# LLM Safety

Published articles for LLM Safety.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Introducing AMS: Activation-based model scanner for open-weight LLM safety verification

DevFeed: [Introducing AMS: Activation-based model scanner for open-weight LLM safety verification](<https://devfeed.tech/articles/introducing-ams-activation-based-model-scanner-for-open-weight-llm-safety-verification-34297.md>)

Original publisher: [Read original article](<http://opensource.googleblog.com/2026/04/introducing-ams-activation-based-model-scanner-for-open-weight-llm-safety-verification.html>)

Author: Google Open Source (noreply@blogger.com)

Published: 2026-04-27T18:30:00Z

Content type: release

Language: en

Sources: [Google Open Source Blog](<https://devfeed.tech/sources/google-open-source-blog.md>)

Topics: [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>), [Large Language Model](<https://devfeed.tech/topics/llm.md>), [Security](<https://devfeed.tech/topics/security.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [Testing](<https://devfeed.tech/topics/testing.md>), [Fine-tuning](<https://devfeed.tech/topics/fine-tuning.md>), [hugging face](<https://devfeed.tech/topics/hugging-face.md>)

Tags: [ai-security](<https://devfeed.tech/tags/ai-security.md>), [benchmark](<https://devfeed.tech/tags/benchmark.md>), [devsecops](<https://devfeed.tech/tags/devsecops.md>), [evaluation](<https://devfeed.tech/tags/evaluation.md>), [llm-safety](<https://devfeed.tech/tags/llm-safety.md>), [model](<https://devfeed.tech/tags/model.md>), [model-verification](<https://devfeed.tech/tags/model-verification.md>), [open](<https://devfeed.tech/tags/open.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [safety](<https://devfeed.tech/tags/safety.md>), [security](<https://devfeed.tech/tags/security.md>)

### AI overview

Google introduces AMS, an open-source Activation-based Model Scanner for verifying the safety-related integrity of open-weight large language models before deployment. The tool analyzes geometric structure in model activation space instead of sending behavioral-test prompts and is described as scanning models in 10-40 seconds.

### Source excerpt

by Glen Messenger, Google Kubernetes Engine (GKE) The open-weight model ecosystem is thriving--and so is its shadow. A 2025 study identified over 8,000 safety-modified model repositories on Hugging Face alone, with modified models complying with unsafe requests at rates of 74% compared to 19% for their original instruction-tuned counterparts. For organizations deploying open-weight models, a critical question emerges: how do you know the model you downloaded is safe to run? We believe defensive security tools should be widely available. AMS represents our contribution to a safer AI ecosystem--one where developers everywhere can verify model integrity before deployment. Today we're releasing AMS (Activation-based Model Scanner), an open source tool that answers this question in 10-40 seconds--without sending a single prompt. The Problem with Behavioral Testing Traditional safety verification relies on behavioral testing: send harmful prompts, check if the model refuses. This approach has three fundamental limitations. It's slow. Comprehensive benchmarks like HarmBench require hundreds of queries. For organizations running continuous integration pipelines or screening large model registries, this can be impractical. It's incomplete. No benchmark covers every harmful behavior. Models can exhibit safe behavior on known test sets while remaining unsafe on novel or out-of-distribution prompts. It's gameable. Models can be fine-tuned to refuse benchmark prompts while complying with novel attacks--a known limitation of purely behavioral evaluation approaches. A Structural Approach Clean vs Tampered Models AMS takes a different approach entirely. Instead of testing what a model says, it measures how a model thinks. Safety training creates measurable geometric structure in a model's activation space. Instruction-tuned models develop internal "direction vectors"--representations that separate harmful content from benign content with high statistical confidence (4-8σ separation). Wh