A new arXiv paper studies a simple real-time safety monitor for LLM outputs: take a verifier signal from an external model, apply a calibrated threshold, and raise an alarm when safety can no longer be assumed.
The paper, “Online Safety Monitoring for LLMs,” was submitted on July 2 by Mona Schirmer, Metod Jazbec, Alexander Timans, Christian Naesseth, Maja Waldron, and Eric Nalisnick. It is listed for the ICML 2026 Hypothesis Testing Workshop.
The problem is deployment-time safety. Alignment training reduces unsafe behavior, but it does not remove the need to monitor outputs when a model is actually being used.
The monitor is intentionally simple
The paper’s monitor uses an external model as a verifier. That verifier produces a signal about output safety. The system then turns the signal into an alarm decision through thresholding, with the threshold calibrated using risk control.
The paper says this simple design is competitive with more advanced monitors based on sequential hypothesis testing in experiments on mathematical reasoning and red-teaming datasets.
That is a useful result because production systems often favor monitors that are legible, calibratable, and easy to operate. A complex monitor may be stronger in theory but harder to debug when it blocks a user, misses a harmful output, or adds too much latency.
The deployment question is what happens after the alarm
An alarm is not a safety system by itself. It is a decision point.
If a monitor fires, the application still needs a policy: block the answer, ask a stronger verifier, retry with a safer model, route to human review, force retrieval, add constraints, or degrade the feature. Without that second step, the monitor only produces another score.
This is especially relevant for agents. A single unsafe or wrong output may become a tool call, file change, purchase, message, or API request. Online monitoring is most valuable before an output becomes an irreversible action.
Risk control is the part to watch
The paper’s practical value is not the idea that thresholds exist. Teams already use scores and thresholds across moderation, fraud, anomaly detection, and content filtering.
The important part is calibration. If a team can specify a risk target and calibrate the threshold against that target, the monitor becomes easier to reason about than a raw model score.
The caveat is domain transfer. Experiments on mathematical reasoning and red-teaming datasets do not prove the same threshold will work in medical advice, coding agents, finance workflows, education, or customer support.
