OpenAI Activation Probes: How GPT-5.6 Is Monitored From the Inside

OpenAI says it now watches the inside of its most capable models, not only their words. In a research post dated November 2, 2026, the company describes how it trains and deploys activation probes, small classifiers that read a model's internal activity and can interrupt a response while it is still being generated. According to the post, probes have run on all assistant completions since GPT-5.6. This guide explains what that means, how the probes are built, which findings OpenAI reports, and what the company admits they cannot do.

The source is the OpenAI Alignment team's post, "Training activation classifiers for safety and alignment", by Alex Makelov, Xiaojun Xu, Sundaram Ananthanarayanan, Ethan Mcdonald and Tom Dupre la Tour. It follows OpenAI's October 29 post on detecting frontier model misalignment, where probes are named as one component of a larger monitoring system.

Agents that act on your behalf need rules. See how explainx helps secure your agents →

TL;DR: what OpenAI says about activation probes

What is an activation probe?

A large language model produces a long sequence of numeric vectors, called activations, as it reads a prompt and writes an answer. A probe is a small model trained on those vectors to answer one narrow question, such as "does this completion break a given policy?" The post describes probes as using a model's own "neural patterns" to classify activity as misaligned or otherwise undesirable, for example a user showing harmful intent.

The idea is different from the usual guardrail. A text classifier is a separate model that reads the final words. A probe sits beside the monitored model and reads what the model itself computed. OpenAI lists three advantages over external text-based classifiers:

1. Streaming decisions. A probe can block a policy-violating turn midway instead of after it is finished.
2. Jailbreak robustness. OpenAI says probes are more robust to jailbreaks than significantly bigger text classifiers.
3. Efficiency. They are significantly cheaper to run.

If you want the background on why reading internals helps at all, our explainer on interpretability and monitoring without solving alignment covers what teams can do with white-box signals today.

Why OpenAI added a layer of probes

OpenAI frames the work as defense in depth. It trains models to behave safely and aligned, but the post says adversarial pressure, rare circumstances or training failures can still degrade safety. So the company deploys extra monitors that try to detect such cases and stop further action. Until now the public description of that stack was text classifiers on user prompts and assistant completions.

Starting from GPT-5.6, activation classifiers run as another layer on all assistant completions. For readers following that model family, see our posts on the GPT-5.6 Sol, Luna and Terra lineup in ChatGPT Pro and the CheatingBench fact-check for GPT-5.6 Terra. Probes are separate from the model's behavior training. They are a watcher bolted onto the same forward pass.

OpenAI also says probes are one component of its internal misalignment monitoring system, alongside model-based review, automated investigation and human response. That matches the system described in the October 29 post.

How the probe is built

The technical section is short but specific. Here is what the post says.

Architecture

• Input: a vector of residual stream activations, typically from a layer around the middle of the model.
• Output: logits for a binary classification task, such as whether a completion violates a given policy.
• Design: based on attention probes (Kantamneni et al., 2025), using an MLP plus QV-attention architecture with an exponential moving average.
• Why the moving average: compared with a rolling mean, it cuts the streaming state from memory proportional to window size times heads to memory proportional to heads only. OpenAI reports essentially no difference in predictive power.
• Training stability: a learnable pre-MLP bias, initialized from an estimate of the negative training activation mean.
• Multi-output probes: for many domains, one probe shares most weights across several output categories, which may help categories with little training data.

OpenAI also tested linear probes, MultiMax probes and covariance probes. In a footnote it says none improved predictive performance. Full-attention probes performed similarly but lacked the low-buffer streaming implementation. A single-layer probe is also simpler for inference infrastructure.

A robustness check on the architecture

OpenAI ran an experiment on how much a probe's score changes when benign text is placed before a violative suffix in the assistant message. It reports that the MultiMax probe architecture proposed by Kramar et al. (2026) is significantly more affected by benign prefixes than the Max of Rolling Means Attention architecture from the same paper. The latter is very similar to OpenAI's exponentially decaying attention design.

Activation probes logit drift as benign prefix length grows across three probe architectures Image: OpenAI

The practical point: an attacker should not be able to hide a violation by padding the answer with harmless text first. Figure 1 in the post shows the probe logits for the three architectures as the benign prefix grows.

The rolling softmax objective

Probes are trained with one label per message, but they run on every prefix. At inference the probe produces a score for each message prefix as the answer is sampled, and flags the message as soon as the score crosses a threshold. In training, OpenAI aggregates the prefix scores with a softmax and supervises the resulting message-level score. It contrasts this with the hard-max aggregation of Kramar et al. and hypothesizes that softmax spreads supervision better across prefixes. In its experiments softmax modestly improves the recall versus flag-rate Pareto front.

Data, seeds and evaluation

• Data: up to 1 million training messages, a mix of synthetic and de-identified conversations. Labels come from OpenAI's most capable reasoning models acting as LLM judges.
• Seeds: the post says the random initialization of probe weights has a large impact on performance, so OpenAI usually trains at least 32 random initializations per hyperparameter setting and selects the best seed on a validation set.
• Hyperparameters: learning rate, activation source layer and architectural capacity matter most.
• Training cost: AdamW for fewer than 5 epochs. Because probe weights are small compared with the activations they process, training is bandwidth-limited, so tens of probes train together on one accelerator in about the time of one. A footnote says roughly 85 percent of the spread in probe performance comes from initialization randomness.
• Evaluation: recall on a small, carefully labeled set, and separately the escalation rate (the share of relevant messages that trigger the probe) on a large, representative set. The recall versus escalation curve is the main deployment decision. OpenAI also runs automated and manual red-teaming for jailbreak robustness.

How the deployment works

Probes run in a streaming fashion directly on the inference engine, keeping only a minimal buffer for token pooling, and return one logit per sampled token. OpenAI says this gives them almost the same reliability as the model itself, and makes them easier to make fail-closed than an external text classifier.

The sequence when a score is high:

1. The system logs classifier logits together with each sampled token.
2. When a logit passes the threshold, it stops streaming the completion to the user.
3. It escalates the message to a reasoning model for final judgement.
4. Tool calls are blocked until the call is marked safe.

This matters for agents. A tool call is an action in the world, and a probe that sees risky intent before the call executes gives the system a place to pause. Our guide on monitoring AI agent behavior with explainx Sentinel covers the same idea at the application layer.

Three empirical findings OpenAI reports

1. Probes transfer across post-training, less across pre-training

A probe trained on one model's activations behaves differently on another model. OpenAI measured transfer across steps of post-training and across different amounts of pre-training. It reports excellent transfer across many post-training stages and more limited transfer across pre-training checkpoints.

Probe recall against traffic escalation across post-training checkpoints for OpenAI activation classifiers Image: OpenAI

The consequence is operational. A probe trained on one pre-trained base model is incompatible with a model that has a different weight initialization, so probes must be retrained for each new base model. Even within one family, performance can degrade as weights diverge from the checkpoint the probe learned from. That motivates periodic retraining.

2. Jailbreak robustness, with a caveat

OpenAI points to prior work showing activation-based monitors resist some jailbreaks and complement text classifiers. It adds that probes may detect content in encodings the monitored model understands but external classifiers struggle to read. In its red-teaming, OpenAI says probes were overall more robust to jailbreaks than content-based classifiers.

The caveat is explicit. Robustness is especially high for jailbreaks that are not optimized directly against the probe. Real attackers adapt to whatever signals a safety stack exposes, which is why OpenAI red-teams its safeguards. Treat the claim as a reported result from the vendor's own testing, not an independent audit.

3. Probe accuracy tends to grow with model capability

For a fixed task, a text classifier sees the same input and performs the same. A probe's input is the monitored model's activations, which differ between models. OpenAI says prior work, including Nordby et al. (2026), suggests probe accuracy can improve with model capability, that it has seen the same trend, and that probe performance keeps increasing on its frontier models. The post does not give a numeric comparison across models.

What the post does not say

The post is a methods note, so several things readers may want are absent.

• No headline detection rate. OpenAI gives charts and qualitative findings, and warns the figures are not necessarily representative of deployed classifiers.
• No list of policies. It says the set of policies probes cover is being expanded, but does not list them.
• No false-positive numbers for users. Escalation rate is used as the evaluation metric, but the deployed thresholds are not disclosed.
• No external replication. All results are OpenAI's own.

For a comparison, Google DeepMind described activation probes aimed at cyber and biological knowledge in its Gemini 4 report. Our write-up of the Gemini 4 Argon safety report shows how a second lab combines probes with a chain-of-thought monitor. Goodfire has also pitched probe-style monitors for rogue agents in a cost-focused approach, covered in our post on Goodfire's inside-out monitors.

Limits OpenAI states plainly

OpenAI lists the weaknesses itself, which is part of why the post is useful.

• Supervised only. Probes are trained with labels, so they detect only what OpenAI can explicitly train them to detect. A new kind of misbehavior with no labeled examples will not be flagged.
• Coupled to the model. Probes depend on the monitored model's activations, so each new base model needs new probes, and weight changes may need retraining.
• One layer, not the whole stack. They complement other safeguards. The post stresses that probes do not replace text classifiers, model-based review, investigation or human response.

This is the honest framing of white-box monitoring in 2026. It is cheap and fast, and it sees things text cannot, but it is narrow and brittle across model generations.

What this means for builders

If you build with OpenAI models through the API or ChatGPT, you do not configure probes. They sit in OpenAI's serving stack. Three practical consequences follow from the post.

1. Responses can stop mid-stream. If a probe fires, the stream halts and a reasoning model reviews the message. Apps that stream tokens to users should handle truncated completions and blocked tool calls gracefully.
2. Tool calls may be delayed. The post says tool calls are blocked until marked safe after a flag. Agents should treat a delayed or denied tool call as a normal outcome, with retries and clear errors.
3. Do not drop your own guardrails. The vendor says its probes are one layer. Your own permissions, sandboxing and logging still matter, especially for agents that act on third parties. The agent security platform AgentBeam, built by the explainx.ai team, targets that application-side layer by stopping AI agents before they take dangerous actions.

For a wider look at how OpenAI tests safety before release, see our post on OpenAI deployment simulation. For how the company handles a model with elevated biology and cyber capability, see the GPT-Rosalind system card addendum.

Why this post matters

Two years ago, "safety monitor" usually meant another model reading text. This post shows a major lab treating internal activations as a production signal, with a streaming design, a retraining cost and a stated failure mode. It also shows how fast the field is moving: the post cites 2026 papers from McKenzie, Kramar, Cunningham, Anderson, Sel, Nordby and Dooms, and it says prior work such as Patel and Wang (2024) laid earlier groundwork.

The honest takeaway is mixed. Probes look like a strong, cheap addition against known categories of harm. They also tie safety to a specific model checkpoint, which raises the cost of every new base model. Expect more labs to publish similar designs, and expect independent researchers to test whether the jailbreak-robustness claim holds against attackers who optimize against the probe itself.

How to check the claims yourself

• Read the original post and its three figures at the OpenAI Alignment blog, and the companion October 29 post for the wider monitoring system.
• Read the cited papers, especially Kramar et al. (2026) on probe architectures, before judging the architecture comparison.
• Watch for third-party red-team reports that attack probes directly. OpenAI itself says adaptive attackers are the real test.
• Compare with Google's description of its own probes in the Gemini 4 report, linked above.

Related reading

• Gemini 4 Argon safety report: activation probes and a misalignment monitor
• Interpretability and monitoring for teams that cannot solve alignment
• Goodfire inside-out monitors for rogue agents
• OpenAI deployment simulation before release
• GPT-5.6 Terra and CheatingBench, fact-checked
• AI agent safety monitoring with explainx Sentinel
• GPT-Rosalind system card addendum

Details reflect OpenAI's published post as of November 2, 2026. Figures are from OpenAI's internal experiments and may not match deployed systems.