Research preprints from the scientific community. arxiv.org
Proposes VLA-Tug, a lightweight calibrated probe on VLA latent layers that gives runtime failure detection with bounded error rates, predicts failure modes, and enables steering under distribution shift.
Proposes Mechanistic Shaping, training models against internal representations to suppress unsafe concepts, and studies whether shaped concepts stay monitorable via probes, finding three circumvention mechanisms.
Introduces PGuard, a streaming guardrail that probes an LLM's intermediate representations for token-level safety detection with low serving overhead, and reports strong results across 30+ safety benchmarks.
Argues chain-of-thought oversight needs separate evidence for faithfulness, localizability and monitorability; two case studies show evidence for one property does not establish the others, and proposes an evidential-chain reporting standard.
A linear probe on an agent's activations flags, before output is written, when a pressured agent is about to leak a secret. It catches 82% of leaks at 5% false alarms, beating a zero-shot monitor.
Tests activation probes for detecting rare misalignment with few positive examples, finding that many negatives help, upsampling helps somewhat, and larger models are more sample-efficient.
Introduces Structured Representation Probe, a lightweight linear monitor reading a frozen driving policy's internal representations to anticipate hard failures, outperforming runtime baselines on Bench2Drive.
Tests whether activation-based latent harm monitors beat simple baselines and refusal under distribution shift, finding the signal degrades and largely tracks the model's refusal decision.
Formalizes decision sufficiency for controllers that choose to assist, clarify, or refuse from internal representations, and audits sparse autoencoder features in small LLMs for safe generative control.
Studies how much activation-based safety monitors depend on the original behaviour-generating computation, finding most performance transfers without it but native access gives a modest, consistent advantage.
VERITAS verbalises layer-wise model computation per CoT token and trains a classifier on it to detect unfaithful reasoning, outperforming LLM-as-Judge and activation probing.
LEMON is a graph neural network monitor over attention maps that uses symmetry-invariant design to detect hallucination and jailbreak misbehavior zero-shot across 16 LLMs, beating baselines by up to 14 ROC-AUC points.
Uses human interventions on LLM agent over-asking failures as labels to localize decision directions, steer with probe-gated interventions, and test weight-level fixes across models, finding mixed results.
Tests whether LLMs can control their own activations via in-context neurofeedback, finding limited control and only one model able to raise a deception monitor's score, relevant to activation-monitor evasion.
Shows that latent probes trained on mixed injection data mostly learn exposure, while retraining on exposed cases lets them predict an agent's unsafe tool calls up to two steps early.
TRACE tracks harmful-response risk during LLM generation using a concept codebook and GRU, steers harmful activations toward benign ones, and reduces Harmbench attack success with little refusal change.
Trains white-box probes on a large deception dataset (FIBS) that outperform black-box monitors at detecting sabotage and unverbalized deception in agentic coding and hidden-goal settings.
Shows that activation probes with high AUROC fail as deployed alarm monitors for LM agents, proposing an operational validity contract and finding no setting reaches alarm-policy validity.
Measures how safety-relevant content in latent space becomes accessible at the output via Jacobian readouts, finds DPO can hide recognition, and shows adaptive attacks evade prompt-side monitors.
Fine-tuning LLMs for shorter reasoning chains lowers CoT faithfulness in most settings, mainly through inconsistency, while monitorability stays robust because models still acknowledge input interventions.
Uses a sparse autoencoder to find a VLA feature tied to adversarial patches, then suppresses it only when a linear probe detects an attack, improving robot policy robustness on LIBERO-10.
Using a synthetic math benchmark with programmatic trace checks, the paper finds correct answers often have invalid chain-of-thought traces, undermining CoT as evidence of reasoning for monitoring and interpretation.
Matched comparison of DPO against representation steering and probes for LLM safety control and monitoring, finding DPO strongest overall while probes and steering offer cost or low-data advantages and complementary benefits.
Proposes TACIT, a linear probe on frozen LLM internal states that detects harmful agent trajectories, including unsafe tool use, outperforming strong open guard models in macro-F1 and generalization.
Shows chain-of-thought is load-bearing mainly on hard tasks, where errors propagate before monitors can intervene, and that linear probes can read reasoning modes but steering controls them only weakly.
Finds that RL-induced chain-of-thought obfuscation in VLMs coincides with template features blending into visual content, and proposes TAME, an SAE-based activation regularizer that improves CoT monitorability.
Uses a shared sparse autoencoder to compare internal concepts behind LLM chain-of-thought and direct answers, and finds that causal faithfulness varies with depth and scale and is not fully verbalized in the CoT.
Proposes an unsupervised deployment-time LLM safety detector that flags out-of-distribution inputs using local sparsity in sparse autoencoder features, achieving near-optimal performance with few neurons.
Trains lightweight MLP probes on LLaMA-3.1-8B hidden activations to detect harmful prompts, matching much larger guard models on several benchmarks at lower latency and compute.
Difference-of-means probes on frontier open-source LLM internals detect reward hacking in coding evals, matching LLM monitors cheaply and predicting hacks from chain-of-thought before actions occur.
Shows that LLM judges and fine-tuned critics recover only part of the true importance of chain-of-thought steps, measured by Monte Carlo rollout advantage, so readable reasoning traces are not automatically interpretable.
Proposes ObserverBench, a benchmark testing whether internal estimators are adequate for safety interventions and monitoring by measuring action loss rather than accuracy alone, showing AUROC can misrank monitors.
Proposes a behavioral and mechanistic score for hidden chain-of-thought-like reasoning in Qwen3 models, finding stronger latent-reasoning signals in the reasoning-tuned variant, though not proof of latent reasoning.
Shows reasoning models disclose malign hidden system-prompt directives in chain-of-thought more often than benign ones, undermining CoT monitoring, and steering vectors can induce or suppress this hiding.
Proposes LMSM, a Linux-Security-Module-style framework that gates LLM output using calibrated interpretability signals, cutting HarmBench attack success from 39.2% to 3.3% on Qwen3-4B.
Trains MLP probes on frozen LLM activations to detect vulnerabilities in C/C++ code, matching a fine-tuned SOTA on Devign but trailing it on harder benchmarks.
Introduces AMS, an activation-space scanner that detects whether safety training in language models has been removed or modified, such as by abliteration, with a four-class taxonomy of modifications.}
Compares how well monitors can detect hint-reliance across explicit and latent chain-of-thought reasoning, finding monitorability depends more on task properties and model access than on reasoning mode.
Shows a tension between CoT faithfulness needed for monitoring and robustness to unsafe reasoning in reasoning models, introduces a replacement-based faithfulness test and HazMart dataset, and uses representation steering to boost safe behavior.
Shows that reasoning summaries reveal less about answer correctness than full reasoning traces, especially when the prompt is visible, so monitorability claims must specify both display and reader.