RUBEN: Rule-Based Explanations for Retrieval-Augmented LLM Systems

Joel Rorseth; Parke Godfrey; Lukasz Golab; Divesh Srivastava; Jarek Szlichta

cs.CLMay 11, 2026

RUBEN: Rule-Based Explanations for Retrieval-Augmented LLM Systems

Authors: Joel Rorseth, Parke Godfrey, Lukasz Golab, Divesh Srivastava, Jarek Szlichta

Organizations: University of Waterloo · York University · AT&T Chief Data Office

Abstract

This paper demonstrates RUBEN, an interactive tool for discovering minimal rules to explain the outputs of retrieval-augmented large language models (LLMs) in data-driven applications. We leverage novel pruning strategies to efficiently identify a minimal set of rules that subsume all others. We further demonstrate novel applications of these rules for LLM safety, specifically to test the resiliency of safety training and effectiveness of adversarial prompt injections.

Explore similar work

Safety Beyond the Interface: Detecting Harm via Latent States in Large Language Models
Sep 16, 2026Alizishaan Khatri, Chiquita Prabhu, Omkar NeogiLarge Language Model Safety Harms
SafeLLM: Extraction as a Hallucination-Resistant Alternative to Rewriting in Safety-Critical Settings
Jun 11, 2026Julia Ive, Felix Jozsa, Evridiki Georgaki +6Large Language Model Safety Large Language Model Hallucination
RAG-Safety-Bench: Reliable Evaluation of Retrieval-Augmented LLM Safety
Sep 11, 2026Adithiyan Rajan Indira Saravanan, Kathleen C. FraserLarge Language Model Safety Retrieval-Augmented Generation Systems

Sep 16, 2026 · cs.AIJ/K move · Enter open · S save

Safety Beyond the Interface: Detecting Harm via Latent States in Large Language Models

Alizishaan Khatri, Chiquita Prabhu, Omkar Neogi

Wrynx Inc. · Independent Researcher

Autonomous systems increasingly rely on Large Language Models (LLMs) yet the safety infrastructure surrounding these models introduces latency and compute overhead. This limits utility in resource-constrained, time-critical deployments. Existing external guardrail models remain blind to the model's internal workings, creating a fundamental assurance gap. We ask: does the model already know when the content is harmful? We extract activations from LLaMA-3.1-8B and train lightweight MLP classifier probes (12.6M parameters) to detect harmful prompts. Evaluated on WildJailbreak, Beavertails, and AEGIS 2.0, our probes achieve F1 scores of 99%, 83%, and 84%, respectively competitive with 1000x larger guard models while cutting latency and compute costs.

Large Language Model Safety Harms Guardrail Safety Latent States Multilayer Perceptrons

Open paper Ask about it PDF

Abstract

Explore similar work

Safety Beyond the Interface: Detecting Harm via Latent States in Large Language Models

SafeLLM: Extraction as a Hallucination-Resistant Alternative to Rewriting in Safety-Critical Settings

RAG-Safety-Bench: Reliable Evaluation of Retrieval-Augmented LLM Safety