Proposes VLA-Tug, a lightweight calibrated probe on VLA latent layers that gives runtime failure detection with bounded error rates, predicts failure modes, and enables steering under distribution shift.
Shows that emotion-vector probes in LLM activations shift before reward hacking and specification gaming, can predict hacks several sentences early, and steering them changes hacking rates.
Proposes Mechanistic Shaping, training models against internal representations to suppress unsafe concepts, and studies whether shaped concepts stay monitorable via probes, finding three circumvention mechanisms.
Trains efficient activation-based classifiers that read a model's internal activations to detect and interrupt policy-violating behaviour in real time during deployment.
Introduces PGuard, a streaming guardrail that probes an LLM's intermediate representations for token-level safety detection with low serving overhead, and reports strong results across 30+ safety benchmarks.
Argues chain-of-thought oversight needs separate evidence for faithfulness, localizability and monitorability; two case studies show evidence for one property does not establish the others, and proposes an evidential-chain reporting standard.
A linear probe on an agent's activations flags, before output is written, when a pressured agent is about to leak a secret. It catches 82% of leaks at 5% false alarms, beating a zero-shot monitor.
Tests activation probes for detecting rare misalignment with few positive examples, finding that many negatives help, upsampling helps somewhat, and larger models are more sample-efficient.
Introduces Structured Representation Probe, a lightweight linear monitor reading a frozen driving policy's internal representations to anticipate hard failures, outperforming runtime baselines on Bench2Drive.
Tests whether activation-based latent harm monitors beat simple baselines and refusal under distribution shift, finding the signal degrades and largely tracks the model's refusal decision.
Studies whether activation verbalizers can decode the opaque latent reasoning thoughts of a CODI model on Qwen3-8B, finding they surface intermediate values but editing them rarely steers the answer, which bears on monitorability.
Formalizes decision sufficiency for controllers that choose to assist, clarify, or refuse from internal representations, and audits sparse autoencoder features in small LLMs for safe generative control.
Proposes training language models to emit hidden marker tokens tied to training-data subsets as a covert self-reporting monitor, and reports a small TinyStories demo of the marker reflex.
Studies how much activation-based safety monitors depend on the original behaviour-generating computation, finding most performance transfers without it but native access gives a modest, consistent advantage.
VERITAS verbalises layer-wise model computation per CoT token and trains a classifier on it to detect unfaithful reasoning, outperforming LLM-as-Judge and activation probing.
LEMON is a graph neural network monitor over attention maps that uses symmetry-invariant design to detect hallucination and jailbreak misbehavior zero-shot across 16 LLMs, beating baselines by up to 14 ROC-AUC points.
Uses human interventions on LLM agent over-asking failures as labels to localize decision directions, steer with probe-gated interventions, and test weight-level fixes across models, finding mixed results.
Tests whether LLMs can control their own activations via in-context neurofeedback, finding limited control and only one model able to raise a deception monitor's score, relevant to activation-monitor evasion.
Shows that latent probes trained on mixed injection data mostly learn exposure, while retraining on exposed cases lets them predict an agent's unsafe tool calls up to two steps early.
TRACE tracks harmful-response risk during LLM generation using a concept codebook and GRU, steers harmful activations toward benign ones, and reduces Harmbench attack success with little refusal change.
Goodfire and Baseten announce Project Beacon, deploying white-box activation monitors to detect unsafe agentic behaviour in open models in real time, cutting judge costs about 50x.
Trains white-box probes on a large deception dataset (FIBS) that outperform black-box monitors at detecting sabotage and unverbalized deception in agentic coding and hidden-goal settings.
Builds probe-based cybersecurity monitors for Kimi K3 and GLM 5.3 that flag suspicious agent exchanges for an LLM judge, matching its recall at about 50x lower cost.
Uses Lanham-style interventions on ethical reasoning to show larger models depend less on their chain-of-thought, and that constrained CoT formats may raise necessity, with implications for CoT monitoring.
Shows that activation probes with high AUROC fail as deployed alarm monitors for LM agents, proposing an operational validity contract and finding no setting reaches alarm-policy validity.
Measures how safety-relevant content in latent space becomes accessible at the output via Jacobian readouts, finds DPO can hide recognition, and shows adaptive attacks evade prompt-side monitors.
Fine-tuning LLMs for shorter reasoning chains lowers CoT faithfulness in most settings, mainly through inconsistency, while monitorability stays robust because models still acknowledge input interventions.
Uses a sparse autoencoder to find a VLA feature tied to adversarial patches, then suppresses it only when a linear probe detects an attack, improving robot policy robustness on LIBERO-10.
Proposes model hermeneutics: probing an open-weight reader model's internals to monitor closed-weight models for reward hacking, sycophancy and deception, with distillation improving reader faithfulness.
Using a synthetic math benchmark with programmatic trace checks, the paper finds correct answers often have invalid chain-of-thought traces, undermining CoT as evidence of reasoning for monitoring and interpretation.
Matched comparison of DPO against representation steering and probes for LLM safety control and monitoring, finding DPO strongest overall while probes and steering offer cost or low-data advantages and complementary benefits.
Proposes TACIT, a linear probe on frozen LLM internal states that detects harmful agent trajectories, including unsafe tool use, outperforming strong open guard models in macro-F1 and generalization.
Argues that latent reasoning architectures like COCONUT and full-bandwidth transformers would undermine chain-of-thought monitorability, weakening a key oversight tool against misalignment and scheming.
Shows chain-of-thought is load-bearing mainly on hard tasks, where errors propagate before monitors can intervene, and that linear probes can read reasoning modes but steering controls them only weakly.
Finds that RL-induced chain-of-thought obfuscation in VLMs coincides with template features blending into visual content, and proposes TAME, an SAE-based activation regularizer that improves CoT monitorability.
Speculates that labs may automate architecture research toward no-CoT latent reasoning, which could reduce chain-of-thought monitorability and make interpretability harder.
Uses a shared sparse autoencoder to compare internal concepts behind LLM chain-of-thought and direct answers, and finds that causal faithfulness varies with depth and scale and is not fully verbalized in the CoT.
Proposes an unsupervised deployment-time LLM safety detector that flags out-of-distribution inputs using local sparsity in sparse autoencoder features, achieving near-optimal performance with few neurons.
Training a 4B model with a persistent lesion on its J-lens monitoring directions restores task accuracy from 20.9% to 97.7%, showing models can adapt around the internal signals used to monitor them.
Trains lightweight MLP probes on LLaMA-3.1-8B hidden activations to detect harmful prompts, matching much larger guard models on several benchmarks at lower latency and compute.