OpenAI has trained and deployed activation classifiers as a safety monitoring layer for frontier models.

Starting with GPT-5.6, OpenAI has deployed activation classifiers (probes) across both internal and external traffic for its strongest model. These probes use real-time token-by-token scoring based on internal activations to interrupt non-compliant responses and tool calls mid-generation, handing them over to a reasoning model for review. Experiments show that probes are more robust against tested jailbreak attacks than larger text classifiers, with accuracy improving as model capability grows and generalizing well across checkpoints post-training. However, they require retraining on new base models and can only detect known violation types that are explicitly trainable.