language:

• en
  license: mit
  size_categories:
• 1K<n<10K
  task_categories:
• text-classification
  task_ids:
• intent-classification
• multi-class-classification
  tags:
• jailbreak-detection
• llm-safety
• sparse-autoencoders
• mechanistic-interpretability
• benchmark
• SAE
• activation-probing
• NeurIPS
  pretty_name: SAEGuardBench
  configs:
• config_name: prompts
  data_files:
  • split: jailbreakbench_harmful
    path: prompts/jailbreakbench_harmful.parquet
  • split: jailbreakbench_benign
    path: prompts/jailbreakbench_benign.parquet
  • split: harmbench
    path: prompts/harmbench.parquet
  • split: advbench
    path: prompts/advbench.parquet
  • split: sorry_bench
    path: prompts/sorry_bench.parquet
  • split: wildjailbreak
    path: prompts/wildjailbreak.parquet
• config_name: results
  data_files:
  • split: detection
    path: results/detection_results.parquet
  • split: transfer
    path: results/transfer_results.parquet
  • split: hybrid
    path: results/hybrid_results.parquet

dataset_info:

• config_name: prompts
  features:
  • name: prompt
    dtype: string
  • name: label
    dtype: string
  • name: source
    dtype: string
  • name: category
    dtype: string
• config_name: results
  features:
  • name: model
    dtype: string
  • name: method
    dtype: string
  • name: dataset
    dtype: string
  • name: auroc_mean
    dtype: float64
  • name: auroc_std
    dtype: float64

SAEGuardBench

Do SAE Features Actually Help Detect Jailbreaks? A Systematic Benchmark of Interpretability-Based Safety Methods

Overview

SAEGuardBench is the first systematic benchmark evaluating whether Sparse Autoencoder (SAE) features improve jailbreak detection in large language models. We compare 8 detection methods across 4 paradigms on 6 datasets and 4 models (2B--70B parameters).

This dataset contains:

• Benchmark prompts from 6 jailbreak/safety datasets (3,590+ prompts)
• Structured experiment results (detection accuracy, transfer, hybrid recovery)
• Trained probe checkpoints for all 8 detection methods
• Raw experiment outputs (100+ JSON files with full metadata)

Key Finding: The Detection Gap

SAE features consistently hurt jailbreak detection. The Detection Gap (best SAE AUROC minus best non-SAE AUROC) is negative on every model tested:

A simple linear probe on raw activations (0.949 AUROC) outperforms every SAE-based method and LlamaGuard-3 (0.885).

InterpGuard

We propose InterpGuard, a two-stage framework:

1. Detect with raw activation probes (0.957 AUROC)
2. Explain with SAE feature activations (98% of harmful samples have safety-relevant concepts in top-10 features)

Dataset Structure

Prompts (prompts config)

Schema: prompt (string), label (harmful/benign), source (dataset name), category (harm type)

Results (results config)

Schema: model, method, dataset, auroc_mean, auroc_std

Additional Files

Detection Methods

Models Evaluated

Quick Start

from datasets import load_dataset

# Load benchmark prompts
prompts = load_dataset("mdarahmanxAI/SAEGuardBench", "prompts")

# Access specific splits
jbb_harmful = prompts["jailbreakbench_harmful"]
harmbench = prompts["harmbench"]

print(f"JailbreakBench: {len(jbb_harmful)} harmful prompts")
print(f"HarmBench: {len(harmbench)} prompts")
print(f"Sample: {jbb_harmful[0]['prompt'][:80]}...")

# Load structured results
results = load_dataset("mdarahmanxAI/SAEGuardBench", "results")
detection = results["detection"]

# Filter for a specific model
gemma_results = detection.filter(lambda x: "gemma" in x["model"].lower())

Reproduce Results

git clone https://github.com/ronyrahmaan/saeguardbench.git
cd saeguardbench
uv sync
uv run python scripts/run_all.py  # Full pipeline

See the GitHub repository for detailed instructions.

Citation

@article{rahman2026saeguardbench,
  title={Do {SAE} Features Actually Help Detect Jailbreaks?
         {A} Systematic Benchmark of Interpretability-Based Safety Methods},
  author={Rahman, Md A},
  journal={arXiv preprint arXiv:XXXX.XXXXX},
  year={2026}
}

License

MIT License. See individual upstream dataset licenses for source data terms.