Goodfire Jailbreak Monitors Go Live on Kimi K3 and GLM 5.3

What happened

Interpretability company Goodfire has moved its jailbreak-detection research into production. It shipped probe-based cybersecurity monitors that run alongside live inference for two large open-weight models, Moonshot's Kimi K3 and Zhipu's GLM 5.3 5. The headline result comes from an external red team. FAR.AI found 66 universal jailbreaks against the unmonitored system, and none of them got through once the monitors were active, across 140 attack strategies 5.

The design is a cascade. Lightweight probes read the model's internal activations as it runs. Only when a probe crosses a threshold does the system pass the session to a more expensive LLM judge 5. Goodfire says this matches the recall of an always-on LLM judge at roughly 50 times lower cost and 50 times less added latency 5. The monitors are built on SGLang with custom kernels, and the reported throughput penalty is under 2% compared with default serving 5.

The numbers, and their limits

Goodfire tested the cascade on 2,400 chat and agentic sessions totaling more than 60,000 turns. The data came from four places [5]:

• Anthropic's Petri red-teaming library
• ExploitBench
• A cybersecurity slice of WildChat
• Benign software-engineering rollouts

On that set, the system caught 93% of harmful sessions and interrupted 5.5% of benign ones 5.

That false-alarm rate is the figure operators should look at first. Agentic coding sessions run for many turns. If one in twenty legitimate sessions gets interrupted, developers will notice, especially in security-adjacent engineering work where benign and malicious requests can look alike.

The red-team result also needs a careful reading. FAR.AI had two days. It started with 1,500 static jailbreak strategies and kept the 140 that worked against the unmonitored base model 5. Those attacks were non-adaptive: they were fixed in advance and never adjusted in response to the monitor 5. Going from 66 to zero is a real improvement against known techniques. It does not show resistance to an attacker who can probe the monitor and iterate. That harder test is the one that matters most for activation-based defenses.

Why the deployment target matters

The choice of Kimi K3 explains much of why this is news rather than another paper. K3 is a 2.8-trillion-parameter mixture-of-experts model that activates about 104 billion parameters per token 2. Running it at all is a cluster-scale job.

The sources disagree on how large that job is.

Checkpoint size

• One deployment guide measures the published checkpoint at 1,560.94GB across 96 shards. That is about 160GB more than a naive 4-bit estimate predicts, and enough that an 8-GPU B200 node cannot load it 1.
• Another guide cites roughly 594GB for a native MXFP4 safetensors release 3.
• A local-hosting comparison places the weights in the 1.5TB class before any runtime overhead 2.

Minimum hardware

• vLLM's guidance says the model needs at least one 8× B300 node 4.
• A separate guide claims 8× H100 80GB is the floor 3.
• SGLang's own H100 recipe calls for four 8-GPU H100 nodes, or 32 GPUs. Even then, each card is left with only a few gigabytes for KV cache and recurrent state 1.

The discrepancies probably reflect different weight formats and serving assumptions. Taken together, the sources agree that K3 is not something an individual can run on a workstation 23.

The serving stack is also new. K3 combines recurrent and attention layers, and supporting it required vLLM to add prefix caching over the recurrent (KDA) state 4. Moonshot contributed a KDA prefill-cache change alongside the weights 3.

This is the environment Goodfire's monitors have to work in. Memory is already scarce, kernels are custom, and every percentage point of throughput costs real money. GLM 5.3 is the lighter of the two models. Its Flash variant has about 320 billion total parameters and a roughly 306GiB FP8 checkpoint 2, but that still puts it in server territory.

Reading the result

The most significant claim here is not the zero-jailbreak figure. It is the claim that interpretability-based monitoring can run on frontier-scale open models for under 2% of throughput 5.

Safety tooling for open weights has usually forced a trade-off. Operators either run a costly LLM judge on every turn or accept little oversight. A cascade that consults the expensive judge only when internal activations look suspicious changes that cost calculation, provided the probes generalize.

There are reasons for caution. All the performance figures come from Goodfire's own evaluation plus a short, non-adaptive external test. The 5.5% benign-interruption rate may limit adoption in exactly the developer workloads these models target.

Still, the larger shift is that activation probes now run inside a production SGLang deployment of a 2.8T-parameter hybrid model. Interpretability is moving from analyzing models after the fact to taking part in serving them. The next useful milestone would be an adaptive red-team result.