The Vision

For decades, the cybersecurity world has relied on rules and signatures — firewalls, antivirus, and intrusion detection systems that the community can write, share, and update the moment a new threat appears, without rebuilding the underlying system. We don’t have this in AI safety. Today, keeping a model safe usually means retraining it or bolting on a black-box classifier that nobody can inspect, adjust, or trust.

GAVEL brings rule-based, signature-style security from cyber into AI safety. It is:

• Robust — rules operate on a model’s internal activations, not the surface text it produces, so they can’t be dodged by simply rewording a prompt.
• Flexible — safety rules can be written, tweaked, or removed on the fly, with no retraining of the model or its detectors.
• Collaborative — rules and the components they’re built from are shareable, versionable, and auditable, so the community can pool threat intelligence the same way security researchers share signatures today.

 

How It Works

Think of it as a security camera for a model’s mind. As the LLM processes a prompt and drafts a response, GAVEL taps into its internal activations and checks them against a set of rules:

Model activations → Cognitive Element probes
e.g. "making a threat", "payment processing" → Logical rule engine
e.g. IF threat AND payment THEN block → Remediation
Stop, Refuse, Disclose, Steer, ...

1. Cognitive Elements (CEs) are small, interpretable concepts — like “making a threat” or “processing a payment” — each detected by a lightweight probe trained on the model’s own internal activations.
2. Rules combine CEs with simple logic (“IF this CE AND NOT that CE, THEN flag”) to capture nuanced, domain-specific behavior with much higher precision than a single end-to-end classifier.
3. Because CEs and rules are separate, modular pieces, anyone can compose a new rule from existing CEs — or contribute a new CE — without retraining anything.

Rules and CEs are model-agnostic — they describe behaviors, not any one model’s internals, so the community can write, share, and reuse them freely across different LLMs. A rule only becomes model-specific the moment a model owner sets up their own GAVEL instance and trains CE probes on that particular model’s activations to classify against it.

 

What We Offer the Community

 

Publications & Talks

GAVEL: Towards Rule-Based Safety Through Activation Monitoring
Shir Rozenfeld, Rahul Pankajakshan, Itay Zloczower, Eyal Lenga, Gilad Gressel, Yisroel Mirsky. ICLR 2026. Rank A*

Rules for Neural Traffic: A New Defensive Layer for LLMs
Black Hat USA 2026 Briefing.

GAVEL: Rule-Based Security over LLM Activations
Stanford University, Real World AI Security (USA 2026)

 

Contributors

• PI: Yisroel Mirsky
• Researchers: Shir Rozenfeld, Rahul Pankajakshan, Gilad Gressel
• Research Assistants: Itay Zloczower, Eyal Lenga
• GAVEL Studio (base): Sean Shuhman, Ofek Avigezer, Shahaf Har-Tsvi, Shahar Navian

 

Get Involved

GAVEL is built to grow with its community. Explore the code, try GAVEL Studio, or reach out if you’d like to contribute a rule, a Cognitive Element, or an integration.

Offensive AI Lab on GitHub · Contact Us

 

---

Funded by the European Union, ERC Starting Grant AGI-Safety (GA 101222135)

Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union or the European Research Council Executive Agency. Neither the European Union nor the granting authority can be held responsible for them.