AMD Patent Would Stop AI Chatbots From Producing Harmful Outputs Before They Escape
AMD is patenting a system where one AI sits inside a chip and watches another AI's internal thought process in real time, ready to pull the alarm the moment something looks dangerous.
How AMD's AI-watching-AI safety system actually works
You're running a powerful AI assistant on your company's server, and somewhere inside that model, a manipulated prompt is steering it toward generating something harmful. By the time the output lands in front of a user, it's too late.
AMD's patent describes a way to catch that problem earlier, by having a second, smaller AI watch the first one's internal signals while it's still "thinking." Those internal signals, called activation values, are the intermediate calculations a neural network makes as it processes a request. The watchdog AI checks those signals against patterns it's been trained to recognize as dangerous, and if something trips its alarm, it triggers an exception, essentially stopping the first AI in its tracks before a harmful response is ever produced.
The key detail is that all of this happens on the chip itself, not after the fact in software. AMD designs the chip hardware (specifically the accelerators and shared memory) to make this real-time interception possible.
… intercepting, at the one or more trained machine learning models, a subset of activation values of one or more intermediary layers of the genAI inference model from a memory shared by the one or more parallel processors and the one or more accelerators …
Translation: The system monitors the internal data of an AI model while it is running to see what it is thinking.
How the interceptor reads activation values mid-inference
The system involves two AI models running simultaneously on the same processing hardware. The first is a generative AI inference model (think a large language model or image generator) running on parallel processors. The second is a smaller trained machine learning classifier running on dedicated accelerators, separate processing units optimized for specific tasks.
The trick is shared memory. Because both models have access to the same memory pool, the watchdog model can intercept activation values from the generative model's intermediary layers. Activation values are the numerical outputs of each internal layer of a neural network as it processes data, essentially the model's working notes as it builds a response. By reading those notes mid-process, the classifier can evaluate whether the generative model is heading somewhere dangerous.
The classifier has been pre-trained to recognize patterns in activation values that correspond to malicious behavior, such as outputs driven by adversarial prompt injections or jailbreak attempts. If the intercepted values meet one or more flagged criteria, the classifier fires off an exception, a low-level hardware interrupt that halts or redirects the inference process before a harmful output is ever assembled.
- Generative AI runs on parallel processors (GPUs or similar)
- Watchdog AI runs on dedicated accelerators in the same chip
- Both share a memory space so the watchdog can read internal signals
- A flagged result triggers an exception that stops the bad output
A trained machine learning model intercepts a subset of activation values of a generative artificial intelligence inference model executing at a processing system and classifies the subset of activation values as malicious based on the subset of activation values meeting one or more criteria.
Translation: A secondary AI watches the main AI to identify and flag dangerous or harmful patterns in its internal data.
What this means for AI safety inside chips
Most current AI safety measures work at the input or output layer, either screening what users type in or filtering what the model produces. AMD's approach targets the layer in between, the model's own internal processing, which is harder to game because it doesn't depend on recognizing specific words or phrases. A cleverly worded jailbreak prompt might fool a text filter, but the underlying pattern of activations it produces inside the model may still look anomalous to a well-trained classifier.
The tradeoff is real and worth naming: running a second AI model on every inference adds computational overhead, and false positives (the watchdog flagging legitimate outputs as malicious) could make the system frustrating or unreliable in production. Whether that cost is worth it depends entirely on how accurate the classifier can be at scale, which the patent doesn't fully answer. AMD's chip-level approach to AI safety is one of the more concrete examples among new Big Tech patents targeting AI security at the hardware layer rather than the application layer.
The design bet here is that activation-level monitoring is more reliable than text-level filtering, and that AMD's hardware architecture (shared memory between processors and accelerators) can absorb the latency penalty without making real-time inference unusable. That's a reasonable wager for high-security deployments like enterprise servers or government infrastructure, but it gets shakier for consumer applications where the classifier's false-positive rate could create constant interruptions. The deeper cost is maintenance: that watchdog classifier needs to be retrained continuously as new attack patterns emerge, or it ages out of usefulness. AMD is betting the hardware scaffold is stable enough to outlast the threat models it was trained on.
There are more where this came from
We read every patent application Big Tech publishes and send you the ones worth knowing. Plain English, free, every week.
The drawings
4 drawing sheets from US 2026/0236580 A1 · click any drawing to enlarge
Want this weekly breakdown for a company we don't cover? Patentlyze Pro →