Training activation classifiers for safety and alignment

At OpenAI, we train models to behave in a safe and aligned way. Despite recent progress in this direction [OpenAI, 2026b], there remain cases when adversarial pressure, rare circumstances, or training failures can degrade safety and alignment. For this reason, we adopt a ‘defense in depth’ approach: we deploy models with additional monitors that aim to detect such cases and stop further model action. Specifically, we use text classifiers that run on user prompts and assistant completions for this purpose. Starting from GPT-5.6 [OpenAI, 2026a], we have added another layer of defense to this stack: activation classifiers that run on all assistant completions. Activation classifiers, or probes for short, are lightweight ML models that use an LLM’s own internal activations — its “neural patterns” — to classify model activity as being misaligned or otherwise undesirable (e.g., user activity having harmful intent). Probes offer multiple advantages compared to external text-based classifiers: they enable streaming decisions which can block a policy-violating model turn midway; are more robust to jailbreaks than significantly bigger text classifiers; and…