BlueGlass: Composite AI Safety Framework

• BlueGlass is an open-source composite AI safety framework that integrates evaluation of model outputs with internal analysis, unifying diverse safety and interpretability methods.
• It employs a layered architecture—foundations, feature tools, and safety tools—to orchestrate coordinated workflows including distributional evaluations, approximation probes, and sparse autoencoders.
• Demonstrated on vision-language object detection, BlueGlass reveals performance trade-offs, phase transitions in layer dynamics, and spurious correlations fundamental to composite AI safety.

BlueGlass is an open-source framework for composite AI safety, defined as a unifying infrastructure for combining multiple safety and interpretability methods rather than treating any one method as sufficient in isolation. It is designed to integrate tools that operate on both model outputs and model internals, and the framework is demonstrated on vision-LLMs for object detection through three analyses: distributional evaluation, probe-based analysis of layer dynamics, and sparse autoencoders for interpretable concept discovery (Nandigramwar et al., 14 Jul 2025). Its central claim is infrastructural rather than algorithmically singular: modern AI systems require coordinated workflows in which evaluators, probes, sparse feature models, and interventions share common abstractions for models, datasets, features, storage, and execution.

1. Conceptual basis and safety model

BlueGlass is motivated by the observation that existing safety tools usually target different and complementary slices of model behavior. Behavioral evaluations can surface failures across distributions, but they do not identify internal causes. Mechanistic tools can inspect or modify internal representations, but may not characterize deployment-time failures. Concept analyses can reveal spurious features, but do not quantify robustness across operational settings. BlueGlass treats these as reasons to build composite AI safety workflows in which tools are interoperable and mutually constraining rather than isolated (Nandigramwar et al., 14 Jul 2025).

Within this formulation, “composite AI safety” is not introduced through a single standalone mathematical definition. Instead, it is specified architecturally. The framework’s role is to let researchers move from disconnected one-off analyses to coordinated pipelines in which output-side evaluation, internal feature recording, probing, sparse decomposition, and activation intervention can be applied to the same models and datasets with shared interfaces.

A common misconception is to treat BlueGlass as a new benchmark, a single safety metric, or a specialized detector. The framework is none of these. It is infrastructure plus case studies. Its empirical demonstrations are centered on object detection with vision-LLMs, but the project’s stated significance is broader: providing a general substrate for composing safety tools across outputs and internals (Nandigramwar et al., 14 Jul 2025).

2. Layered architecture and internal feature infrastructure

BlueGlass is organized into three layers: foundations, feature tools, and safety tools (Nandigramwar et al., 14 Jul 2025).

At the foundations layer, the framework provides abstractions for model interfaces, dataset management, evaluators for performance and safety analysis, and runners for experiment orchestration. The stated purpose is to abstract over heterogeneous ecosystems such as HuggingFace, detectron2, MMDetection, and custom model code while presenting a unified interface to downstream tooling.

The feature tools layer is the core mechanism for internal analysis. Its central component is the Interceptor, a wrapper around a target model that defines “access points” where internal features can be captured or modified. The Interceptor supports manual mode, in which calls are inserted directly into model code, and hooked mode, in which standard architectures are instrumented automatically through a mapping from abstract access points to concrete layers. This layer also includes the Recorder, which captures feature artifacts; the Patcher, which modifies them for interventions such as activation patching or steering; and the Aligner, which standardizes heterogeneous tensors into a common schema so that downstream tools can be reused across architectures.

Persistence is handled by Storage, which saves aligned features to disk using Apache Arrow tables and Parquet. A FeatureDataset wrapper exposes these cached activations for downstream tasks such as probe training or sparse autoencoder training, and the system also supports streaming access through HuggingFace datasets. This design is practically significant because it decouples expensive instrumented inference from repeated downstream analysis: once features are aligned and cached, multiple tools can operate on them without rerunning the model (Nandigramwar et al., 14 Jul 2025).

The safety tools layer sits above these abstractions and hosts the concrete analyses. Because all tools consume the same model, data, and feature interfaces, BlueGlass presents composition as an engineering property of the framework rather than a loose methodological aspiration.

3. Output-side evaluation in vision-language object detection

BlueGlass is demonstrated on object detection with vision-LLMs, a domain chosen for its relevance to safety-critical applications such as robotics and autonomous driving (Nandigramwar et al., 14 Jul 2025). The evaluated systems include YOLOv8x as a zero-shot vision-only baseline; DINO-DETR (Swin-L) fine-tuned on each target dataset as an upper-bound supervised baseline; and several VLMs: Grounding DINO, GenerateU, Florence 2 Large, and Gemini 2.0 Flash. The authors also explored LLaVA-NeXT, GPT-4o-mini, and PaliGemma-2, but excluded them because their outputs were unparsable or incorrect for the evaluation pipeline.

The datasets were selected to induce multiple kinds of distribution shift: FunnyBirds, EuroCity Persons (ECPersons), VALERIE22, BDD100k, COCO, and LVIS. These support comparisons across synthetic versus real distributions, driving versus common-object domains, small versus large label sets, and closed-set versus open-vocabulary settings.

A technical difficulty in evaluating VLMs is that they emit open-ended text rather than labels from a fixed vocabulary. BlueGlass addresses this with a text-embedding similarity pipeline. Let $$f_{\text{encoder}}: \mathbb{T} \rightarrow \mathbb{R}^d$$, with class set $\mathcal{C}=\{c_1,\dots,c_N\}$ and model outputs $\mathcal{O}=\{o_1,\dots,o_M\}$. The mapping is:

$$\mathbf{e}_{c_i}=f_{\text{encoder}}(c_i), \qquad \mathbf{e}_{o_j}=f_{\text{encoder}}(o_j),$$

$$\text{sim}(o_j,c_i)=\mathbf{e}_{o_j}^\top \mathbf{e}_{c_i},$$

$$\hat{y}_j=\arg\max_{c_i\in\mathcal{C}} \text{sim}(o_j,c_i).$$

The evaluation pipeline also introduces negative classes such as “an object” or “a thing,” part prompts such as “parts of a car,” and controls over maximum predictions, confidence thresholds, objectness-score inclusion, and TopK selection. On GenerateU over COCO mini, the reported ablation indicates that adding box/objectness information raises AP substantially, negative classes improve precision, part prompts slightly help or maintain performance, CLIP text embeddings outperform BERT and also outperform B1ADE/NVEmbed in that setup, and overly aggressive confidence thresholds reduce performance (Nandigramwar et al., 14 Jul 2025).

The principal metrics are Average Precision (AP) and Average Recall (AR), using standard COCO evaluation when a dataset does not define otherwise.

Dataset	Best reported result	Salient interpretation
FunnyBirds	DINO (SFT) 99.6 AP / 99.9 AR	Supervised specialization dominates synthetic OOD benchmark
ECPersons	DINO 66.4 / 76.0	Driving-like pedestrian detection strongly favors supervised detector
COCO	DINO 58.3 / 78.6	Closed-set common-object detection still favors fine-tuned detector
LVIS	GenerateU 25.5 / 40.7	Open-vocabulary setting favors generative VLM with proposal network

These results support BlueGlass’s first safety-oriented finding: VLMs show meaningful zero-shot detection ability, but they also exhibit clear trade-offs and failure modes across distributions (Nandigramwar et al., 14 Jul 2025). Fine-tuned DINO-DETR outperforms all other systems except on LVIS, especially on ECPersons and VALERIE22, where it is reported as 2–3x more accurate. GenerateU performs best on LVIS because it combines a detection network with a LLM. Grounding DINO is characterized as efficient and strong on smaller or medium label sets but weaker on fully open-vocabulary detection. Florence 2 Large and Gemini 2.0 Flash, which lack explicit proposal or detection components, perform especially poorly in open-vocabulary localization, which the authors attribute to missing geometric priors.

This output-side analysis exemplifies BlueGlass’s intended use: identify behavioral failures and capability boundaries before moving to internal analysis.

4. Approximation probes and phase transitions in layer dynamics

BlueGlass’s second major demonstration is a probe-based analysis of layer dynamics using what the authors call approximation probes (Nandigramwar et al., 14 Jul 2025). The analysis focuses on Grounding DINO and compares it with DINO-DETR. For a feature extractor up to layer $\ell$,

$\phi_\ell: \mathcal{X} \rightarrow \mathbb{R}^d,$

the framework trains two linear probes per layer: a classification probe with cross-entropy and a localization probe with smooth L1. Unlike standard probes trained directly on ground truth, these probes are trained to approximate the raw predictions of the model itself. Probe success at a given layer therefore measures how linearly sufficient that layer’s representation is for reproducing the model’s current task behavior.

The reported empirical pattern is a phase transition across decoder layers. Probe performance is below final-layer performance in early layers, falls further in intermediate layers, reaches a critical transition layer $\ell^*$, and then rises sharply toward final task performance in later layers. The authors interpret this as a three-stage hierarchy:

1. Extraction phase
2. Reorganization phase
3. Refinement phase

This shared trajectory in both Grounding DINO and DINO-DETR is used to argue that zero-shot VLM detection is not mechanistically alien to supervised vision-only detection. Instead, both are described as relying on hierarchical feature learning, with VLMs acquiring open-world behavior by inserting language-aligned semantics into that hierarchy (Nandigramwar et al., 14 Jul 2025).

The paper frames this interpretation with an information-bottleneck perspective:

$L_{\text{IB}} = I(Z_\ell; Y) - \beta I(Z_\ell; X),$

where $\mathcal{C}=\{c_1,\dots,c_N\}$0 and $\mathcal{C}=\{c_1,\dots,c_N\}$1 are mutual informations and $\mathcal{C}=\{c_1,\dots,c_N\}$2 controls the trade-off. It also describes a hierarchical composition

$\mathcal{C}=\{c_1,\dots,c_N\}$3

contrasted with a purely linear transition

$\mathcal{C}=\{c_1,\dots,c_N\}$4

The appendix states Proposition 1 (Phase transition in mutual information), asserting the existence of a critical layer $\mathcal{C}=\{c_1,\dots,c_N\}$5 at which $\mathcal{C}=\{c_1,\dots,c_N\}$6 undergoes compression and $\mathcal{C}=\{c_1,\dots,c_N\}$7 follows a non-monotonic “reorganization dip.” It also states Proposition 2 (Phase transition in hierarchical models), which claims that linear transformations cannot resolve compositional ambiguities and that non-linearity is necessary to discard irrelevant activations and compose features. The accompanying theorem states that if all $\mathcal{C}=\{c_1,\dots,c_N\}$8 are linear, no compression or composition occurs. These claims function as theoretical framing rather than full theorem-proof development, but they define the interpretation BlueGlass assigns to the observed probe trajectories (Nandigramwar et al., 14 Jul 2025).

From a safety perspective, this suggests that internal monitoring or intervention may be most informative around critical transition layers rather than only at the output surface.

5. Sparse autoencoders and interpretable concept discovery

BlueGlass’s third case study is sparse autoencoder (SAE) analysis on Grounding DINO, aimed at decomposing dense internal activations into sparse latent units with more interpretable semantics (Nandigramwar et al., 14 Jul 2025). The framework supports multiple SAE variants—ReLU, TopK, Batch TopK, and Matryoshka—and also notes possible use for transcoding or crosscoding. The concrete experiment uses TopK SAE.

The SAE is trained on features from the residual stream of decoder layers, with particular discussion of concepts from decoder layer 4. With normalized input $\mathcal{C}=\{c_1,\dots,c_N\}$9, the encoder-decoder structure is:

$\mathcal{O}=\{o_1,\dots,o_M\}$0

with latent width

$\mathcal{O}=\{o_1,\dots,o_M\}$1

where $\mathcal{O}=\{o_1,\dots,o_M\}$2 is the expansion factor. Sparsity is enforced by

$\mathcal{O}=\{o_1,\dots,o_M\}$3

which retains only the $\mathcal{O}=\{o_1,\dots,o_M\}$4 largest activations, and reconstruction is given by

$\mathcal{O}=\{o_1,\dots,o_M\}$5

The total loss is described as a weighted sum of reconstruction loss and auxiliary loss, as in TopK SAE, but the exact weighted formula is not written explicitly in the paper (Nandigramwar et al., 14 Jul 2025).

Concept discovery is carried out by dataset attribution. For each sparse unit, the top-activating examples are collected from the COCO validation set, and the authors visualize the top 64 features per sparse unit. Because the task is object detection, these features correspond to object proposals or bounding boxes rather than whole images.

The reported concepts include semantic categories such as animals, parts of objects, and higher-level abstractions such as people playing on the ground. More importantly for safety analysis, the SAE reveals a concrete spurious correlation: a sparse unit strongly activated by hands often co-activates with predictions for objects commonly held in hands, such as knife or cell phone, even when the target object is absent or visually ambiguous. This is presented as evidence that the detector may rely on contextual co-occurrence cues rather than robust object evidence (Nandigramwar et al., 14 Jul 2025).

This case study illustrates the framework’s broader claim that composite safety requires the ability to connect distributional failures to internal mechanisms. In BlueGlass, SAEs are the component that most directly supports concept-level mechanistic hypotheses.

6. Scope, limitations, and disambiguation

BlueGlass is presented as foundational infrastructure and a set of representative case studies, not as a complete benchmark of composite AI safety (Nandigramwar et al., 14 Jul 2025). Several limitations are explicit. The framework does not provide a single formal mathematical definition of a composite safety workflow. The empirical analysis is concentrated on object detection, with deeper internal work focused primarily on Grounding DINO and DINO-DETR. SAE interpretation is manual and illustrative rather than quantitatively scored. Several popular VLMs had to be excluded because their outputs were not reliably parsable for the evaluation pipeline. The paper also notes that some equations are malformed, which matters for strict reproducibility of the typed mathematical presentation.

A second limitation is domain scope. BlueGlass demonstrates how to combine output evaluation, probes, and SAEs, but it does not itself resolve broader questions about cross-domain generalization, standardized intervention benchmarks, or automated mechanistic validation. A plausible implication is that its main contribution lies in reducing the engineering friction that otherwise prevents such multi-tool studies from being run systematically.

The name should also be distinguished from several unrelated research areas. BlueGlass is not the same as RGB glass surface segmentation systems such as GEM, which use SAM, a simple feature pyramid, Discerning Query Selection, and the synthetic S-GSD dataset for transparent glass masks (Hao et al., 2024, Hao et al., 2023). It is also distinct from literature-mining frameworks for inorganic glasses that combine LDA, a Caption Cluster Plot, and elemental maps for knowledge discovery in materials science (Venugopal et al., 2021); from plasmonic blue-light-selective scattering designs based on Ag and Au nanocubes on transparent substrates such as TiO$\mathcal{O}=\{o_1,\dots,o_M\}$6 and glass (Ye et al., 2019); and from early conceptual proposals for camera-mediated color-vision assistance on mobile devices or prospective Google Glass-style wearables (Oliveira et al., 2015).

In its precise scholarly usage, BlueGlass denotes the 2025 framework for composing safety analyses across model outputs and internals. Its significance lies in treating safety not as a single evaluator or a single interpretability method, but as a workflow in which distributional evaluation, approximation probes, sparse autoencoders, and potential feature interventions are made interoperable through shared abstractions and cached aligned features (Nandigramwar et al., 14 Jul 2025).