Proposes VLA-Tug, a lightweight calibrated probe on VLA latent layers that gives runtime failure detection with bounded error rates, predicts failure modes, and enables steering under distribution shift.
Shows that emotion-vector probes in LLM activations shift before reward hacking and specification gaming, can predict hacks several sentences early, and steering them changes hacking rates.
Proposes Mechanistic Shaping, training models against internal representations to suppress unsafe concepts, and studies whether shaped concepts stay monitorable via probes, finding three circumvention mechanisms.
Trains efficient activation-based classifiers that read a model's internal activations to detect and interrupt policy-violating behaviour in real time during deployment.
Introduces PGuard, a streaming guardrail that probes an LLM's intermediate representations for token-level safety detection with low serving overhead, and reports strong results across 30+ safety benchmarks.
Argues chain-of-thought oversight needs separate evidence for faithfulness, localizability and monitorability; two case studies show evidence for one property does not establish the others, and proposes an evidential-chain reporting standard.
A linear probe on an agent's activations flags, before output is written, when a pressured agent is about to leak a secret. It catches 82% of leaks at 5% false alarms, beating a zero-shot monitor.
Tests activation probes for detecting rare misalignment with few positive examples, finding that many negatives help, upsampling helps somewhat, and larger models are more sample-efficient.
Introduces Structured Representation Probe, a lightweight linear monitor reading a frozen driving policy's internal representations to anticipate hard failures, outperforming runtime baselines on Bench2Drive.
Tests whether activation-based latent harm monitors beat simple baselines and refusal under distribution shift, finding the signal degrades and largely tracks the model's refusal decision.
Studies whether activation verbalizers can decode the opaque latent reasoning thoughts of a CODI model on Qwen3-8B, finding they surface intermediate values but editing them rarely steers the answer, which bears on monitorability.
Formalizes decision sufficiency for controllers that choose to assist, clarify, or refuse from internal representations, and audits sparse autoencoder features in small LLMs for safe generative control.
Proposes training language models to emit hidden marker tokens tied to training-data subsets as a covert self-reporting monitor, and reports a small TinyStories demo of the marker reflex.
Studies how much activation-based safety monitors depend on the original behaviour-generating computation, finding most performance transfers without it but native access gives a modest, consistent advantage.
VERITAS verbalises layer-wise model computation per CoT token and trains a classifier on it to detect unfaithful reasoning, outperforming LLM-as-Judge and activation probing.
LEMON is a graph neural network monitor over attention maps that uses symmetry-invariant design to detect hallucination and jailbreak misbehavior zero-shot across 16 LLMs, beating baselines by up to 14 ROC-AUC points.
Uses human interventions on LLM agent over-asking failures as labels to localize decision directions, steer with probe-gated interventions, and test weight-level fixes across models, finding mixed results.
Tests whether LLMs can control their own activations via in-context neurofeedback, finding limited control and only one model able to raise a deception monitor's score, relevant to activation-monitor evasion.
Shows that latent probes trained on mixed injection data mostly learn exposure, while retraining on exposed cases lets them predict an agent's unsafe tool calls up to two steps early.