JADR协议能从模型内部直接测出危险识别能力，不用外部裁判，还能对比Qwen3和Gemma 2在不同量化下的安全表现，挺实用。
该论文提出JADR（Jacobian Assessment of Danger Recognition）协议，利用Jacobian空间（J-space）在模型生成第一个token前衡量其危险识别能力。协议将每个层级的top-k J-space tokens映射到6个行为轴，并使用StrongREJECT构建危险样本、XSTest和OKTest构建安全对照。方法不依赖外部裁判模型，完全在模型激活上本地运行。研究者测试了Qwen3-1.7B、Qwen3-4B、Qwen3-8B、Qwen3-Uncensored-4B、Qwen3-SafeRL-4B和Gemma 2 9B共6个模型在BF16、INT8、INT4三种量化精度下的表现，使用SafetyAUC指标及bootstrap置信区间进行统计比较。结果能显著区分模型内部安全机制的强弱并揭示不同量化带来的差异。
Silent Alarm: A J-Space Protocol for Comparing Danger Recognition Across Models and Quantization Levels
Jailbreak-robustness research typically evaluates safety through generated responses using an LLM-as-judge approach. Such evaluations, however, are sensitive to the benchmark's grading procedure and capture only observed behavior on a given set of attacks, without directly revealing the hidden fragility of the underlying safety mechanisms. This work proposes JADR (Jacobian Assessment of Danger Recognition), a protocol that measures a model's internal representation through Jacobian space (J-space, a recently proposed workspace of verbalizable concepts) before the first response token is generated. For every prompt and layer we record the top-k J-space tokens; these are grouped into six behavioral scenario axes and compared between a danger sample based on StrongREJECT and a safe control drawn from XSTest and OKTest. The method does not call on an external judge model: the computation runs entirely locally, on the activations of the model under evaluation, which lets us compare both different models against each other and modifications of a single model -- quantization and fine-tuning in particular -- on the same terms. The final comparison rests on the proposed SafetyAUC metric, complemented with bootstrap confidence intervals. The protocol is applied to six models (Qwen3-1.7B, Qwen3-4B, Qwen3-8B, Qwen3-Uncensored-4B, Qwen3-SafeRL-4B, Gemma 2 9B) across three weight-representation regimes -- BF16, INT8, and INT4 -- and checked against an independent behavioral evaluation with the StrongREJECT grader. The metric separates models with a strong versus a weak internal safety mechanism with statistical significance and captures substantively different effects across quantization regimes.