通过内部隐藏空间干预，实现多轮编程代理的安全实时控制。
AgentLens: Interpretable Safety Steering via Mechanistic Subspaces for Multi-Turn Coding Agent
- 从隐藏层特征中识别有害执行状态，动态干预10维子空间。
- 在194个任务上显著减少有害行为，检测准确率超90%。
- 适合关注大模型代理安全与可解释性的研究人员和开发者。
基于大语言模型的编程代理展现出强大的自主能力，但在与外部环境的多轮交互中也带来显著的安全与滥用风险。现有安全机制主要依赖外部防护墙，难以在执行过程中进行细粒度行为控制。而近期机制可解释性方法多局限于单轮或越狱式问答场景，无法捕捉多轮代理执行中的动态风险演化。本文从内部视角研究多轮编程代理的安全性，提出AgentLens（机制子空间干预与引导）白盒防御框架，可在运行时检测并以表示层面缓解安全风险。不同于传统防护机制，AgentLens通过单层10维子空间干预，从步骤级隐藏表示中识别有害状态并加以修正。为支持研究，我们构建了机制代理安全（MAS）基准，涵盖使用LLaMA-3.1-8B、Qwen-2.5-7B和Gemma-2-9B在194个任务上的全面标注多轮执行轨迹。大量实验表明，AgentLens具备强安全检测能力，初步验证了前瞻风险预测的可能性，并显著降低编码代理的有害动作，为机制可解释性在动态大模型代理安全中的应用奠定基础。代码已开源。
原文摘要 · Abstract (English)
Coding agents based on large language models (LLMs) demonstrate remarkable autonomous capabilities, but they also introduce significant safety and misuse risks during multi-turn interactions with external environments. Existing safety mechanisms mainly rely on external guardrails, which have a limited ability to perform fine-grained behavioral control during execution. Meanwhile, recent mechanistic interpretability methods for LLM safety are mostly confined to single-turn or jailbreak-style QA settings, limiting their ability to capture the evolving risk dynamics of multi-turn agent execution. In this paper, we investigate the safety of multi-turn coding agents from an internal perspective. We propose AgentLens (Mechanistic Subspace Intervention and Steering), a white-box defense framework that performs runtime safety detection and representation-level mitigation for coding agents. Unlike conventional agent guardrails, AgentLens detect harmful execution states from step-level hidden representations and mitigate unsafe behavior by intervening in a 10-dimensional subspace within a single layer. To support this research, we introduce the Mechanistic Agent Safety (MAS) benchmark, comprising comprehensively annotated multi-turn execution trajectories across 194 tasks using LLaMA-3.1-8B, Qwen-2.5-7B, and Gemma-2-9B. Extensive experiments show that AgentLens achieves strong safety detection performance, provides preliminary evidence for lookahead risk anticipation, and substantially reduces harmful actions of the coding agent, establishing a foundation for applying mechanistic interpretability to dynamic LLM agent safety. The code is available at: https://github.com/EddyLuo1232/AgentLens
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。