OpenAI's activation classifiers appeared on November 2 in the company's alignment research blog. OpenAI said that, starting with GPT-5.6, these lightweight models, called probes for short, have been deployed on the internal and external traffic of its most capable models, covering all assistant completions. Instead of only reading output text, they read a model's own internal activation signals, score each token, and can stop a violating reply midway through generation once a score crosses a threshold. That is the key difference from traditional text classifiers.
| Dimension | Text classifiers | Activation classifiers |
|---|---|---|
| Basis for judgment | The output text | Internal model activations |
| When blocking happens | Judged on the text as a whole | Scored token by token; stopped once the threshold is crossed |
| Jailbreak robustness | Relatively weaker | More robust in OpenAI's experiments |
In deployment, a probe runs directly on the inference engine and returns one score for each sampled token. Above the threshold, the system stops streaming the completion to the user, hands the message to a reasoning model for a final judgment, and blocks tool calls until the call is confirmed safe. Training uses up to 1 million messages, drawn from synthetic data and de-identified conversations, with labels judged by the most capable reasoning models; a single configuration is usually trained with at least 32 random initializations before the best is selected. OpenAI also found that probe accuracy rises with the capability of the model being monitored, unlike a text classifier whose input does not change.
Only known violation types can be detected, and a new base model needs retraining
The limits of probes are equally clear: they depend on labeled training data and can only detect known, measurable kinds of undesirable activity; cases absent from the training data fall outside their coverage. Each probe is closely coupled to one model's activations, so a base model with a different weight initialization requires retraining. Within the same base-model family, probes transfer well across post-training checkpoints, but transfer across pre-training checkpoints is more limited and calls for periodic retraining. OpenAI places probes inside a broader monitoring system, alongside model-based review, automated investigation, and human response, rather than letting a single classifier decide on its own. For users, the significance of this disclosure is not any single blocking figure, but a shift in safety monitoring from judging after the text is read to judging while it is being generated, moving the jailbreak contest inside the model.
