测试三种模型内部探测方法，发现无法可靠预判有害行为。
Internal-State Probes Read the Situation, Not the Action: Three Negative Results for Pre-Action Misalignment Monitoring
- 设计可验证的预动作检测测试框架，区分真实预判与仅描述输入。
- 三种方法在143个预响应场景中全未正确识别危险轨迹，准确率0%。
- 即使语义有意义，探测信号也易受无关概念干扰，不适合安全监控。
模型内部探测器若能提前识别有害文本或工具行为，或可用于监控智能体系统。我们探究内部读出是否支持更强的预动作判断，而非仅描述提示、构造差异或当前轨迹。在三个模型族中测试三种方法：基于Qwen2.5-Coder-32B-Instruct的微调/基线方向、Llama-3.1-8B-Instruct在不安全前缀末尾标记处的探测，以及Gemma-3-27B-IT在勒索工具行为场景中用于投影与引导的情绪概念向量。在这些案例中，构造有效性、语义可读性及引导效应均未成为稳健的预动作监测手段：每种都被泛化性或特异性检验所削弱。Qwen方向在AUC 1.000下区分微调与基线，但在143个预助手回合上下文中无一成功触发阈值，在342个预填充行中仍继续危险轨迹；Llama在解码提示域上表现近乎完美（AUC 0.999），最佳未来行为探测器仅达AUC 0.801，比多数类高出5.1个百分点，且六对有序跨源迁移中有五对为负值。Gemma情绪投影语义合理，但共享前缀最小对在首个差异输入前状态不可区分，引导特异性在面对猫、天气、体育和地理等无关学习方向时显著下降。我们提出将内部读出主张转化为预动作测试的方法，并报告有限范围内的负面结果：监控主张必须通过情景/动作泛化与概念特异性双重检验。代码已公开于https://github.com/maxf-zn/misalignment_monitoring。
原文摘要 · Abstract (English)
Probes on model internals could help monitor agentic systems if they identify harmful text or tool actions before those actions are generated. We ask when an internal readout supports this stronger pre-action claim, rather than merely describing the prompt, construction contrast, or current trajectory. We test three methods across three model families: a Qwen2.5-Coder-32B-Instruct fine-tune/base direction, Llama-3.1-8B-Instruct probes at the last token of unsafe prefills, and Gemma-3-27B-IT emotion-concept vectors used for projection and steering in a blackmail tool-action scenario. Across these cases, construction validity, semantic legibility, and steering effects do not become robust pre-action monitors: each is undercut by a generalization or specificity check. The Qwen direction separates fine-tune from base at AUC 1.000, yet crosses its threshold on 0/143 audited pre-assistant turn contexts and on 0/342 Qwen prefill rows where the model continues the unsafe trajectory. The Llama features decode prompt domain almost perfectly (AUC 0.999), while the best future-behavior probe reaches AUC 0.801 and only +5.1 pp accuracy lift over majority; single-source cross-domain transfer is non-positive on five of six ordered pairs. Gemma emotion projections are semantically meaningful, but a shared-prefix minimal pair has indistinguishable states before the first differing input, and steering specificity weakens against unrelated learned directions such as cats}, weather, sports, and geography. We contribute a methodology for converting internal-readout claims into pre-action tests, and report scoped negative results: monitor claims must survive both scenario/action generalization and concept-specificity controls. Code is released at https://github.com/maxf-zn/misalignment_monitoring
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。