Obfuscated Adversarial Training produces activations that evade detectors yet still cause harmful outputs

Activation-based safety detectors can be bypassed by adversarially optimized internal states, so monitoring activations alone is insufficient. Obfuscated Adversarial Training aims to train the model itself, but the result is that harmful behavior persists despite appearing benign. Engineers building safety mechanisms should consider that obfuscated activations undermine detection-based approaches.