Researchers Want to Read an AI's Mind Before It Does Something Dangerous
A university team is building tools to watch what happens inside an AI model as it thinks, not just what it says. The goal: catch harmful requests that slip past every other filter.
Key points
- Ben-Gurion University of the Negev researchers will present the GAVEL system at Black Hat USA 2026 in August.
- GAVEL watches internal AI activity, called "activations," rather than scanning the words typed into or out of a model.
- The system uses a shared dictionary of "cognitive elements" so security rules can be written, shared, and reused across different AI products.
- Language-switching tricks that fool today's word-scanning filters cannot fool activation analysis, because the same brain regions light up regardless of which language the request was written in.
- The project is funded by the European Union and the team is releasing open-source tools for the wider security community.
Most of today's AI safety tools work the same basic way: read what goes in, read what comes out, flag the bad stuff. The problem is that attackers already know this. Writing a harmful request in French, or wrapping it in code, or sliding it through a side door in the system can fool word-scanning filters almost trivially. Security researchers at Ben-Gurion University of the Negev think the answer is to stop reading the words and start watching the thinking.
How does this work in plain terms?
Inside every AI model is a web of artificial neurons, tiny mathematical switches that fire in patterns as the model processes a request. The BGU team treats those firing patterns the same way a neurobiologist treats a brain scan: if certain clusters of neurons light up, something specific is being thought about.
Their system, called GAVEL (Governance via Activation-based Verification and Extensible Logic), maps those firing patterns to plain-language labels they call "cognitive elements." Think of cognitive elements as building blocks: words like "create content," "personal information," or "masquerade as human." Stack the right blocks together in a rule and you get a detector. The combination "create content" plus "personal information" plus "click/enter" points to a possible phishing attempt, where criminals craft fake messages to steal people's passwords or bank details.
The design borrows from Snort and YARA, two well-known rule sets that network defenders already use to spot attacks on computer networks. The point is to give security teams a shared vocabulary so that one team's carefully written rule can be dropped straight into another team's system.
"If the model's thinking about doing that dangerous task, I should be able to pick up on that inside the neural activations themselves," said Yisroel Mirsky, head of the Offensive AI Research Lab at Ben-Gurion University and the project's lead researcher, as first reported by Dark Reading.
Why do current filters keep failing?
Today's filters scan text, the tokenized input and output, meaning the raw words and characters the model sees. That works for the obvious cases. It breaks the moment an attacker changes the surface without changing the intent. A jailbreak prompt, where someone tries to trick an AI into ignoring its own safety rules, looks completely different if you translate it into Mandarin or encode it in Base64, a way of scrambling text into a string of letters and numbers. The word-scanner misses it. Activation analysis does not, because the same clusters of neurons fire no matter which language carried the instruction.
Previous activation-analysis research labelled whole buckets of behaviour as "cybercrime" or "misinformation," which is too blunt. It produced too many false alarms and could not explain its reasoning. GAVEL's granular cognitive-element approach is meant to fix both problems.
| Layer | What it scans | Main weakness |
|---|---|---|
| Token/word filtering | Text typed in or out | Bypassed by language changes or encoding |
| Traditional activation analysis | Internal neuron firing | Broad labels, high false-alarm rate |
| GAVEL | Internal neuron firing + granular rules | Still early research, needs community adoption |
Mirsky is careful not to oversell it. Researchers are "still very much poking in the dark," he says, and GAVEL is a complement to existing filters, not a replacement. Word-level scanning is cheap, fast, and catches the vast majority of attacks. Activation analysis is the deeper layer that catches the sophisticated attempts that make it through everything else.
The team plans to release open-source code and a starter rule set at Black Hat in August. Whether it takes hold will depend on how many practitioners pick it up, write new rules, and push them back to the shared repository.
Operational takeaway: the failure mode here is monoculture, defending AI with a single layer and assuming attackers won't find the angle it misses.
