用激活空间探针检测有害请求，发现其更适合作为风险预警而非上下文判断工具。
The Entanglement Wall: Activation-Space Probes as Risk Detectors, Not Context Adjudicators
- 通过残差流探针分析模型激活空间，识别潜在有害请求
- 在测试集中阻断95.5%-97.7%的合规攻击，68.4%的XSTest提示
- 适合用于安全审计与风险监控，不适用于精细上下文判别
上下文变化可能使同一表述从无害变为有害，但表层形式不变。我们检验残差流探针是否能在有效操作点区分有害请求与表面匹配的良性对照。在三个7-8B模型家族中，激活传感器在分类选集上阻断了95.5%-97.7%的法官标注合规攻击，同时阻断59.6%-68.4%的XSTest提示。完全独立的审计重建接近理论上限的源对比AUROC（0.996-0.999），但固定迁移至匹配对时表现较弱：在守护选择的Twin-n70子集上为0.656-0.819，在完整Twin-n163队列上为0.590-0.690。在参考族测试十轴，跨所有族测试七轴，经泄漏、留出与置换控制后，未使用直接配对边界拟合的任一轴在Twin-n163上均未达到指定数值阈值。该要求在分析阶段才加入。24B/32B扩展版本结果一致。成对训练分类器在类别和生成批次留出下性能下降，且在95%语料内真阳性率下误阻断79.6%-100%的XSTest提示。在测试读取点，这些激活分数表现为广义风险探测器，而非独立上下文判别器。
原文摘要 · Abstract (English)
Context can change whether a request is harmful without changing its topic or surface form. We ask whether residual-stream probes distinguish harmful requests from surface-matched benign controls at a useful operating point. Across three 7-8B model families, an activation sensor blocks 95.5-97.7 percent of judge-classified compliant attacks in a taxonomy-selected set. It also blocks 59.6-68.4 percent of XSTest prompts. A fully disjoint audit reconstructs near-ceiling source-contrast AUROC (0.996-0.999), but fixed transfer to matched pairs is weaker: 0.656-0.819 on the guard-selected Twin-n70 subset and 0.590-0.690 on the full Twin-n163 cohort. We test ten axes on the reference family and seven across all families with leakage, hold-out, and permutation controls. On Twin-n163, no axis evaluated without direct pair-boundary fitting reaches the specified numerical threshold. Requiring persistence on that full cohort was added at analysis time. A separately specified 24B/32B extension gives the same result. Pair-trained classifiers weaken under category and generation-batch hold-out and false-block 79.6-100 percent of XSTest at 95 percent in-corpus TPR. At the tested read points, these activation scores behave as broad-risk detectors rather than standalone context adjudicators.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。