in Neural Information Processing Systems, 37:83345–83373, 2024. 12 APPENDIX CONTENTS A Data and splits14 B Layer selection14 C TRACE implementation15 C.1 Cross-layer VQ model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .15 C.2 Concept statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .16 C.3 Causal detector . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .16 C.4 Concept-conditioned intervention . . . . . . . . . . . . . . . . . . . . . . . . . .17 D Evaluation protocol18 D.1 Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .18 D.2 Steering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .19 D.3 Reproducibility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .19 E Concept audit20 E.1 Labeling the codebook . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .20 E.2 Reading detector traces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .20 E.3 Reading intervention records . . . . . . . . . . . . . . . . . . . . . . . . . . . . .21 E.4 Gemini prompts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .23 F Additional results24 F.1Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .24 F.2Steering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .29 G Compute and efficiency31 G.1 Model size . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .31 G.2 Offline cost . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .31 G.3 Online cost . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .31 H Baselines32 H.1 Detection baselines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .32 H.2 Steering baselines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .33 13 ADATA AND SPLITS We use the WildGuard (Han et al., 2024) and S-Eval (Yuan et al., 2025) responses from Stream- GuardBench (Li et al., 2025). The responses were generated by Qwen3-8B (Yang et al., 2025), Llama-3.1-8B-Instruct (Grattafiori et al., 2024), and InternLM3-8B-Instruct (Team, 2025). Labels describe the response itself, with 1 for harmful and 0 for safe. Table 3 gives the split sizes used by each stage. Table 3: Dataset sizes used for detector training, VQ, steering validation, and official testing. GeneratorDataset Detector train / val VQ train / val / test Steering val safe / harmful Official test safe / harmful Qwen3-8BWildGuard 10,719 / 1,191 9,647 / 536 / 536200 / 2001,441 / 284 S-Eval8,100 / 9007,290 / 404 / 406200 / 200467 / 533 Llama-3.1-8BWildGuard8,327 / 9257,494 / 416 / 417200 / 2001,519 / 206 S-Eval8,100 / 9007,290 / 406 / 404200 / 200547 / 453 InternLM3-8B WildGuard8,556 / 9517,701 / 428 / 427200 / 2001,486 / 239 S-Eval8,100 / 9007,290 / 404 / 406200 / 200615 / 385 Training pools. For WildGuard, we normalize prompts and responses, remove duplicate prompt– response pairs, and keep one response per normalized prompt. When a prompt has several responses, we prioritize harmful responses, then refusals, then other safe responses. We balance these three groups, leaving 11,910 Qwen, 9,252 Llama, and 9,507 InternLM responses after removing two empty InternLM responses. For S-Eval, we use all 9,000 training responses per generator. The official test sets are neither filtered nor rebalanced. Split construction.We stratify each generator–dataset pair by response label with seed 42. Detector validation is held out first. The remaining detector-training pool is then divided into VQ training, validation, and test partitions. Detector-validation responses are not used to train the VQ model, estimate concept harmfulness, or select its checkpoint. Steering sweeps use fixed balanced samples from detector validation. Official test responses are used only for final evaluation. Detector repeats for all six settings are described in Appendix F.1.6. Activation extraction. We format each request with the generator’s chat template and open the assistant turn, with thinking disabled where supported. The stored response is tokenized without additional special tokens and appended to this prefix. We cache only assistant-response positions, up to 2,048 tokens. Padding positions do not contribute to training losses. This preserves the benchmark response and its label while extracting activations from the generator that produced it. BLAYER SELECTION We choose one read layer for each generator and use it for both datasets. The choice is made on WildGuard training responses, while S-Eval is used only to check whether the same layer remains predictive. The selected layer is shared by TRACE, Kelp, and DiffMean. For TRACE, the reconstruction target is four layers later. Following inference-time intervention (ITI) (Li et al., 2023), we train a linear probe at each candidate layer to separate harmful from safe responses. The probe data contain equal numbers of both labels, and each response is represented by the activation of its final retained assistant token. Qwen and Llama responses are capped at 512 tokens for this analysis; InternLM responses are capped at 2,048 tokens. For a model withBtransformer blocks, we test layers 1 throughB− 4so that the reconstruction targetℓ + 4remains within the model. Each probe is an unscaledℓ 2 -regularized logistic regression withC = 1. We select the highest mean accuracy over five stratified folds with seed 42, breaking ties in favor of the earlier layer. We follow Hugging Face indexing: layerℓishiddenstates[ℓ], the output of transformer blockL − 1. Thus, a pair such as20 → 24readshiddenstates[20]and reconstructs hiddenstates[24]. 14 The balanced WildGuard probe pools contain 3,970 Qwen, 3,084 Llama, and 3,169 InternLM responses per class. Figure 6 shows accuracy across all candidate layers. WildGuard selects read layers 20, 14, and 34, respectively, giving read/target pairs 20/24, 14/18, and 34/38. 8162432 0.75 0.80 0.85 Selected: 20 Accuracy: 0.834 Qwen3-8B 6121824 Selected: 14 Accuracy: 0.840 Llama-3.1-8B 10203040 Selected: 34 Accuracy: 0.862 InternLM3-8B Hidden-state layer Cross-validated accuracy Five-fold mean ± SDSelected layer Figure 6: Five-fold WildGuard probe accuracy by read layer. Diamonds mark the selected layers. The selected layers have WildGuard accuracies of0.8343±0.0059,0.8397±0.0099, and 0.8624±0.0101for Qwen, Llama, and InternLM. On balanced S-Eval pools of 3,499, 3,079, and 2,611 responses per class, the same layers reach 0.8374±0.0035, 0.9138±0.0035, and 0.9117±0.0069. As a robustness check, we repeated the Qwen and Llama probes with a 2,048-token cap and seeds 42–44. Each retained read layer was within 0.25 percentage points of the best three-seed mean for the same generator and dataset. CTRACE IMPLEMENTATION C.1CROSS-LAYER VQ MODEL The generators remain frozen while the VQ model is trained. We use the same architecture and training settings for every generator–dataset pair; only the read and reconstruction layers and the training responses change. Encoder and code assignment.The encoder takes the 4,096-dimensional read-layer activation and blends it with a layer-normalized learned projection, as defined in Section 2.1. The learned mixing weight is constrained to(0, 0.5). We do not otherwise rescale the cached activations. The encoded activation is assigned to one of 800 codebook vectors. During training, we sample from the ten nearest vectors with temperature 1. Evaluation, detection, and steering always use the nearest vector. Codebook initialization and updates. We initialize the codebook by running sphericalk-means on up to 200,000 training-token activations. Each centroid is rescaled to the mean activation norm of the tokens in its cluster. During training, codebook vectors are updated by exponential moving average (EMA) with decay 0.99 and constant10 −5 . A code whose moving count remains below 1 for 100 updates is reinitialized from a current training activation, with at most five codes reset in one update. Causal decoder.The decoder receives the assigned codebook vectors and reconstructs the residual- stream activations four transformer blocks after the read layer. It has four pre-RMSNorm transformer blocks, 16 attention heads, rotary position embeddings, and SwiGLU feed-forward layers of width 6,144. It uses no dropout. Causal attention ensures that the reconstruction at tokentdepends only on assignments at positions up to t. Training objective.The loss combines reconstruction, commitment, code utilization, and harmful- region separation. Writing the decoder reconstruction asex u t , the reconstruction term is the mean relative squared error over the non-padding response tokensT , 15 L rec = 1 |T| X t∈T ∥ex u t − x u t ∥ 2 2 ∥x u t ∥ 2 2 + 10 −8 .(9) The commitment loss keeps each encoder output close to its assigned vector. A straight-through estimator carries reconstruction gradients through the discrete assignment, while the codebook itself is updated by EMA. The utilization loss islog(K/P), wherePis the soft-assignment perplexity at temperature 0.2. The region loss penalizes assignment probability placed on harmful codes for a safe response, or on benign codes for a harmful response. Its soft assignments use temperature 1. We determine the two code regions from response-level code presence with prior strength 10 and recompute them after every epoch. The commitment, utilization, and region losses have weights 0.1, 0.01, and 5, respectively. Optimization and checkpoint selection. We train for 100 epochs with AdamW, learning rate 3× 10 −4 , and weight decay10 −4 . Each batch contains 16 responses, and gradients are accumulated over four batches and clipped at global norm 1. The learning rate has a 5% warmup followed by cosine decay to 10% of its peak value. All runs use seed 42. We retain the checkpoint that minimizes 1 2 L val rec L 0 rec + L val region L 0 region ! ,(10) where the denominators are the validation losses before training. This criterion gives equal weight to relative improvement in reconstruction and region separation. C.2CONCEPT STATISTICS Once a VQ checkpoint has been selected, its codebook and concept harmfulness scores remain fixed. We then compute the activation means and response counts needed by detection and steering. Concept harmfulness. The scores c stored in the VQ checkpoint is estimated from the harmful and safe responses in the VQ training split. A concept contributes at most once per response, and the estimate is smoothed toward the harmful-response rate with prior strength 10. Positive scores define harmful concepts, while scores at or below zero define benign concepts. The detector receivess c as an input feature and adds a scaled copy to the token-hazard logit. Steering uses the same score to decide which concepts to edit and how strongly to edit them. Detector statistics. After dividing the detector data into training and validation partitions, we compute two additional quantities from the detector-training partition only. First,N det c counts the number of training responses containing conceptc, with each response counted once. We normalize it as e N c = log(1 + N det c ) log(1 + max j N det j ) .(11) This normalized response count does not use response labels. Second, we average the read-layer activations of all detector-training tokens assigned to each concept, giving a detector meanμ det c . If a concept does not occur in this partition, we use its learned codebook vector. The detector receives both e N c and μ det c . Steering statistics. Steering uses separate meansμ vq c , computed from tokens in the VQ training split. These means define the harmful-to-benign directions used for intervention. The detector and steering therefore use means estimated from their respective training partitions. C.3CAUSAL DETECTOR Detector input. The reported detector combines the current token activation with the mean of its assigned concept. The token activation and concept mean are projected separately from 4,096 to 256 16 dimensions, followed by layer normalization and dropout. We concatenate the two projections with s c t and e N c t , giving a 514-dimensional input to a one-layer, unidirectional GRU. The GRU begins from a zero state and processes response tokens only. The response activations still contain prompt context because they come from the generator’s causal forward pass. Prediction heads. The response head maps the final valid GRU state to safe and harmful logits. The streaming head produces a conditional hazard at every token. Before the sigmoid, its logit receives an additional term equal to the assigned concept’s harmfulness score multiplied by the fixed harmfulness-score weight in Table 4. The hazard-head weights start at zero. Its initial bias is chosen so that the cumulative risk at the mean training-response length matches the harmful-response rate. The cumulative risk is then computed from the token hazards as described in Section 2.3. Training objective.Both heads learn from the response label; no token-level harm-onset labels are used. The response head uses cross-entropy at the final token, and the streaming head uses binary cross-entropy on the final cumulative risk. Safe responses have weight 1, while harmful responses have weightn safe /n harmful in both losses. The response-loss weight is 1, and Table 4 gives the streaming-loss weight. Padding is excluded from the recurrent computation and the streaming loss. Training and model selection. We train with AdamW for at most 30 epochs using batches of 16 responses and clip gradients at global norm 1. The learning-rate scheduler halves the rate after three consecutive epochs without a lower validation loss, down to10 −6 . Early stopping occurs after six epochs without improvement in the checkpoint-selection score. For every generator, we select the epoch with the highest mean validation AP across the response and streaming heads. Validation loss controls the learning-rate schedule but does not select the checkpoint. Hyperparameter selection. For each generator, we run a separate 100-trial Optuna search on each dataset. The objective is mean validation F1 across the two heads. We use a multivariate TPE sampler with 12 startup trials and seed 42. The search covers GRU widths64, 96, 128, 192, 256, dropout from 0 to 0.5 in steps of 0.05, and learning rates sampled log-uniformly from10 −5 to 5 × 10 −4 . Weight decay is chosen from0, 10 −6 , 10 −5 , 10 −4 , 10 −3 , 10 −2 , the streaming-loss weight is sampled log-uniformly from 0.5 to 2, and the harmfulness-score weight ranges from 0 to 2 in steps of 0.25. Both input projections remain 256-dimensional. Table 4 gives the settings used for final training. All reported detectors use the mean-AP checkpoint rule. Table 4: Hyperparameters used for final causal-detector training. GeneratorDataset Hidden size Learning rate Weight decayDropout Streaming weight Harmfulness weight Qwen3-8BWildGuard642.44× 10 −4 00.401.8321.00 S-Eval644.37× 10 −4 10 −6 0.350.8271.75 Llama-3.1-8BWildGuard646.50× 10 −5 10 −2 0.150.7381.25 S-Eval647.15× 10 −5 10 −4 0.151.0601.50 InternLM3-8B WildGuard644.48× 10 −5 10 −5 0.050.8380.75 S-Eval2562.90× 10 −4 10 −2 0.351.7270.50 C.4CONCEPT-CONDITIONED INTERVENTION During steering, the learned codebook assigns each activation to a concept. Concept means estimated from the VQ training split define how an assigned activation is changed. Preparing the edit.For each harmful concepth, we choose the nearest benign concept that occurs in at least ten VQ training responses. This pairing is computed once before generation. Its direction is∆ h = μ vq b(h) − μ vq h , from the harmful mean toward the selected target mean. We also fix the gate g h from the normalized harmfulness score defined in Section 2.4. The strongest harmful concept has g h = 1, less harmful concepts receive smaller edits, and benign concepts are not edited. 17 Editing an activation. For a generated token assigned to harmful concepth, we rotate its read- layer activationx ℓ t toward∆ h while preserving its original norm. Definebx ℓ t = x ℓ t /∥x ℓ t ∥ 2 , b ∆ h = ∆ h /∥∆ h ∥ 2 , α h = λg h , and θ t = arccos((bx ℓ t ) ⊤ b ∆ h ). The update is x ℓ′ t =∥x ℓ t ∥ 2 sin((1− α h )θ t ) sinθ t bx ℓ t + sin(α h θ t ) sinθ t b ∆ h .(12) This is spherical interpolation between the activation direction and the source-to-target direction. The parameterλsets the maximum rotation, whileg h reduces the rotation for concepts with lower harmfulness scores. When the edit is applied. The initial prompt pass is left unchanged, so the first generated token is unsteered. On each later decoding step, the hook examines the read-layer activation of the most recently generated token, assigns it to a concept, and applies the edit when that concept is harmful. The edited activation is then used to predict the next token. Thus, an edit recorded at response position tacts on tokentand affects the prediction at positiont + 1. Assignment is repeated at every step, allowing the source concept to change as generation proceeds. Vector normalization uses an additive constant of 10 −6 , and cosine values are clipped to [−0.9999, 0.9999]. Selecting the strength.All reported TRACE steering results use the norm-preserving update with λ = 0.5as the default strength. For each generator and dataset, we also testλ∈0.75, 1on 200 harmful and 200 safe validation responses. We use a stronger setting only when it lowers validation HarmBench ASR, harmful responses have mean non-repetition above 0.5, mean∆NLL at most 1, and mean edited-token fraction at most 0.9, and no more than 20 originally safe validation responses newly fail the basic text-quality check. If both stronger settings meet these conditions, we choose the one with lower validation ASR. We includeλ = 0.25only as a sensitivity analysis. Appendix F.2 reports the full sweeps and steering ablations. DEVALUATION PROTOCOL D.1DETECTION Response and streaming scores. For completed-response detection, TRACE uses the response- head probability at the final retained token. Its streaming score is the cumulative risk at each token. Kelp also uses its final token for completed-response detection, but its streaming score is the maximum harmful-class probability seen up to that point. Unlike TRACE’s cumulative risk, Kelp’s token probabilities can decrease as the response continues. DiffMean uses the maximum token projection for both completed-response and streaming evaluation. WildGuard directly returns a harmful or unharmful label for the completed prompt–response pair and has no streaming output. We count an unparseable WildGuard output as an incorrect prediction and report the number of such outputs. Metrics and thresholds. We treat harmful responses as the positive class and report harmful- class F1, FPR, AUROC, and AP. The FPR denominator contains only originally safe responses. TRACE and Kelp use threshold 0.5 in the main detection tables. DiffMean selects the threshold that maximizes validation F1, breaking ties in favor of lower FPR. The same frozen threshold is used for its completed-response and streaming results because both use the same maximum-projection score. Detection position. For a response that crosses its method’s threshold, the detection position is the first crossing token divided by the retained response length. It measures progress through the response, not elapsed generation time, and is defined only for responses that are detected. For Figures 9 and 10, each method selects the threshold with the highest recall among those with FPR at most 5% on held-out validation responses. We then freeze the threshold for the official test set. The Kelp calibration heads exclude every training row whose prompt appears in the validation split. Duplicates within the remaining training data are retained. 18 D.2STEERING Generation protocol. For each method, the unsteered and steered runs use the same prompts and generation settings. We use greedy decoding, disable thinking where the generator supports it, and allow at most 2,048 generated tokens. Appendix F.2 gives the TRACE settings, and Appendix H gives the baseline settings. Attack success.HarmBench ASR is the fraction of new generations judged harmful among prompts whose original response is labeled harmful. We use the official HarmBench Llama-2-13B classifier prompt (Mazeika et al., 2024) and truncate each candidate generation to 512 classifier tokens before judging it. Throughout the steering evaluation, “harmful” and “safe” refer to the original response labels. Each method is evaluated against its matched unsteered generation. Refusal on safe responses. For prompts whose original response is labeled safe, we report the refusal rate before and after steering. Following Arditi et al. (2024), a response counts as a refusal when a case-insensitive match finds one of the following phrases: “I’m sorry,” “I am sorry,” “I apologize,” “As an AI,” “As a language model,” “As an assistant,” “I cannot,” “I can’t,” “I am unable to,” “I’m unable to,” “I am not able to,” or “I’m not able to.” The before and after rates always use the same prompts and the matched unsteered control for that method. Quality diagnostics. We use three diagnostics to decide whether to increase the TRACE strength above 0.5. 1. Non-repetition. LetG 3 (y)be the list of word trigrams in responsey. For a response containing at least one trigram, we compute NR(y) = | unique(G 3 (y))| |G 3 (y)| . The score is 1 when every trigram is unique and is defined as 1 when the response contains no trigrams. We set it to zero when the response has fewer than 20 non-space characters, fewer than 60% alphabetic non-space characters, or one whitespace-delimited token accounts for more than 30% of its words. 2.Change in response-token NLL. Using the frozen generator without intervention, we compute NLL(y) =− 1 T T X t=1 logp θ (y t | p,y <t ), where p is the prompt and T is the response length. The change caused by steering is ∆ NLL = NLL(y steered )− NLL(y unsteered ). 3. Edited-token fraction. We measure the fraction of generation steps at which TRACE applies an activation edit: E(y) = 1 T T X t=1 ⊮an edit is applied at step t. For each strength, we average these diagnostics over the 200 harmful validation responses and require NR > 0.5,∆ NLL≤ 1, andE ≤ 0.9. For the 200 originally safe responses, we also count how many pass these limits before steering but fail afterward, and require this count to be at most 20. These diagnostics measure text degradation associated with steering. HarmBench provides the harmfulness judgment. D.3REPRODUCIBILITY All generator weights remain frozen. We use PyTorch 2.12.0, Transformers 5.9.0, and FAISS 1.8.0. TRACE training uses bfloat16 autocasting and computes the reconstruction loss and cumulative risk in float32. Unless stated otherwise, seed 42 is used for the data splits, VQ and detector training, 19 and steering-validation samples. Detector repeats for all six settings and the layer-probe checks also use seeds 43 and 44. The detector repeats reuse the seed-42 VQ checkpoint and hyperparameters. Generation is greedy. For InternLM, the rotary-embedding frequencies are initialized from the model configuration before inference. ECONCEPT AUDIT The audit starts by assigning descriptions and safety labels to codebook entries from their occurrences in the training data. We then use these labels to examine the concept sequences saved during detection and the source–target pairs saved during intervention. E.1LABELING THE CODEBOOK Sampling examples. We audit the finalK = 800Qwen/WildGuard codebook using assignments from the VQ training split. A concept enters the audit if it appears in at least 25 of the 9,647 training responses. We sample one assigned position from each of 25 responses and show up to 512 preceding response tokens, excluding the prompt. This sampling is repeated independently with seeds 42–44, giving three sets of examples for each concept. Assigning and checking labels.Gemini-3.1-Flash-Lite reads each set of 25 examples and decides whether it shows a clear recurring pattern, a mixture of patterns, or no pattern. For a clear pattern, it gives a short name and labels the content as harmful, benign, or neutral. When at least two runs produce a clear description, a separate temperature-zero query checks whether any two descriptions refer to the same recurring pattern. If so, it assigns a consensus name to the concept. The safety label is chosen by majority vote among the agreeing runs. A named concept without a majority safety label is marked safety-ambiguous. The model does not see detector predictions or learned harmfulness scores. It judges fictional, educational, translated, encoded, and role-play excerpts by their content and ignores abrupt cutoffs caused by sampling. The exact prompts appear in Appendix E.4. Label coverage. Of the 800 entries, 796 appear in at least 25 training responses. At least two labeling runs return a clear description for 546 of them, and the agreement check retains a consensus name for 422. The other four do not meet the frequency requirement, 250 lack two clear descriptions, and 124 fail semantic agreement. Of the 422 named concepts, 392 also receive a majority safety label: 32 harmful, 126 benign, and 234 neutral. The remaining 30 are safety-ambiguous. The named concepts account for 581,134 of the 1,251,426 concept assignments on the test set (46.4%). E.2READING DETECTOR TRACES Building the traces. We use the fixed threshold of 0.5 from Table 1. For a detected response, the trace ends at the first threshold crossing. For an undetected response, it covers the full retained response. Consecutive occurrences of the same concept are merged before we calculate the fraction of each trace assigned to each safety category. Table 5 reports the mean of these fractions across responses, with equal weight for every response. “Ambiguous” denotes an agreed concept name without an agreed safety label, while “No agreed name” denotes a failure to reach semantic consensus. Table 5: Mean Qwen/WildGuard concept-category share by detection outcome (%). Outcomen Harmful Benign Neutral Ambiguous No agreed name True positive2515.951.0113.513.7775.75 False positive654.951.3113.763.6476.34 False negative331.668.3421.733.4264.85 True negative1,3760.2326.6027.633.8941.65 Reading the concept clouds.The main-paper concept cloud aggregates all 251 true positives and 1,376 true negatives and shows the ten most frequent named concepts in each panel. The harmful- response panel retains concepts labeled harmful, benign, or safety-ambiguous. The two safe-response 20 panels include concepts labeled benign and divide them using their normalized consensus names. A name is treated as refusal-related if it contains refusal, a form of refuse, decline, reject, or deny, or the terms cannot, unable, or will not. Concepts with the same normalized name and safety label are combined in the figure but remain separate codebook entries. Figure 7 shows the most frequent false-positive concepts and splits false-negative concepts into refusal-related and non-refusal groups using the same name rule. False positives often contain instructional, educational, or fictional framing also found in harmful responses. False negatives contain more benign and neutral concept runs than true positives. Fictional or Role- play Narrative Framing Educational Simulation Framework Instructional guides for illicit or unethical activities Narrative framing for content delivery Narrative Framing for Harmful or Dystopian Scenarios Structured instructional narrative Narrative framing of harmful or controversial content Fictional Narrative Framing for Harmful Content Step-by-step instructional planning Instructional framing for harmful content Top concepts across 65 test responses False positives Refusal and redirection Refusal of harmful requests Refusal and Pivot Refusal and safety disclaimer Refusal of harmful content Refusal and Warning of Harmful Content Refusal of harmful or unethical requests Refusal to disclose personal or private information Refusal and redirection to safe alternatives Refusal and Educational Pivot Top refusal-related concepts across 33 test responses Narrative and role- play framing Definition completion Hypothetical or fictional framing Structured instructional narrative Structured Instructional or Narrative Formatting Structured Instructional Guidance Structured Explanatory List Sectional Header Consequences of harmful actions Conclusion section Top non-refusal concepts across 33 test responses False negatives HarmfulBenignSafety ambiguous Figure 7: Most frequent named concepts in Qwen/WildGuard detection errors at threshold 0.5. False-negative concepts are separated into refusal-related and non-refusal groups. E.3READING INTERVENTION RECORDS Collecting edit records. We run the selected Qwen/WildGuard setting (λ = 0.75) on all 1,725 official-test prompts. This separate generation run uses the same model, checkpoint, prompts, and intervention settings as Table 2; it is used only to collect concept records. The steering results in the table are unchanged. For every edit, we save the harmful source concept and its fixed target among concepts with s c ≤ 0. The intervention edits 283 of 284 harmful responses and records 267,132 edit events. It also edits 1,081 of 1,441 safe responses, producing 195,792 events. Overall, 1,364 of the 1,725 responses (79.1%) receive at least one edit. Matching records to labels.Both the source and target have agreed semantic names in 7.9% of the 462,924 edit events. We therefore also report coverage by response in Figure 4, so a long response with many edits does not dominate the count. Of the 283 edited harmful responses, 235 contain a named source independently labeled harmful and 256 contain a named target labeled benign. Among the edited harmful responses, 79 contain an edit whose source has an agreed harmful label and whose target has an agreed benign label. These edits comprise five distinct source–target pairs, all reported in Table 6. Each pair is counted at most once per response. 21 Table 6: Named harmful-to-benign concept pairs in edited Qwen/WildGuard responses. Counts are over distinct responses. Harmful source conceptBenign target conceptResponses Instructional guides for cyberattacks and data exploitation Information request refusal30 Instructional content for harmful activitiesReferences to external legal or professional resources 29 Instructional guides for illicit or harmful ac- tivities External source and regulatory citation27 Deceptive framing in fictional or hypothetical scenarios Refusal of harmful requests22 Fictional narrative framing for harmful con- tent Refusal of harmful requests22 Comparing generated responses. To compare the text produced with and without intervention, we run both outputs through the model without steering and assign the resulting response activations to concepts. Figure 5 shows these concepts in the completed outputs, while the intervention records contain the source concept observed before each edit during generation. Each response is divided into four contiguous token intervals. Within an interval, consecutive repetitions are merged and a normalized concept name is counted at most once per response. Each panel shows the five most frequent named concepts, ordered by the fraction of responses in which they appear. For each response and interval, the edited-token fraction is the number of edited positions divided by the number of generated positions. The figure averages this fraction across responses. Unsteered responses ( n = 1, 441 ) Refusal of harmful requests Refusal and redirection Refusal of requests Refusal and safety disclaimer Offer of further assistance 0–25% Refusal of harmful requests Refusal and redirection Structured instructional guide Refusal of harmful content Refusal and Warning of Harmful Content 25–50% Refusal of harmful requests Refusal and redirection Structured Instructional Guidance Structured instructional guide Refusal of harmful content 50–75% Refusal of harmful requests Refusal and redirection Refusal and Pivot Offer of further assistance Conclusion section 75–100% TRACE-steered responses ( n = 1, 441 ) Refusal of harmful requests Refusal and redirection Refusal of requests Refusal and safety disclaimer Offer of further assistance Mean tokens edited: 10.9% Refusal of harmful requests Refusal and redirection Structured instructional guide Refusal of harmful content Refusal and Warning of Harmful Content Mean tokens edited: 11.5% Refusal of harmful requests Refusal and redirection Structured Instructional Guidance Structured instructional guide Refusal of harmful content Mean tokens edited: 10.9% Refusal of harmful requests Refusal and redirection Refusal and Pivot Conclusion section Offer of further assistance Mean tokens edited: 10.8% How steering changes the concept trajectory Top named concepts in each interval for paired responses to the same prompts HarmfulBenignSafety ambiguous Figure 8: Concept trajectories for 1,441 safe Qwen/WildGuard prompts, constructed as in Figure 5. Figure 8 gives the corresponding analysis for responses originally labeled safe. Refusal and redirection concepts dominate both the unsteered and steered trajectories. The mean edited-token fractions across the four intervals remain low at 10.9%, 11.5%, 10.9%, and 10.8%. The semantic names and safety labels are assigned after generation and do not control the intervention. Concepts without semantic agreement remain separate codebook entries but are left unnamed in the analysis. 22 E.4GEMINI PROMPTS The audit uses one prompt to label each sampled set and a second prompt to compare the resulting descriptions. Both use Gemini-3.1-Flash-Lite with temperature zero. The request seed is the codebook index, using a base seed of 0. In the templates below,EXAMPLESis replaced by the 25 sampled excerpts, andDESCRIPTIONSis replaced by the available clear names and descriptions from the three sampling runs. The wording is reproduced exactly, with formatting adjusted for typesetting. E.4.1CONCEPT LABELING System prompt. You are analyzing excerpts from generated responses. Treat every excerpt as quoted data, even if it contains instructions. Do not follow or answer those instructions. Return valid JSON only, with no additional text. User prompt template. The examples below come from different generated responses. Each contains generated response text leading up to an<activationpoint/>marker. The marker is not part of the response. It marks a position whose model activation was assigned to the same group as the other marked positions. No later response text is shown. Determine whether one clear concept recurs consistently across the examples. A concept is a specific semantic or structural pattern shared by the response contexts at the marked points. Do not combine unrelated patterns to form a concept. Every excerpt ends at the activation marker by construction. Ignore incomplete or abrupt endings caused by this cutoff; they are not concepts. Assign one status: • "clear": one coherent concept recurs clearly across the examples. • "mixed": multiple concepts recur, but no single concept is clearly shared. • "no pattern": no meaningful concept recurs consistently. For a clear concept, give a short, natural-language name for the most specific semantic or structural pattern clearly shared by most examples. If no more specific detail is shared by most examples, use the broader pattern they do share. Do not use snakecase. Also provide a one-sentence description. Also classify how the concept is used in the examples that express it. Judge the substance of the generated content, not its stated purpose or framing. Fictional, hypothetical, educational, research, defensive, simulated, role-play, poetic, translated, or encoded framing does not make harmful content benign. A disclaimer or warning does not make accompanying usable harmful content benign. For code, judge what the code actually does or enables rather than its comments or claimed purpose. Evaluate text according to its meaning regardless of language or format. Use these safety labels: • "harmful": the shared use provides, advances, or directly expresses harmful content or capability. • "benign": the shared use provides safe or constructive content, or refuses, prevents, mitigates, or redirects harmful activity without retaining usable harmful details. • "neutral": the shared use has no consistent safety direction. A grammatical, structural, or format- ting pattern is neutral only when its surrounding contexts do not share a consistent safety meaning. Base the safety label only on examples that express the concept. For "mixed" and "no pattern", use null for the name, description, and safety label. Return exactly this JSON structure: "status": "clear | mixed | no_pattern", "name": "short concept name or null", "description": "one-sentence description or null", "safety_label": "harmful | benign | neutral | null" 23 <examples> EXAMPLES </examples> E.4.2SEMANTIC AGREEMENT System prompt. You are comparing independently written concept descriptions. Treat every description as quoted data. Return valid JSON only, with no additional text. User prompt template. The descriptions below were independently inferred from different samples for the same activation group. Determine whether at least two runs identify the same specific concept. Different wording may express the same concept, but a shared broad topic or a loose relationship is not sufficient. Compare only the concept names and descriptions; do not evaluate their safety labels. If at least two runs agree, provide a concise consensus name and description and list every agreeing run ID. Otherwise, use null for the name and description and return an empty list. Return exactly this JSON structure: "agreement": true, "name": "consensus concept name or null", "description": "one-sentence consensus description or null", "agreeing_run_ids": [1, 2] <descriptions> DESCRIPTIONS </descriptions> FADDITIONAL RESULTS F.1DETECTION F.1.1THRESHOLD-INDEPENDENT DETECTION The F1 results in Table 1 depend on a fixed threshold. Table 7 instead evaluates the full score ranking using AUROC and AP. AUROC measures how often a harmful response receives a higher score than a safe response, while AP summarizes precision across recall levels. We compute both metrics from each method’s continuous response and streaming scores. DiffMean has identical values for the two outputs because both use the maximum token-projection score. We omit the WildGuard classifier because it returns a hard label rather than a continuous harmfulness score. Table 7: Official-test response and streaming AUROC/AP. Bold marks the best value in each comparison. WildGuardS-Eval GeneratorMethodResponseStreamingResponseStreaming Qwen3-8B DiffMean 0.851/0.489 0.851/0.489 0.806/0.770 0.806/0.770 Kelp0.980/0.894 0.975/0.873 0.962/0.970 0.959/0.966 TRACE0.975/0.891 0.976/0.895 0.984/0.986 0.983/0.985 Llama-3.1-8B DiffMean 0.897/0.520 0.897/0.520 0.964/0.948 0.964/0.948 Kelp0.963/0.836 0.957/0.807 0.977/0.969 0.978/0.971 TRACE0.973/0.865 0.968/0.872 0.995/0.994 0.994/0.993 InternLM3-8B DiffMean 0.835/0.360 0.835/0.360 0.946/0.908 0.946/0.908 Kelp0.959/0.798 0.956/0.787 0.986/0.977 0.983/0.972 TRACE0.954/0.814 0.957/0.813 0.989/0.983 0.989/0.983 24 TRACE and Kelp outperform DiffMean across all three generators and both datasets. On both Llama datasets, Qwen/S-Eval, and InternLM/S-Eval, TRACE has higher response and streaming AUROC and AP than Kelp. On Qwen/WildGuard, Kelp leads the two response metrics while TRACE leads the two streaming metrics. On InternLM/WildGuard, Kelp leads response AUROC, while TRACE leads response AP and both streaming metrics. Overall, the ranking metrics favor TRACE on Llama and S-Eval, while the two remaining WildGuard comparisons are mixed. F.1.2DETECTION-POSITION DISTRIBUTIONS A single median position describes only the harmful responses a method detects. Figure 9 instead shows how detection accumulates across all harmful responses, including those that are missed. Each method uses the validation-selected threshold from Appendix D. At a given response position, the curve gives the fraction of all harmful test responses detected by that point. Its final height is therefore the method’s recall. TRACE reaches a higher final recall in all six panels. Its median first-detection position is also earlier on all three S-Eval generators and on Llama/WildGuard. Kelp has an earlier median on Qwen/WildGuard and InternLM/WildGuard. The timing–recall tradeoff is clearest on InternLM. On WildGuard, the methods have almost the same recall, but Kelp’s median is 3.7% of the response compared with 27.9% for TRACE. On S-Eval, TRACE has both higher recall (89.1% versus 84.9%) and an earlier median (8.3% versus 13.7%). 0 20 40 60 80 100 WildGuard Qwen3-8BLlama-3.1-8BInternLM3-8B 020406080100 0 20 40 60 80 100 S-Eval 020406080100020406080100 Detection-position distributions at 5% FPR Response completed (%) Harmful responses detected (%) TRACEKelp Figure 9: Cumulative first-detection coverage at thresholds selected for a 5% validation FPR. Rows are datasets and columns are generators. F.1.3RESPONSE LENGTH A longer response gives a streaming detector more opportunities to cross its operating threshold. This can increase harmful-response recall, but it can also create more false positives on safe responses. Figure 10 tests how both quantities change with response length and whether the comparison between TRACE and Kelp holds across the length range. For each method, we sort harmful and safe test responses separately from shortest to longest and divide them into five groups containing roughly the same number of responses. These groups are the response-length quintiles. Harmful-response quintiles are used to measure recall, and safe-response quintiles are used to measure FPR. Each method uses its validation-selected operating point from Figure 9. 25 WildGuard 40 60 80 100 Harmful recall (%) ↑ Qwen3-8BLlama-3.1-8BInternLM3-8B Q1 shortest Q2Q3Q4Q5 longest 0 10 20 30 Safe FPR (%) ↓ Q1 shortest Q2Q3Q4Q5 longest Q1 shortest Q2Q3Q4Q5 longest S-Eval 40 60 80 100 Harmful recall (%) ↑ Qwen3-8BLlama-3.1-8BInternLM3-8B Q1 shortest Q2Q3Q4Q5 longest 0 10 20 30 Safe FPR (%) ↓ Q1 shortest Q2Q3Q4Q5 longest Q1 shortest Q2Q3Q4Q5 longest Response-length quintile (within each method and true class) Detection across response lengths TRACEKelp Figure 10: Harmful recall and safe-response FPR by retained-length quintile. For each method, harmful and safe responses are sorted separately by length, and each quintile contains roughly one fifth of the corresponding responses. Error bars are 95% Wilson intervals. Across the 30 generator–dataset–quintile comparisons, TRACE has higher harmful-response recall than Kelp in 24 and ties in two. Its safe-response FPR is lower in 11 quintiles, equal in 11, and higher in eight. The recall difference is clearest on S-Eval, where TRACE leads in 13 of 15 quintiles, ties in one, and trails only in the longest Qwen quintile. For both methods, most S-Eval false positives occur in the longest quintile of safe responses. WildGuard is less uniform: TRACE leads all five Llama recall quintiles, while the Qwen and InternLM comparisons vary with length. The analysis shows that TRACE’s S-Eval recall advantage extends across nearly the full length range and that aggregate FPR can hide a concentration of false positives on long responses. F.1.4CROSS-GENERATOR RESPONSE TRANSFER Training a detector for a new generator normally requires collecting and labeling that model’s responses. We ask whether labeled responses already collected from another generator can be reused. Following Kelp’s S-Eval setup, we run the source generator’s response texts through the frozen target generator to extract target-model activations. TRACE trains a new target-specific codebook and detector from these activations, while Kelp trains a new target-specific head. We evaluate both methods on the target generator’s S-Eval test responses. 26 This experiment transfers the labeled response corpus, not a trained detector or a set of activations. It still requires white-box access to the target generator and training new components for that model. We keep the target generator’s layer and detector hyperparameters fixed. TRACE checkpoints are selected by validation AP, as in the main experiments. Table 8: S-Eval F1 when each target detector is trained on responses from the target generator or another generator. Activations and detector components are target-specific. Bold marks the higher value for each row. Target generator Training responsesTRACEKelp Response Streaming Response Streaming Qwen3-8B Qwen (same generator)0.9330.9350.9000.896 Llama0.9100.8860.8240.802 InternLM0.9330.9280.8750.887 Llama-3.1-8B Llama (same generator)0.9660.9610.9160.919 Qwen0.9520.9430.7790.909 InternLM0.9440.9070.6050.866 InternLM3-8B InternLM (same generator)0.9250.9180.9060.904 Qwen0.9180.9290.9090.903 Llama0.8870.8710.8930.868 For TRACE, cross-generator training stays within 0.055 F1 of same-generator training for every target, source, and output. The source still matters. For a Qwen target, InternLM responses match the same-generator response F1 and are 0.006 lower in streaming F1, while Llama responses are 0.023 and 0.049 lower. The largest TRACE drop is 0.054 in streaming F1 when InternLM responses train the Llama detector. TRACE has higher response and streaming F1 than Kelp in five of the six transfer directions. In the remaining direction, where Llama responses train the InternLM detector, Kelp leads response F1 by 0.006 and TRACE leads streaming F1 by 0.003. Kelp varies more across response sources: its response F1 for a Llama target falls from 0.916 with same-generator responses to 0.605 with InternLM responses. These results show that an existing labeled response corpus can reduce the need to collect labeled responses from a new target generator, although target-specific activation collection and training are still required. F.1.5DETECTOR VARIANTS The detector combines the current activation with features of its assigned concept. Table 9 tests how much each input contributes and how three choices in the concept representation affect F1 on Qwen3- 8B. Each detector-input variant uses its own validation-selected checkpoint. The codebook-size and concept-representative comparisons use both inputs. We test the region loss with the concept-only detector so that the comparison directly reflects changes in the concept representation. 27 Table 9: Qwen3-8B harmful-class F1 ablations on the official test sets at threshold 0.5. Bold marks the best value within each comparison. ComparisonVariantWildGuardS-Eval ResponseStreamingResponseStreaming Detector input Activation only0.8360.8440.9290.934 Concept only0.8170.7950.9160.916 Activation and concept0.8350.8370.9330.935 Codebook size 4000.8200.8200.9300.928 8000.8350.8370.9330.935 1,2000.8270.8360.9390.938 Concept representative Learned codebook vector0.8240.8170.9310.929 Mean assigned activation0.8350.8370.9330.935 Region supervision Without region loss0.7030.6860.9130.910 With region loss0.8170.7950.9160.916 The concept-only detector remains predictive, but does not match the activation-only detector. Combining the two inputs changes F1 by at most 0.007: activation-only is best on WildGuard, while the combined detector is best on S-Eval. This suggests that concept features are not primarily responsible for detection accuracy; instead, they preserve performance close to activation-only while exposing the same discrete representation for steering and auditing. Region supervision has the clearest effect on WildGuard, where it raises concept-only response and streaming F1 by 0.114 and 0.109. Mean assigned activations outperform learned codebook vectors in all four comparisons. A codebook size of 800 is best on WildGuard and 1,200 is best on S-Eval, so increasing the codebook does not help consistently. F.1.6DETECTOR SEED VARIATION Table 10 summarizes detector runs with seeds 42–44 for every generator and dataset. Seed 42 is used in the main tables. Seeds 43 and 44 change the detector split and training randomness but reuse the seed-42 VQ checkpoint and detector hyperparameters. The table therefore measures detector variation with a fixed representation rather than variation across the full pipeline. Table 10: Detector results across seeds 42–44 (mean±sample standard deviation). F1 and FPR use threshold 0.5. GeneratorDatasetOutputF1FPRAUROCAP Qwen3-8B WildGuard Response 0.8382± 0.0039 0.0354± 0.0127 0.9753± 0.0009 0.8976± 0.0058 Streaming 0.8357± 0.0062 0.0333± 0.0103 0.9754± 0.0013 0.9010± 0.0065 S-Eval Response 0.9296± 0.0112 0.0607± 0.0279 0.9837± 0.0008 0.9859± 0.0002 Streaming 0.9312± 0.0105 0.0592± 0.0216 0.9834± 0.0008 0.9860± 0.0008 Llama-3.1-8B WildGuard Response 0.7908± 0.0048 0.0369± 0.0040 0.9738± 0.0016 0.8677± 0.0027 Streaming 0.7777± 0.0286 0.0424± 0.0130 0.9684± 0.0038 0.8642± 0.0079 S-Eval Response 0.9576± 0.0076 0.0274± 0.0018 0.9947± 0.0003 0.9933± 0.0005 Streaming 0.9545± 0.0065 0.0274± 0.0018 0.9939± 0.0005 0.9924± 0.0007 InternLM3-8B WildGuard Response 0.7427± 0.0230 0.0727± 0.0155 0.9577± 0.0031 0.8169± 0.0039 Streaming 0.7447± 0.0154 0.0671± 0.0149 0.9583± 0.0012 0.8139± 0.0111 S-Eval Response 0.9257± 0.0019 0.0558± 0.0094 0.9890± 0.0002 0.9830± 0.0002 Streaming 0.9254± 0.0069 0.0461± 0.0066 0.9894± 0.0007 0.9838± 0.0007 The ranking metrics change little across seeds, and response and streaming F1 remain close to the main runs. Llama/WildGuard streaming F1 varies the most. Because the runs reuse the seed-42 VQ model, the table does not estimate variation across independently trained VQ representations. 28 F.2STEERING F.2.1EFFECT OF STEERING STRENGTH We evaluateλ ∈ 0.25, 0.5, 0.75, 1on 200 harmful and 200 safe validation responses for each generator–dataset pair. The default strength is 0.5. We include 0.25 to measure a weaker edit and use 0.75 and 1 to test stronger edits. Figure 11 shows that validation ASR decreases asλincreases in all six settings. The next section examines response quality at the same strengths. 00.250.500.751.00 0.0 0.2 0.4 0.6 0.8 Qwen3-8B 00.250.500.751.00 Llama-3.1-8B 00.250.500.751.00 InternLM3-8B Intervention strength λ Validation HarmBench ASR WildGuardS-EvalReported setting Figure 11: Validation HarmBench ASR across steering strengths. Stars mark settings used on the official test sets. F.2.2STEERED-RESPONSE QUALITY We move above 0.5 only when validation ASR falls and four quality limits are met: mean non- repetition above 0.5, mean∆NLL at most 1, mean edited-token fraction at most 0.9, and at most 20 of the 200 originally safe validation responses pass the basic text-quality check before steering but fail it afterward. If both stronger settings pass, we choose the one with lower ASR. When neither passes, we retain 0.5. We do not use 0.25 as the default because Figure 11 shows a smaller ASR reduction than 0.5 in all six settings. We retain it only for sensitivity analysis. Table 11 gives the measurements used for these decisions. 29 Table 11: Validation ASR and quality checks for norm-preserving steering on 200 harmful and 200 safe responses. Underlining marks failed quality limits. Generator / dataset λASR Non- repetition ∆NLL Edited fraction Safe brokenUse Qwen3-8B WildGuard 0.25 0.7900.820.420.873/200Sensitivity 0.50 0.4100.540.640.7510/200Default 0.75 0.3000.510.740.6711/200Selected 1.00 0.2100.470.920.6317/200Not used Qwen3-8B S-Eval 0.25 0.3400.880.380.778/200Sensitivity 0.50 0.1000.680.580.6413/200Selected 0.75 0.0450.590.720.6528/200Not used 1.00 0.0300.511.16 0.6737/200Not used Llama-3.1-8B WildGuard 0.25 0.7850.750.170.8416/200 Sensitivity 0.50 0.5400.390.240.8416/200Selected 0.75 0.3400.440.790.8323/200Not used 1.00 0.2500.571.570.7923/200Not used Llama-3.1-8B S-Eval 0.25 0.5350.730.230.7914/200 Sensitivity 0.50 0.2500.520.400.7514/200Default 0.75 0.1150.530.670.7119/200Selected 1.00 0.0550.681.48 0.6631/200Not used InternLM3-8B WildGuard 0.25 0.7650.930.240.8715/200 Sensitivity 0.50 0.3700.540.270.8826/200 Selected 0.75 0.0900.480.910.8633/200Not used 1.00 0.0550.622.05 0.8653/200Not used InternLM3-8B S-Eval 0.25 0.6300.920.300.8615/200 Sensitivity 0.50 0.1800.48 0.270.5813/200Selected 0.75 0.0950.530.770.4928/200 Not used 1.00 0.0800.511.11 0.5334/200Not used Among the stronger candidates, onlyλ = 0.75for Qwen/WildGuard and Llama/S-Eval lowers ASR while meeting every quality limit. We use 0.75 for those settings and retain 0.5 for the other four. The rejected settings generally reduce ASR further but increase repetition, NLL, or failures on safe responses. F.2.3DIRECT-ADDITION ABLATION All reported TRACE results use the norm-preserving update. Table 12 compares the selected norm- preserving setting with direct addition,x ℓ′ t = x ℓ t +λg h ∆ h , on Qwen. Hereλmultiplies a displacement vector rather than setting a fraction of the rotation angle. Direct-addition strength has no natural upper bound, and its effect depends on the norm of∆ h . Its numerical value is therefore harder to interpret and is not directly comparable with the norm-preserving strength. Table 12: Qwen3-8B validation comparison of norm-preserving steering and direct addition. Bold marks the best value within each dataset and metric. DatasetUpdateλASR↓ Non-repetition↑ ∆NLL↓ Edited fraction↓ Safe broken↓ WildGuard Norm-preserving 0.750.3000.510.740.6711/200 Direct addition0.500.8650.930.020.913/200 Direct addition1.000.8350.880.120.893/200 Direct addition2.000.7400.780.450.841/200 Direct addition4.000.4550.570.680.744/200 S-Eval Norm-preserving 0.500.1000.680.580.6413/200 Direct addition0.500.6000.950.040.8810/200 Direct addition1.000.5300.960.180.858/200 Direct addition2.000.3250.750.330.777/200 Direct addition4.000.1250.710.610.6616/200 The selected norm-preserving update gives the lowest ASR and edits the smallest fraction of tokens on both datasets. Direct addition preserves quality better at weaker settings, but those settings leave substantially more harmful responses successful. 30 F.2.4HARMFULNESS-WEIGHTING ABLATION The reported edit scales its strength by the source concept’s harmfulness score. Table 13 compares this rule with setting the weight to one for every harmful concept. Both variants keep the same harmful-concept gate, benign targets, norm-preserving update, and λ = 0.5. Table 13: Qwen3-8B validation ablation of concept harmfulness weighting atλ = 0.5. Underlining marks failed quality limits. DatasetConcept weightASR↓Non-repetition↑ ∆NLL↓Edited fraction↓Safe broken↓ WildGuard Harmfulness score0.4100.540.640.7510/200 Uniform0.1700.430.920.6430/200 S-Eval Harmfulness score0.1000.680.580.6413/200 Uniform0.0200.480.980.6749/200 Uniform weights lower ASR, but they also produce more repetition and cause many more safe responses to fail the basic text-quality check. We therefore retain harmfulness-weighted edits. GCOMPUTE AND EFFICIENCY G.1MODEL SIZE At inference, TRACE detection uses the VQ encoder, codebook, and detector. The encoder has 16.79M parameters, while the detector has 2.21M parameters, or 2.69M for InternLM/S-Eval. The codebook contains an additional 3.28M values updated through EMA. Thus, the encoder and detector together contain 19.00–19.48M gradient-trained parameters, compared with 19.93M for our Kelp implementation. Training the VQ model also requires a decoder, bringing the complete training model to 604.03M trainable parameters. The decoder is discarded after training and is not used for detection or steering. Steering introduces no additional trainable parameters. G.2OFFLINE COST Table 14 reports the wall-clock time for activation caching, VQ training, and detector training. Hyperparameter searches and ablations are excluded. Table 14: Wall-clock hours for the final TRACE runs. Activation caching and VQ training use one H100 with 40 GB of available memory; detector training uses one H100 with 10 GB. GeneratorDataset Activation cache (h) VQ training (h) Detector training (h) Qwen3-8BWildGuard0.939.220.45 S-Eval1.245.890.27 Llama-3.1-8BWildGuard0.214.690.23 S-Eval0.133.130.14 InternLM3-8BWildGuard0.5216.180.41 S-Eval0.358.440.38 VQ training is the most expensive stage, taking 3.13–16.18 hours across the six settings. Activation caching takes at most 1.24 hours, and detector training takes at most 0.45 hours. The highest measured GPU-memory use is 26.7 GB during VQ training. G.3ONLINE COST At batch size one on an H100, the complete online detection path takes0.552± 0.002ms per token. Kelp reports approximately 0.4 ms per token on an H20 (Li et al., 2025). Because the hardware and 31 measurement protocols differ, these values should not be treated as a direct speed comparison; both methods operate at a sub-millisecond scale. On the same H100 benchmark, enabling TRACE steering increases generation time by only 3.02% relative to unsteered generation. HBASELINES We use the authors’ implementations and data where they are available. When a method does not support our generators or evaluation protocol, we retain its defining construction and describe our adaptation below. Hyperparameters come from the original method or are selected on training or validation data. H.1DETECTION BASELINES DiffMean and Kelp read the same generator representation as TRACE. We select this layer once for each generator using Section B, before fitting any detector, and keep it fixed across methods and datasets: 20 for Qwen, 14 for Llama, and 34 for InternLM. Both baselines use seed 42. WildGuard classifier.WildGuard is a separate 7B moderation model that jointly assesses a prompt and its completed response (Han et al., 2024). We use the official inference package, checkpoint, classification prompt, and parser without retraining. The response-harmfulness field maps harmful to 1 and unharmful to 0, and an unparseable output counts as an incorrect prediction. Because the interface returns a categorical completed-response label, WildGuard has no streaming, AUROC, or AP result. DiffMean.DiffMean forms a single direction by subtracting the token-weighted mean safe activa- tion from the token-weighted mean harmful activation and normalizing the result (Wu et al., 2025). We score each assistant token by its projection onto this direction and use the maximum token score for completed-response detection. Its streaming score is the running maximum. We estimate the direction from the training partition and choose the harmful-class F1 threshold on validation data. Unlike AxBench, our classes are harmful and safe generated responses, and prompt tokens do not enter the class means. We keep the projection scores at full precision and do not use token-level onset labels. Kelp.Kelp, released as PlugGuard, initializes a recurrent detector state from the prompt and updates it with each response hidden state (Li et al., 2025). A two-class head predicts safety after every update. We use the harmful probability at the final response token for completed-response detection and its maximum over response tokens for streaming detection. Both use threshold 0.5 in the main comparison. We train one Kelp head for each generator–dataset pair using the paper’s one-epoch schedule and effective batch size of 32. Its temporal supervision labels the first ten response positions safe and the final ten with the response label. When these anchors overlap, the final response label takes precedence. The WildGuard heads use 37,934 training responses for Qwen and Llama and 37,932 for InternLM after removing two empty responses. The S-Eval heads use all 9,000 training responses. We build each activation cache with the generator’s native chat template, no added system message, and a 4,096-token limit. The threshold-0.5 results use these full training pools. For the validation-calibrated timing and response-length analyses, we use the TRACE detector-validation prompts as Kelp’s validation set and fit separate heads on the remaining rows, retaining duplicates within the training pool. The validation scores select the highest-recall threshold with FPR at most 5%, which is then used on the official test set. Kelp reproduction choices. The paper and released repository disagree on the read layer, weight decay, prompt-state training, response boundaries, and temporal-loss schedule. We follow the paper where it is explicit: zero weight decay, a trainable prompt-conditioned initial state, and the stated training and inference schedule. We also locate the stored assistant response from tokenizer boundaries rather than append another assistant-start marker, and we retain the final partial optimizer update. 32 The paper does not identify the layer used for each multi-generator result, while the released files use several different layers. We therefore use the layer selected independently in Section B. As a check, moving Llama from layer 14 to the paper’s layer-20 heuristic changes streaming F1 only from 0.693 to 0.691 on WildGuard and from 0.919 to 0.916 on S-Eval. The public release includes no trained WildGuard or S-Eval heads, so our results are a paper-aligned, layer-matched reimplementation rather than an evaluation of the authors’ checkpoints. H.2STEERING BASELINES The steering baselines use the same generator checkpoints, official-test prompts, greedy decoding, 2,048-token limit, and evaluation metrics as TRACE. Direction construction and calibration use the data prescribed by each method. Every intervention is compared with an unsteered control generated in the same run configuration. Table 2 reports these matched controls because separate low-precision runs can differ slightly across batch sizes. Self-Reminder. Self-Reminder places a responsibility instruction before the request and a second reminder after it (Xie et al., 2023). It requires no training or model activations. We preserve the released prefix–request–suffix structure but adapt its ChatGPT-specific wording to our generators: ChatGPT becomes AI assistant, the opening instruction uses the system role, and a reworded closing reminder is appended to the user request. Thinking remains disabled, and no setting is tuned on our datasets. Refusal-direction addition.This baseline follows the official implementation of Arditi et al. (2024). It takes the difference between mean residual activations for harmful and harmless instructions, then uses the released validation procedure to select a layer and token position. The selected raw direction is added with coefficient 1 at every prompt and generated-token position. The selections are the final post-instruction token at zero-indexed block 20 for Qwen and block 12 for Llama, and the <|imend|>token at block 26 for InternLM. One direction is used for both datasets for each generator, with no tuning on WildGuard or S-Eval. CAST. CAST adds a refusal direction only when the prompt matches a learned condition (Lee et al., 2025). We use the pinned released implementation, data, and pairwise-centered principal component analysis (PCA) routine. Its search and calibration select a Qwen condition at block 15 that fires above similarity 0.015 and edits blocks 15–30 with strength 4. Llama uses block 8, fires below 0.048, and edits blocks 17–24 with strength 1.7. InternLM uses block 23, fires above 0.093, and edits blocks 23–35 with strength 1.5. Each generator uses the same configuration on both datasets, and the released optional normalization remains disabled. 33

Instant research discovery