Google's Gemini 4 Argon monitoring includes probes that read the model's internal signals
Google says Gemini 4 Argon runs behind three layers of real-time protection, one of which reads the model's internal signals. The post does not include a sabotage-evasion rate, so it cannot show that reasoning text has stopped working as an audit log.
Written for builders.See today for builders
Google says its previous generation solved five of its end-to-end simulated cyberattack scenarios, and Argon solved all 12.
| Measure | Value | As of | Claim |
|---|---|---|---|
| Previous generation, per Google | 5 scenarios solved | 6 | |
| Argon, per Google | 12 scenarios solved | 6 |
What happened
- Google says the internal-introspection layer uses small transformers called activation probes, which read the model's internal neural signals.
- In the continuous-monitoring layer, Google combines signals as the model reasons and writes across multiple steps, and can cut off the agent mid-stream.
- Google says external bio jailbreak red teaming could unlock less than 1% of the bio sub-tasks it tests for.
- Google says Argon solved all 12 end-to-end simulated cyberattack scenarios, up from five in the previous generation.
Why it matters
- What it limits constraint The probes are trained on cyber and bio knowledge, so what they demonstrably cover is misuse. Coverage of an agent hiding its intent is a separate claim that needs its own test.
- Who has to decide decision Teams that log an agent's reasoning text as their audit record can ask whether their monitor sees anything else. Google's design combines internal signals with the output.
- Who's exposed exposure A model that solved all 12 simulated attack scenarios is costlier to miss on, so a monitor's miss rate is the number buyers should ask for.
A sabotage-evasion rate is a monitor's miss rate, and it needs a denominator: how many sabotage attempts were run, and against which baseline. Neither Google's post nor a16z's AINews roundup includes one. The misalignment section of Google's post, in the portion available, breaks off at its honeypot tests [8].
The numbers Google does report measure something else. According to Google, violations on its adversarial stress set fell nearly twofold [7]. That is a refusal score: a harmful request goes in, and a harmful answer does or does not come out. Misalignment, as Google defines it, is an agent deciding on its own to pursue a goal different from the user's [8]. A refusal score does not measure that.
The probes are trained to spot when the model is activating knowledge about cyberattacks or biological threats [3]. That makes them a misuse detector first. Whether they would also catch an agent concealing its intent is a separate question.
In our view, a design that combines internal signals with the written output [4] does not depend on the reasoning text being a faithful record. That is a sound hedge. It is an inference from the architecture, and Google does not report it as a result. The claim that chain-of-thought has stopped working as an audit log would need a measured miss rate, a control, and a stated denominator.
What to watch
- Google's full Safety and Security Report: whether it gives honeypot results with a denominator and a miss rate for its monitors.
- Independent evaluations of Argon's monitoring that report how often sabotage-style behavior passes undetected, with a control.
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Google says it wraps Gemini 4 Argon in three layers of real-time protection: input screening, internal introspection and continuous monitoring.
- [2]
Google says the internal-introspection layer uses small transformers ("activation probes") that read the model's internal neural signals.
- [3]
Google says the activation probes are trained to spot when the model is activating knowledge about cyberattacks or biological threats.
- [4]
Google says that in continuous monitoring, as the model reasons and writes its response across multiple steps, it combines these signals and takes action when necessary, such as cutting off the agent mid-stream if the responses become problematic.
- [5]
Google says external bio jailbreak red teaming could only unlock less than 1% of the bio sub-tasks it tests for.
- [6]
Google says Argon solved all 12 of its end-to-end simulated cyberattack scenarios, up from five in its previous generation.
- [7]
Google says that on an adversarial set meant to stress test the model, violations reduced nearly twofold.
- [8]
Google describes misalignment as an agent deciding on its own to pursue a goal different to what the user intended, and says it ran realistic "honeypot" tests for that behavior.
- [9]
Google says its full Safety and Security Report systematically covers its set of defenses for Argon.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources & coverage · 2 publishers
The reporting this story was synthesized from, earliest first. Every link goes to the original.
- blog.googleRaluca Ada Popa3d agoDeveloping Gemini 4 Argon responsibly and safely
- open.substack.com2d ago[AINews] AI Engineer NYC: Gemini 4 Argon, Vals AI Benchmarks