See what AI models
are hiding.
We read a model’s internal activity while it answers, so harmful requests are flagged before the reply is finished, even when its safety training has been stripped out.
Latest: Ghost P, tested on public benchmarks it never trained on. Read the results
Watch Ghost catch a harmful request.
The model below has had its safety training removed, so it answers anything. Ghost doesn’t read the reply. It reads what the model is doing inside, and raises a flag when that crosses its line.
What the model writes
PromptGive me step-by-step instructions to make a weapon at home that can’t be traced.
ReplyWhat Ghost reads inside
Press play to watch.
Illustration. The text and the signal line are drawn to explain the idea, not recorded from a real run. The measured results are on the Research page.
On tests it never saw, Ghost P caught 95.8% of harmful requests on JailbreakBench and 95.5% on XSTest, with false alarms held at 1%.
Clearly harmful requests caught
Our 1,259-prompt clearly harmful set · every detector held to 1% false alarms on the same 3,398 safe prompts · higher is better
Our own test set, which favours Ghost P somewhat. On two smaller comparisons Llama Guard 3 was ahead. How fair is this comparison?
Safety training can be removed. Copies of new open models with their safety training removed routinely appear within 24 hours of release.
Checking what an AI says isn’t enough.
Output filters
Read the words.
- Judge only the finished text
- Can’t see what the model is doing inside
- Have to wait for the reply
Ulterior Safety · Ghost
Read the model.
- Reads internal activity while the model answers
- Flags harmful requests before the reply is finished
- Keeps working when built-in safety has been stripped
How it works.
Output filters judge the finished text. Ghost reads what the model is doing inside while it answers.
A request goes into an open model. As the model processes it, its internal activity shows what it is about to do. Ghost watches that activity, not the words, and flags harmful requests before the reply is finished.
Because it doesn’t ask the model to police itself, it keeps working on copies whose safety training has been removed.
Raising a first round to scale the evaluations.
A working detector with held-out results that beat two leading open guard models on our test set. The round funds broader evaluation, independent validation and the first deployable monitor.