Silent Alarm: A J-Space Protocol for Comparing Danger Recognition Across Models and Quantization Levels
Roman Prosvirnin, Victor Minchenkov, Alexey Soldatov, Vladimir Bashun
Why It Matters
What makes this one worth your time
This research provides a new methodology for evaluating the robustness of language models against dangers, which is crucial for improving AI safety and reliability in real-world applications.
JADR offers a novel approach to evaluate internal safety mechanisms in language models.
Summary
The paper introduces the JADR protocol, which assesses a model's internal danger recognition mechanisms using Jacobian space before generating responses, allowing for comparisons across different models and quantization levels without relying on external judge models.
Key contributions
- Introduction of the JADR protocol for evaluating danger recognition in language models.
- Development of the SafetyAUC metric for quantifying internal safety mechanisms.
- Comparative analysis of multiple models and quantization regimes using a consistent internal evaluation framework.
Notable insights
- The use of Jacobian space for internal representation analysis is a novel approach that could lead to deeper insights into model fragility.
- The SafetyAUC metric, combined with bootstrap confidence intervals, offers a statistically rigorous way to compare model safety across different configurations.
Possible limitations
- Not stated in the abstract.
Abstract
arXiv:2607.12792v1 Announce Type: cross Abstract: Jailbreak-robustness research typically evaluates safety through generated responses using an LLM-as-judge approach. Such evaluations, however, are sensitive to the benchmark's grading procedure and capture only observed behavior on a given set of attacks, without directly revealing the hidden fragility of the underlying safety mechanisms. This work proposes JADR (Jacobian Assessment of Danger Recognition), a protocol that measures a model's internal representation through Jacobian space (J-space, a recently proposed workspace of verbalizable concepts) before the first response token is generated. For every prompt and layer we record the top-k J-space tokens; these are grouped into six behavioral scenario axes and compared between a danger sample based on StrongREJECT and a safe control drawn from XSTest and OKTest. The method does not call on an external judge model: the computation runs entirely locally, on the activations of the model under evaluation, which lets us compare both different models against each other and modifications of a single model -- quantization and fine-tuning in particular -- on the same terms. The final comparison rests on the proposed SafetyAUC metric, complemented with bootstrap confidence intervals. The protocol is applied to six models (Qwen3-1.7B, Qwen3-4B, Qwen3-8B, Qwen3-Uncensored-4B, Qwen3-SafeRL-4B, Gemma 2 9B) across three weight-representation regimes -- BF16, INT8, and INT4 -- and checked against an independent behavioral evaluation with the StrongREJECT grader. The metric separates models with a strong versus a weak internal safety mechanism with statistical significance and captures substantively different effects across quantization regimes.