Source-linked AI summary
DeepSight: An All-in-One LM Safety Toolkit
Bo Zhang, Jiaxuan Guo, Lijun Li, Dongrui Liu, Sujin Chen, Guanxu Chen, Zhijie Zheng, Qihao Lin, Lewen Yan, Chen Qian, Yijin Zhou, Yuyao Wu, Shaoxiong Guo, Tianyi Du, Jingyi Yang, Xuhao Hu, Ziqi Miao, Xiaoya Lu, Jing Shao, Xia Hu
TL;DR
LM safety workflows often separate behavioral evaluation from diagnosis of internal mechanisms, leaving observed risks disconnected from their root causes. DeepSight integrates these stages through DeepSafe and DeepScan, and its analyses report modality-dependent alignment changes, cross-dimensional frontier-risk variation, and latent-space geometry associated with robustness. The toolkit’s scope is bounded by multimodal alignment demands and the hypothesis that neuron-level decoupling may reduce conflicts between competing safety objectives.
Problem
Current LM safety tools separate behavioral evaluation from internal diagnosis, limiting a unified view of external risks and safety mechanisms.
Method
DeepSight integrates DeepSafe for scalable benchmark and frontier-risk evaluation with DeepScan for representation and objective-conflict diagnosis using shared task and data protocols.
Results
Across evaluated models, visual modalities reduce safety alignment, reasoning-enabled multimodal models better identify image-text splitting attacks, frontier-risk strengths vary by dimension, and latent-space geometry matters for robustness.
Takeaways & Limitations
DeepSight provides an open-source evaluation–diagnosis toolkit intended to support more reliable, interpretable safety repairs and verifiable safety engineering.
Takeaways & Limitations
Multimodal safety alignment requires coordinated optimization across vision and language, demanding substantial training data, test-sample richness, and engineering resources.
Abstract
from arXiv · showhide
As the development of Large Models (LMs) progresses rapidly, their safety is also a priority. In current Large Language Models (LLMs) and Multimodal Large Language Models (MLLMs) safety workflow, evaluation, diagnosis, and alignment are often handled by separate tools. Specifically, safety evaluation can only locate external behavioral risks but cannot figure out internal root causes. Meanwhile, safety diagnosis often drifts from concrete risk scenarios and remains at the explainable level. In this way, safety alignment lack dedicated explanations of changes in internal mechanisms, potentially degrading general capabilities. To systematically address these issues, we propose an open-source project, namely DeepSight, to practice a new safety evaluation-diagnosis integrated paradigm. DeepSight is low-cost, reproducible, efficient, and highly scalable large-scale model safety evaluation project consisting of a evaluation toolkit DeepSafe and a diagnosis toolkit DeepScan. By unifying task and data protocols, we build a connection between the two stages and transform safety evaluation from black-box to white-box insight. Besides, DeepSight is the first open source toolkit that support the frontier AI risk evaluation and joint safety evaluation and diagnosis.
1 Introduction
DeepSight addresses fragmented LM safety workflows by integrating behavioral evaluation with internal diagnosis. Its DeepSafe and DeepScan engines support scalable evaluation, frontier-risk assessment, and analysis of safety mechanisms and failures.
- DeepSight connects safety evaluation and diagnosis by unifying task and data protocols.This links observed behavioral failures with analysis of how safety concepts are encoded internally.
- DeepSafe provides a modular evaluation framework integrating over 20 safety benchmarks and supporting frontier AI risk assessment.It is designed to be low-cost, reproducible, efficient, and highly scalable.
- DeepScan diagnoses representation-level structures and objective-level conflicts by locating key layers and neurons without modifying model weights.
- DeepSight is presented as the first open-source toolkit supporting both frontier AI risk evaluation and joint safety evaluation and diagnosis.
- Visual modalities reduce safety alignment across model tiers and widen the disparity between open-source and closed-source models in cross-modal scenarios.
- Reasoning-enabled multimodal models show stronger safety alignment on image-text splitting attacks, while frontier-risk strengths vary across dimensions and latent-space geometry affects robustness.
2.1 Overview
DeepSight establishes a verifiable engineering loop that connects behavioral safety assessment with diagnosis of internal mechanisms. DeepSafe evaluates outcomes, while DeepScan probes representations and objective conflicts to support interpretable repairs.
- Traditional safety workflows separate external-risk evaluation from analysis of internal root causes.
- DeepSight combines DeepSafe and DeepScan into a verifiable loop from black-box assessment to white-box insight.
- DeepSafe standardizes behavioral assessment across over 20 benchmarks, while DeepScan probes representation structures and objective-level conflicts.
- Harmonized task and data protocols connect observed failures with internal safety representations and support more reliable, interpretable repairs.
2.2 DeepSafe
DeepSafe is a modular, configuration-driven toolkit for standardized LLM and MLLM safety evaluation. It integrates diverse benchmarks, evaluators, reporting components, and reproducible execution through a single configuration workflow.
- DeepSafe integrates over 20 safety datasets and supports LLM and MLLM evaluation through a modular, configuration-driven architecture.
- A centralized Registry Mechanism coordinates five foundational modules and decouples task implementation from execution logic.This allows new datasets or metrics to be integrated with minimal code changes.
- DeepSafe normalizes diverse benchmark inputs into a consistent schema and supports custom JSONL datasets.
- Its evaluators combine native benchmark protocols, rule-based matching, and model-based assessment, including the specialized ProGuard judge.ProGuard is fine-tuned on 87k safety pairs to detect subtle risks and adversarial attacks.
- The four-stage workflow—configuration, inference, assessment, and reporting—is driven by one YAML file and produces metrics and visualization reports.
- The “Config-as-Execution” paradigm lowers the barrier for safety research while supporting scalable and reproducible evaluations.
2.3 DeepScan
DeepScan complements behavioral evaluation with configuration-driven diagnosis of internal representations and conflicts among safety objectives. Its registry-based pipeline supports extensible evaluators, multi-model runs, structured outputs, and analysis of latent geometry, disentanglement, neuron coupling, and reasoning information.
- DeepScan probes representation-level structures and objective-level conflicts without modifying model weights.
- 2.3 DeepScan: A registry-based, declarative workflow separates model, dataset, evaluator, and reporting components so extensions avoid changes to core execution code.
- 2.3.2 Built-in Diagnostic Evaluators: Built-in evaluators can be combined across datasets and include X-Boundary, TELLME, SPIN, and MI-Peaks.
- 2.3.1 Core Components: DeepScan provides a uniform inference interface while retaining access to underlying models and tokenizers for intermediate-representation extraction.
- 2.3.2 Built-in Diagnostic Evaluators: X-Boundary analyzes safe, harmful, and boundary hidden-space geometry to explain crisp boundaries, boundary ambiguity, and over-refusal.
- 2.3 DeepScan: The pipeline runs configuration, execution, and summarization stages, producing per-evaluator artifacts, aggregate reports, and traceable result payloads.
- 2.3 DeepScan: Multi-model and multi-evaluator runs unify DeepSafe’s outcome assessment with DeepScan’s internal diagnosis in one safety ecosystem.
3.1 Experimental Setup
The experiments use separate benchmark suites and model checkpoints to evaluate safety risks and diagnose internal mechanisms across LLMs and MLLMs.
- DeepSafe setup: DeepSafe evaluates LLMs and MLLMs across content-risk and frontier-risk benchmark domains.The setup lists distinct datasets for content safety and frontier AI risks.
- DeepScan setup: DeepScan evaluates a task suite spanning multiple model families, including Qwen, Llama, Mistral, Gemma, GLM, InternLM, and InternVL checkpoints.The listed checkpoints cover both text-only and multimodal model families.
3.2 Content Risk Evaluation and Analysis
The evaluation finds hierarchical safety performance in LLMs but broader weaknesses and sharper disparities in MLLMs, where visual inputs expand cross-modal attack surfaces. Reasoning capabilities provide limited gains for text safety yet measurable advantages in multimodal settings.
- LLM safety trends: LLMs show hierarchical safety performance that positively correlates with foundational cognitive capabilities.The analysis identifies clear performance tiers and a significant positive correlation between defense capabilities and foundational cognition.
- LLM safety trends: First-tier LLMs exceed 0.77 overall safety, but Model Algorithm Safety remains a comparatively weak dimension.Social and Ethical Safety scores frequently exceed 0.85, while algorithmic robustness remains vulnerable.
- MLLM safety trends: MLLM safety rates decline across tiers, ranging from 0.65–0.71 in the first tier to minimum scores of 0.38 in the fourth tier.Lower-tier MLLMs also reach 0.19 in Network Systems and Information Content Safety when identifying cross-modal adversarial attacks.
- MLLM safety trends: Multimodal introduction produces a 0.33 leading-to-trailing tier gap, compared with 0.17 in text domains.The analysis characterizes this as cross-modal safety degradation alongside intensified performance differentiation.
- Reasoning comparison: Reasoning models show dimension-specific trade-offs, improving Network Systems and Information Content Safety to 0.78 versus 0.76 but trailing in Model Algorithm Safety at 0.63 versus 0.69.They also score 0.63 versus 0.61 in Reality and Cognitive Safety and 0.68 versus 0.76 in Vertical Domain Safety.
- Reasoning comparison: Reasoning models surpass non-reasoning models in multimodal safety, with scores of 0.5633 versus 0.5383.The reported advantage contrasts with highly similar reasoning and non-reasoning performance in text safety tasks.
- Model-source comparison: Open-source and closed-source models perform comparably in text safety, averaging 0.7162 and 0.7262 respectively, a 1.4% gap.The text-domain convergence contrasts with a notable performance gap in multimodal settings.
3.3 Frontier AI Risk Evaluation and Analysis
DeepSight evaluates frontier AI risks across nine dimensions and reveals substantial variation across models, dimensions, reasoning capabilities, time, and efficiency settings.
- Overall Frontier Risk Landscape: Table 4 evaluates 14 models across 9 frontier-risk dimensions, ranking them by overall safety rate.Higher values indicate safer behavior.
- Overall Frontier Risk Landscape: Overall safety rates span approximately 13 percentage points, from first-tier models above 73% to third-tier models below 66%.Kimi-K2-Thinking leads at 74.93%, while GLM-4.5-Air scores 62.09%.
- Dimension-Level Difficulty Spectrum: Manipulation is the weakest dimension at 18.8% mean safety, while AIRD and EvalFaking are nearly saturated at 96.7% and 95.0%.Five models fall below 5% on Manipulation.
- Non-Transferability Across Dimensions: Safety strengths are dimension-specific: no model leads more than two dimensions, and top overall models can still have the lowest score on a particular risk.Kimi-K2-Thinking leads overall but has the lowest Manipulation score.
- Impact of Reasoning Capabilities: Reasoning-enabled models average 11.6% on Manipulation versus approximately 30% for non-reasoning models, although their disadvantage is not universal across risks.All three examined reasoning models exceed 94% on EvalFaking, while two tie at 96.67% on DeceptionBench.
- Temporal Evolution of Safety: Manipulation resistance declined from roughly 30%–33% in 2024 and early 2025 to generally 1%–5% in mid-to-late 2025, followed by partial recovery in late 2025.GPT-5.2 reaches 23.33% and Gemini-3-Flash 27.78%, still below 2024 levels.
- Efficiency–Alignment Trade-off: Small open-source and Flash closed-source models show lower honesty-related safety rates than their larger and non-Flash counterparts.The largest reported gap is 0.19 on MASK between Flash and non-Flash closed-source variants.
3.4 Joint Safety Evaluation and Diagnosis
DeepSight connects behavioral safety evaluation with latent-space diagnosis, linking safety performance to representation geometry and neuron-level coupling.
- Representation Geometry: DeepScan associates excessive safe–harmful geometric separation with sparse latent representations and poorer fine-grained safety judgments.Gemma-3-27B-IT combines geometric anomalies with 71.93% on SALAD-Bench and 39.87% on MedHallu.
- Neuron-Level Coupling: GLM-4.5-Air has a fairness-and-privacy coupling index of -16.51 but only 66.44% overall text safety, showing internal–external performance discrepancy.Models with higher overall safety scores can have weaker coupling indices.
- Neuron-Level Coupling: The authors hypothesize that neuron-level functional decoupling may reduce conflicts between competing safety objectives, whereas entanglement may create objective-interference risks.This is presented as a long-term hypothesis rather than a demonstrated causal result.
- Subspace Encoding and Orthogonality: Qwen2.5-72B-Instruct reaches a TELLME composite encoding rate of 951.76 and 86.97% on HarmBench, whereas InternLM3-8B reaches 285.37 with more dispersed representations.The comparison links separable low-dimensional subspaces with stronger adversarial robustness.
- Representation Separation: Mistral-Small-24B-Instruct has a safe–harmful separation score of 1.89 and a 26.74% Flames attack success rate, indicating highly overlapping safety representations.The analysis argues that inference-time thresholds or prompts cannot address this representational root cause alone.
4 Related Work
Related work spans programmable safety evaluation, latent-space geometry, task-region localization, and analyses of reasoning and generation dynamics.
- Programmable Evaluation Frameworks: Programmable evaluation frameworks support multi-turn interaction, tool use, reusable templates, model-graded judging, and consistent scoring protocols.OpenAI Evals and Inspect are presented as representative lightweight harnesses.
- Geometric Representation Analysis: Geometric diagnostic research uses probing and structured representation analysis to decode truthfulness, safety directions, and internal model states.The cited progression moves from linear probes toward broader latent-space structure.
- Task Regions and Reasoning Dynamics: Other related directions locate knowledge, skill, attention, and safety-specific regions, while reasoning research examines mechanisms underlying generation and in-context learning.Prior work also reports fragility of alignment under pruning or low-rank modifications.
5 Conclusion and Discussion
DeepSight presents an open-source, closed-loop approach that integrates safety evaluation with diagnosis and reports insights across content and frontier-risk domains.
- Conclusion and Discussion: DeepSight integrates DeepSafe and DeepScan to move safety engineering beyond black-box testing toward white-box insight.The toolkit is intended to support a transition from reactive patching to proactive, verifiable safety engineering.
- Conclusion and Discussion: Its evaluations identify critical patterns in the current safety landscape across content-level and frontier-risk domains.The conclusion frames these findings as evidence from extensive model evaluation.