---
title: "ETH Zurich's Adaptive Probes Beat DPO at Safety Without Breaking AI Transparency"
subtitle: "Researchers train language models directly against activation probes to make them safer, more honest, and harder to jailbreak, without blinding interpretability tools."
url: "https://alphasignal.ai/news/eth-zurich-s-adaptive-probes-beat-dpo-at-safety-without-breaking-ai-transparency"
author: "AlphaSignal Newsroom"
author_url: "https://alphasignal.ai/editorial-team"
company: "AlphaSignal"
company_url: "https://alphasignal.ai/company/alphasignal"
published: "2026-09-29T23:03:54.000Z"
updated: "2026-10-03T12:05:53.788Z"
type: "Paper"
topics:
  - "Post Training"
  - "Security"
subtopics:
  - "Alignment"
  - "Dpo"
  - "Red Teaming"
upvotes: 236
source_url: "https://arxiv.org/abs/2609.38645"
comments: 0
truncated: true
---

# ETH Zurich's Adaptive Probes Beat DPO at Safety Without Breaking AI Transparency

> Researchers train language models directly against activation probes to make them safer, more honest, and harder to jailbreak, without blinding interpretability tools.

# Adaptive probes guide safety tuning without losing decodability

Researchers at ETH Zurich and the ELLIS Institute Tübingen report that classifiers over a model’s hidden activations can provide the primary behavioral signal for alignment. Their method, called [probe-guided fine-tuning](https://arxiv.org/abs/2609.38645), repeatedly updates those classifiers as the model changes. Across experiments involving Mistral, Llama, and Qwen models, adaptive probes reduced harmful or deceptive behavior while preserving the ability of newly trained probes to detect the same concepts.

Output-based methods such as reinforcement learning from human feedback, direct preference optimization, and constitutional AI derive supervision from generated text. A capable model may learn to satisfy an evaluator without adopting the intended behavior across contexts. Internal supervision offers another control surface, although optimization can invalidate any monitor used as a fixed target. The paper tests whether continuously refitting that monitor can prevent such evasion. The authors provide an accompanying [GitHub repository](https://github.com/aisa-group/training%5Fagainst%5Fprobes).

## Output scores can miss the mechanism

Most post-training pipelines reward responses that evaluators prefer. DPO learns directly from preferred and rejected response pairs, while RLHF typically uses a learned reward model. These methods can improve observable behavior, but their objectives contain limited information about the internal representations producing it.

A probe is a small classifier trained to predict a concept, such as harmfulness or dishonesty, from a model’s hidden activations. If a probe reliably separates harmful from harmless examples, its score can become a training objective: move activations associated with generated responses toward the desired side of the classifier’s boundary.

Previous work has treated this approach cautiously because a model can reduce probe loss by changing how it represents the concept. A fixed probe may then stop detecting harmful activations even when the generated behavior remains harmful. Optimization has removed the monitor’s access to the feature without resolving the underlying behavior.

## A monitor that moves with the model

Probe-guided fine-tuning alternates between updating the language model and refreshing the probes that supervise it:

1. The current model generates on-policy completions, meaning the samples come from the version being trained.
2. The system records hidden activations from those completions.
3. One or more linear or nonlinear probes score the activations for the target concept.
4. A margin-based loss moves the activations toward the desired side of each probe boundary.

_Preview only. Full text requires an AlphaSignal Pro account._

## Sources

- [Alignment via Training Against Probes Without Losing Monitorability](https://arxiv.org/abs/2609.38645)
- [training_against_probes - GitHub](https://github.com/aisa-group/training_against_probes)
- [Probe-based Fine-tuning for reducing Toxicity](https://arxiv.org/html/2510.21531v1)