LEMON Monitors Any LLM for Hallucinations and Jailbreaks Without Model-Specific Training

Researchers from the Technion, Tel Aviv University, and Google Research have released LEMON, a safety monitoring framework that reads a language model's internal attention patterns to detect misbehaviors — including hallucinations and jailbreak-driven refusal bypasses — without requiring any labeled examples from the model being monitored. The paper appeared in today's arXiv cs.AI listing, targeting a fundamental gap in how deployment teams currently achieve safety coverage for new open-weight models.

The core advance is portability. Most LLM safety probes work by training classifiers on internal activations from a specific model, which means a team deploying a new model must collect incident-labeled data, train a new probe, validate it, and only then achieve coverage. At current release cadences, that pipeline can introduce weeks of unmonitored exposure for every new model entering production. LEMON eliminates that requirement: a probe trained on one or several source LLMs transfers zero-shot to architectures the monitor has never seen.

Why Standard Probes Cannot Cross Architecture Boundaries

The obstacle to cross-model transfer is structural. Standard activation probes operate on hidden states drawn from a model's residual stream, which varies in dimensionality and semantic alignment across architectures. Attention maps share a more consistent semantics — every entry describes how much one token attends to another at a given layer and head — but naively pooling attention maps across models still fails because different architectures use different numbers of heads and layers, with no canonical mapping that equates one model's head 3 to another model's head 3.

LEMON frames this as an algebraic symmetry problem. The attention map produced by an N-token sequence across L layers and H heads forms a tensor A ∈ [0,1]^(N×N×L×H). Permuting the head indices — relabeling head 3 as head 7 — yields an equivalent representation of the same underlying behavior. A monitor that is equivariant under such permutations treats all valid head orderings identically, removing the dependency on any particular architecture's internal conventions. The paper implements this through a graph neural network with W-equivariant message passing: tokens become graph nodes, attention scores become node and edge attributes, and the GNN is constrained to be invariant under permutations of both the head and layer dimensions. [LINK: LEMON arXiv 2610.22723 equivariant GNN architecture]

The monitor runs online during token generation, scoring each new token against a window of recent attention states. The paper reports that this real-time mode adds fewer than 8% computational overhead relative to standard inference — a key property for production deployments where latency budgets matter. [LINK: LEMON arXiv 2610.22723 inference overhead table]

Consistent Transfer Across 16 Models and Six Benchmarks

The team evaluated LEMON in a cross-model zero-shot setting: probes trained on source models applied directly to held-out LLMs the monitor had never encountered during training. The evaluation spans 16 LLMs from six architecture families — 135M to 13B parameters, releases from 2023 through 2025 — against six benchmark datasets covering both hallucination detection and jailbreak monitoring tasks. LEMON improved ROC-AUC by up to 14 points over the strongest baseline (a probability-based detector the authors call "Prob") and achieved the top result in 16 of 18 model-benchmark pairs. [LINK: LEMON arXiv 2610.22723 experimental results tables]

Lookback Lens (Chuang et al., EMNLP 2024) demonstrated that attention patterns support hallucination detection within a model family — a probe trained on a 7B model generalizes to its 13B sibling — but does not achieve zero-shot transfer to unrelated architectures. [LINK: Lookback Lens EMNLP 2024] ACT-ViT, an earlier paper from overlapping Technion authors published at NeurIPS 2025, used activation tensors processed by a vision transformer and required fine-tuning when moved to new LLMs. [LINK: ACT-ViT NeurIPS 2025 Bar-Shalom Frasca Maron] LEMON extends zero-shot reach across architecturally dissimilar models while keeping overhead under 8%.

White-Box Access, Scale Limits, and What Comes Next

The approach requires white-box access to the monitored model's attention layers, which means it cannot be applied to closed-API systems such as GPT-4o or Claude where attention maps are not exposed. For organizations operating open-weight models — the deployment context where the portability problem is most acute — this constraint is typically non-blocking, but it defines the current applicability boundary.

The evaluation covers models up to 13B parameters. Whether equivariant message passing over attention graphs continues to perform at 70B-plus scales or in reasoning-oriented architectures where attention distributions may differ structurally is an open empirical question. The paper is a preprint awaiting peer review, and code was noted as forthcoming at listing time.

The practical implication is direct: safety coverage for a new open-weight model no longer requires waiting for labeled incident data. An equivariant probe trained across a representative set of source architectures can operate as a production monitor from the moment a new release is available, compressing the current weeks-long gap between deployment and coverage — a meaningful reduction in a threat-surface that grows with each new open-weight frontier release.