💬 NLP

AERIC: Anticipatory Hidden-State Monitoring for Implicit Harmful Dialogue

This paper introduces AERIC, a lightweight, same-pass hidden-state monitoring framework that anticipates and suppresses implicit harmful dialogue in real-time with minimal latency overhead, significantly outperforming existing streaming safety guards on key benchmarks.

Original authors: Jihyung Park, Saleh Afroogh, Junfeng Jiao

Published 2026-05-26

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Jihyung Park, Saleh Afroogh, Junfeng Jiao

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are watching a live news broadcast. Usually, safety editors wait until the reporter finishes their sentence, read the whole script, and then decide, "Oh no, that was dangerous!" By then, the harmful words have already been broadcast to the audience.

Other safety tools try to listen as the reporter speaks, but they often need to pause the broadcast, run the words through a separate, heavy-duty computer, and then decide if it's safe. This slows everything down and causes awkward delays.

AERIC is a new, lightweight safety tool that works differently. It doesn't wait for the words to be finished, and it doesn't pause to ask a second computer for help. Instead, it acts like a super-attentive co-pilot sitting right next to the reporter's brain while they are thinking and speaking.

Here is how AERIC works, broken down into simple concepts:

1. The "Same-Pass" Co-Pilot

Most safety tools are like a separate security guard who has to stop and check a bag after you've walked through the door. AERIC is like a security guard who is already inside the building, walking right beside you.

How it works: As the AI generates an answer word-by-word, AERIC reads the "hidden thoughts" (internal data) the AI is having right now. It doesn't make the AI stop or re-think; it just watches the internal process in real-time.
The Benefit: It's incredibly fast. The paper found that using AERIC only slows down the AI by about 2%, whereas other safety tools can slow it down by nearly 80%.

2. Predicting the "Drift" Before It Happens

The hardest part of safety is catching "implicit" harm. This is when an AI sounds polite and helpful but is slowly leading the conversation toward something dangerous (like giving bad medical advice or encouraging self-harm).

The Analogy: Imagine a car driving on a road. A normal guard waits until the car crashes to say, "That was a crash!" AERIC is like a sensor that sees the car starting to drift toward the cliff edge before it actually goes over.
How it works: AERIC looks at the AI's internal trajectory. It asks three questions simultaneously:
1. Future Hazard: "Is the AI about to say something bad in the next few words?"
2. Support Check: "Is the AI actually being helpful and safe right now, even if the topic is intense?" (This prevents the tool from panicking when the AI is discussing serious but safe topics).
3. Drift Check: "Is the AI's current path different from what a safe answer would look like for this specific question?"

3. The "Smooth" Alarm System

If a safety tool screams "DANGER!" the moment it sees a single risky word, it might stop the AI from giving a perfectly good answer.

The Analogy: Think of AERIC's decision rule like a volume knob rather than a light switch. It doesn't just flip a switch; it slowly turns up the volume of the "risk signal" as the AI continues to drift.
How it works: It uses a mathematical smoothing technique (called an Exponential Moving Average). If the AI starts to drift toward harm, the "risk volume" slowly rises. Only when it gets loud enough does the system say, "Stop the generation." This allows the AI to finish safe, helpful sentences without interruption.

What the Paper Actually Found

The researchers tested this "co-pilot" on two different AI models (Qwen and Gemma) and compared it against the best existing safety tools.

Better at catching hidden danger: On tests involving tricky, polite-sounding but harmful advice, AERIC was better at ranking dangerous answers higher than safe ones than the current top tools.
Catching it earlier: When the AI was asked to generate harmful content, AERIC was able to stop the generation much earlier (after fewer words) than the other tools. This means fewer harmful words are ever shown to the user.
Lightweight: It is tiny. The part of the software that learns and makes decisions has only 387 adjustable numbers (parameters). It's so small it barely adds any weight to the system.

The Bottom Line

AERIC proves that you can build a safety system that anticipates trouble by reading the AI's internal thoughts in real-time, without needing to stop and re-process the text. It acts as a fast, early-warning signal that can catch subtle, hidden dangers before they become visible to the user, all while keeping the system running at nearly full speed.

Note: The paper emphasizes that AERIC is a signal, not a full solution. It tells the system "Stop, this looks risky," but it doesn't decide exactly what the system should do next (like blocking the user, asking a clarifying question, or switching to a safe mode). That part is still a separate challenge.

Technical Summary: AERIC – Anticipatory Hidden-State Monitoring for Implicit Harmful Dialogue

1. Problem Statement

Current Large Language Model (LLM) safety systems face two distinct challenges:

Timing: Existing safeguards are typically strongest when judging fully completed text. However, streaming deployments require safety decisions over partial generations to enable early intervention. Current "streaming" guards often rely on additional forward passes over growing text prefixes, creating latency bottlenecks, or they wait until the text becomes sufficiently explicit to classify, reacting only after the unsafe trajectory is already visible.
Implicit Harmfulness: Harmfulness is often not signaled by overtly toxic keywords. In dialogue and advice settings, unsafe behavior can be covert, context-sensitive, or implicit in the trajectory of a response (e.g., polite but encouraging self-harm). Surface-level text analysis or top-next-token preferences often fail to detect this drift toward unsafe regions before the content becomes explicit.

The paper addresses the stricter objective of anticipatory same-pass monitoring: detecting implicit harmful drift during decoding using only the generator's internal hidden states, without invoking an additional forward pass through the base model or a separate generative guard.

2. Methodology: AERIC

The authors introduce AERIC (Anticipatory Evidence and Residual Inference for Continuations), a lightweight monitor that reads hidden states produced during ordinary decoding. The system operates under a "same-pass" constraint, meaning it uses only quantities available from the current decode trajectory ( $h_t$ , prompt summary $p$ , and previous monitor values).

Core Components

AERIC combines three linear scalar heads trained on hidden states projected to a 128-dimensional representation:

Future-Hazard Head ( $f_t$ ):
- Goal: Predicts whether harmful continuation is about to begin within a short horizon.
- Mechanism: Uses onset-aware supervision (from FineHarm) to label prefixes based on the proximity to the harmful onset index ( $o$ ). It asks if the current trajectory is close to entering a harmful state, rather than if the visible prefix is already unsafe.
- Formula: $f_t = w_f^\top \tilde{h}_t + b_f$
Support Head ( $c_t$ ):
- Goal: Models counter-evidence for safe, bounded, supportive, or de-escalatory continuations to prevent over-triggering on emotionally intense but appropriate responses.
- Mechanism: Trained on safe, supportive, or bounded continuations (positive class) versus imminent or post-onset unsafe continuations (negative class).
- Formula: $c_t = w_c^\top \tilde{h}_t + b_c$
Prompt-Conditioned Residual Head ( $r_t$ ):
- Goal: Measures unsafe drift relative to safe behavior for the same prompt type.
- Mechanism: Instead of naive prompt subtraction, it learns the residual direction from matched safe and unsafe continuations paired at the prompt level. It scores whether the hidden-state trajectory has deviated toward an unsafe direction relative to safe behavior for that specific prompt context.
- Formula: $r_t = w_r^\top (h_t - p) + b_r$ , trained with a pairwise ranking loss to ensure unsafe residuals score higher than safe ones.

Decision Rule

The raw per-token score ( $g_t$ ) combines these signals:
$g_t = f_t - \alpha c_t + \beta r_t$
where $\alpha$ controls suppression by support evidence and $\beta$ controls the contribution of residual drift.

For online monitoring, the raw score is smoothed using an Exponential Moving Average (EMA):
$m_t = \lambda g_t + (1 - \lambda)m_{t-1}$
A generation is flagged if $m_t \geq \tau$ . This ensures the decision is prefix-measurable and stable.

Efficiency

The default linear monitor is extremely small, containing only 387 trainable head parameters (3 heads $\times$ 129 parameters each). The total stored artifact size is approximately 6.1 MiB for Qwen3-8B and 3.8 MiB for Gemma-4-E4B-it.

3. Key Contributions

Same-Pass Constraint: Demonstrates that a lightweight monitor can anticipate implicit harmful drift by reading internal hidden states without requiring additional forward passes through the base model.
Implicit Harm Transfer: Shows that explicit harmful supervision (FineHarm, Anthropic HH-RLHF) can be repurposed to detect implicit harmful dialogue via a combination of hazard forecasting, support-sensitive suppression, and prompt-conditioned residual scoring.
Architecture: Introduces a specific three-head architecture (Future-Hazard, Support, Paired Residual) tailored to the failure modes of implicit harm (covert drift, emotional intensity, context-dependence).
Calibration Strategy: Proposes a source-side safe-budget rule (maximizing trigger coverage while constraining safe-trigger rate to $\leq$ 10%) for prompt-level trigger benchmarks.

4. Experimental Results

Balanced Implicit-Harm Benchmarks

Evaluated on DiaSafety (conversational) and Harmful Advice (advice-oriented) using Qwen3-8B and Gemma-4-E4B-it.

Performance: AERIC outperforms the strongest native streaming baseline, Qwen3Guard-Stream-4B, and response-level guards (ShieldGemma-9B, WildGuard).
- DiaSafety: AUROC improved from 0.6830 (Qwen3Guard) to 0.7143 (AERIC).
- Harmful Advice: AUROC improved from 0.8219 (Qwen3Guard) to 0.8582 (AERIC).
Ablation: The "Support" head provided the largest gain on Harmful Advice (handling assertive but bounded guidance), while the "Residual" head provided the final lift on DiaSafety (handling conversational confounds).

Prompt-Level Trigger Benchmarks

Evaluated on HarmBench DirectRequest and SocialHarmBench under a source-side 10% safe-trigger budget.

Early Triggering: AERIC significantly outperforms baselines in triggering before the harmful content is fully exposed.
- HarmBench (Qwen): Trigger@64 reached 0.6438 (vs. 0.1063 for Qwen3Guard).
- SocialHarmBench (Gemma): Trigger@64 reached 0.7363 (vs. 0.2962 for Qwen3Guard).
Withholding: The monitor successfully withheld an average of 23.53 to 41.86 answer tokens before exposure.

Computational Overhead

Latency: On a fixed-generation benchmark, AERIC increased mean latency by only 2.34%.
Comparison: This is drastically lower than Qwen3Guard-Stream-4B (79.40% increase), prefixized ShieldGemma-9B (158.73%), and prefixized WildGuard (216.74%).

5. Significance and Claims

The paper claims that explicit harmful supervision can transfer to implicit harmful monitoring under a strict "no-extra-forward-pass" constraint.

Practical Pre-Exposure Signal: AERIC provides a practical, low-latency risk signal that can anticipate harmful drift before the content becomes explicit on the surface, even against strong native streaming guards.
System Efficiency: It demonstrates that safety signals can be derived from internal representations to support real-time monitoring with negligible overhead (approx. 2% latency increase).
Modest Scope: The authors explicitly state that AERIC is an online risk signal, not a complete intervention policy. The downstream decision (e.g., stopping generation, asking clarifying questions, or routing) remains an open systems problem. The paper does not claim to solve the problem of false refusals or to define the optimal intervention policy, but rather to provide a more efficient and anticipatory detection mechanism than current state-of-the-art guards.