从大模型激活值中还原实时指令集，提升智能体行为可监控性。
PRISM: Recovering Instruction Sets from Language Model Activations
- 基于冻结模型激活值，直接解码出当前活跃的全部指令。
- 在多种攻击场景下，对安全相关指令的召回率超基线27%以上。
- 适合需要透明化智能体决策过程的安全研究与系统审计。
随着大语言模型作为智能体部署，可靠监控不仅需关注输出结果，还需明确驱动其行为的指令集。当模型推断出非预期子目标、受上下文线索影响或遭受提示注入时，这一任务尤为困难。尽管激活值到语言的方法表明隐藏状态可包含自然语言信息，但现有方法无法恢复代理场景中同时生效的完整指令集（包括指令、约束、禁止项和子目标）。本文将此问题形式化为指令集检索，并提出PRISM：一种激活条件解释器，能将冻结目标模型的隐藏状态解码为准确的指令列表。与以往方法不同，PRISM通过裁判引导的GRPO训练，奖励覆盖的指令并惩罚未支持的内容。在正常、受限、提示注入及隐藏目标等多种设置下，PRISM显著优于激活转语言基线，尤其在安全相关目标上表现突出。
原文摘要 · Abstract (English)
As LLMs are deployed as agents, reliable monitoring requires knowing not only what they output, but which instructions are steering their behavior. This is difficult when models infer unintended subgoals, follow contextual cues, or are influenced by prompt injections and hidden objectives. While activation-to-language methods suggest that hidden states can reveal natural-language information, existing approaches are not designed to recover the full set of simultaneous instructions, constraints, prohibitions, and subgoals active in agentic settings. We formalize this problem as instruction set retrieval and introduce PRISM, an activation-conditioned interpreter that decodes hidden states from a frozen target model into a faithful bullet list of active instructions. Unlike prior activation-to-language methods, PRISM is trained to recover instruction sets directly, using judge-guided GRPO to reward covered instructions and penalize unsupported ones. Across benign, constrained, prompt-injection, and hidden-objective settings, PRISM outperforms activation-to-language baselines, especially on security-relevant objectives.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。