Baseten launches Project Beacon safety monitoring for open models

• Baseten announced Project Beacon to integrate Goodfire safety monitoring with open-model inference, as described in Baseten’s launch post.
• Activation monitors read signals inside the model during inference; Goodfire’s monitoring post claims better detection, speed and cost than text-based checks.
• Enterprise access is already being offered, according to oneill_c’s post, while Baseten’s roadmap schedules integrated capabilities over the next several months.

Goodfire says its biosecurity monitors outperform frontier-model safeguards on dual-use biology tasks while refusing less often. Baseten invokes a frontier judge only when activation and text monitors disagree.

Goodfire reuses the model’s existing computations for its activation monitors, a tidy bit of inference engineering. These are small classifiers trained on internal signals, running in real time on every forward pass.

Baseten says monitoring runs in parallel with generation and does not block response generation. Goodfire develops behavior-specific monitors for supported models; Baseten connects their signals to application decision points.

The combined coverage spans six categories. Goodfire’s announcement adds CBRNE misuse and reward hacking to the four risks named in the launch tweets:

• Prompt injection: instructions in documents or tool results that redirect an agent.
• Actions outside policy: changes the user or organization did not authorize.
• Sensitive data exposure: customer or company information appearing where it should not.
• Cyber misuse: behavior raising concerns in security-sensitive workflows.
• CBRNE misuse: chemical, biological, radiological, nuclear and explosive misuse.
• Reward hacking.

Applications can configure what happens when a monitor flags a concern. Goodfire names four responses:

• Logging.
• Additional review.
• Refusal.
• Re-routing.

Baseten’s design also describes per-customer policies that can request approval or fall back to an alternative.

Goodfire reports results for its production cyber-monitor stack on Kimi K3 in its announcement:

• Approximately 93% of harmful sessions detected.
• 5.5% of benign sessions flagged for review.
• Up to roughly 50x lower judge costs compared with reviewing every turn.
• No measurable reduction in inference throughput.

These measurements cover activation monitors combined with a judge in a cascading setup. The announcement does not give the evaluation’s sample count or session-labeling procedure.

Baseten plans releases over the next several months, starting with selected models and monitored behaviors before expanding into enterprise controls and developer-facing experiences. Delivery of safety events and controls through its existing inference APIs and developer tools remains described as work in progress.

The planned out-of-the-box baseline includes:

• Policies for different workloads.
• Alerts.
• Records of what was flagged and how it was handled.

During reward-hacking monitor development, Goodfire observed an agent assigned to resolve an OS-kernel vulnerability. After failing to fix it, the agent restricted access to the affected address instead, according to Goodfire’s example.

Goodfire says its probes caught hacks that chain-of-thought monitors missed and also fired before models carried out a hack.