Pith. sign in

REVIEW 3 major objections 5 minor 33 references

The paper claims that physical danger from embodied actions is a distinct signal from text-level content danger inside LLM hidden states, and that a simple linear probe can detect both.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 23:49 UTC pith:KF3OOCXD

load-bearing objection A genuinely interesting claim about separable hidden-state directions for physical vs. content danger, backed by one well-built control, but the self-built benchmark that produces the cleanest number is unreleased and the taxonomy is leaky — worth a serious referee, not a quick accept. the 3 major comments →

arxiv 2607.15218 v1 pith:KF3OOCXD submitted 2026-07-16 cs.AI cs.CR

When Words Are Safe But Actions Kill: Probing Physical Danger Beyond Text Safety in Hidden-State Risk Space

Weimeng Wang , Ziqiang Wang , Zihang Zhan , Chuanpu Fu , Qi Li , Ke Xu This is my paper
classification cs.AI cs.CR
keywords hidden-state probingphysical safetycontent dangerembodied agentslogistic probeSafeAgentBenchPSB-1Ksafety monitoring
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper argues that LLMs used as household or embodied planners face a safety problem that text moderation cannot see: an instruction like 'microwave an egg' uses safe words but is physically dangerous. The authors claim that in the model's internal hidden states this physical danger forms a direction distinct from ordinary text-content danger, and that a single-layer linear probe trained on hidden states can flag both kinds of risk. They report that the two danger directions are separated by 71–77 degrees across six tested backbones, well beyond what random splits produce on the one model where a formal null was run, and that the probe keeps false positives low where LLM judges over-reject safe tasks. The paper also introduces a new 1,000-pair benchmark with explicit harm words stripped, on which the probe reaches 99.6% accuracy. If correct, the result means physical danger can be monitored cheaply at the representation level, without a large judge and without blocking harmless tasks.

Core claim

The central claim is that content danger (CD) and physical danger (PD) are not the same safety concept inside an LLM, and that the distinction is visible in the geometry of hidden states. For an instruction like 'ignite the curtain' versus 'microwave an egg', the model's internal representation at middle-to-late layers contains two analyzable directions—the content-danger direction (CDD) and the physical-danger direction (PDD)—with probe-weight angles of roughly 72–77 degrees across Qwen2.5-3B/7B/14B/32B, Phi-3.5-mini, and SmolLM2-1.7B; on Qwen2.5-3B the observed 76.33° angle exceeds a random-split null of 60.35° ± 1.58° (z = 10.09, p < 0.0001). The paper operationalizes this separability as

What carries the argument

The central objects are CDD and PDD, class-mean difference directions in hidden-state space: CDD = µ_CD − µ_safe and PDD = µ_PD − µ_safe, estimated from the last-token hidden state at a selected layer. The paper measures two angles between these directions—a mean-difference angle and a probe-weight angle from two L2-regularized logistic probes—and compares the probe-weight angle against a random-split null distribution generated by the identical fitting pipeline, to rule out high-dimensional fitting artifacts. PRISM itself is a one-layer logistic regression over a standardized full hidden state, with the layer chosen by internal cross-validation; it is the concrete mechanism that turns the s

Load-bearing premise

The whole argument rests on the benchmark labels: if the split into content-danger and physical-danger reflects keyword or topic clustering rather than physical causality, the measured hidden-state separation and the probe's performance are partly artifacts of label structure.

What would settle it

Run the identical CDD/PDD pipeline on a new benchmark where safe/unsafe and content/physical labels come from independent human annotators judging physical causality, with no keyword overlap with SafeAgentBench or PSB-1K; if the probe-weight angle no longer exceeds the random-split null (around 60°) or PRISM's physical-danger recall falls far below 99%, the central separability claim is refuted.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • If CD and PD are separable in hidden states, a frozen LLM's representations can serve as a physical-safety monitor without decoding a judgment from the model.
  • PRISM's low false-positive rate (11.7–13.7%, versus 24.7–39.0% for LLM judges) means an embodied agent can reject dangerous plans without rejecting most safe household tasks.
  • Content-oriented guardrails will systematically miss physical risks: the paper's runs show a text guardrail detecting 0% of physical-danger examples.
  • The accuracy stays within 86.2–87.7% from 3B to 32B parameters and across three architectures, suggesting the signal is a general property of LLM representations, not a quirk of one model family.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • A testable extension: if the CD/PD separation is genuine, probing hidden states should also separate other grounded risk families—short-circuits, choking hazards, chemical mixtures—by retraining only the linear probe, not the LLM.
  • The cleanest result (99.6% on PSB-1K) would gain substantially from independent human annotation and public release, since the benchmark was self-built without an annotation audit; this is an editorial caution, not a paper claim.
  • If probes like PRISM detect physical danger without harm words, they could serve as an early-warning layer on generated plans before execution, acting as a second-stage verifier rather than a one-shot classifier.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper investigates whether physical danger (PD) in embodied-agent instructions is a distinct safety problem from text-level content danger (CD). Using hidden-state analysis on Qwen2.5-3B/7B/14B/32B, Phi-3.5-mini, and SmolLM2-1.7B, the authors define class-mean directions CDD and PDD and report probe-weight angles of 71.6–77.3°, with a random-split null on Qwen2.5-3B (76.33° vs. 60.35°±1.58°, z=10.09). They then propose PRISM, a single-layer L2-regularized logistic probe over a selected full hidden state, reporting 86.2–87.7% accuracy and 11.7–13.7% FPR on SafeAgentBench, 99.6% accuracy / 0.7% FPR on a self-built PhysicalSafetyBench-1K (PSB-1K), and replication on SafeText and EARBench. The paper contrasts PRISM with LLM judges that over-block safe tasks and with content guardrails that miss physical danger entirely.

Significance. If the central separability claim holds, the result is significant: it provides evidence that physically grounded danger is represented differently from text-level content danger, and that a simple linear probe can yield a calibrated safe/unsafe operating point at low computational cost. The random-split null in §3.2 is a thoughtful anti-circular control, and the paper's disclosure of fixed hyperparameters, within-fold standardization, and per-layer selection improves reproducibility. PRISM's low-FPR performance across multiple backbones and benchmarks is practically appealing if the label taxonomy is trustworthy. However, the contribution currently rests on a keyword-derived CD/PD split and an unreleased, unaudited self-built benchmark; until those threats are addressed, the strength of the empirical claims is conditional.

major comments (3)
  1. [§5.1, §3.1] The CD/PD taxonomy is load-bearing but derived from a deterministic 25-keyword substring rule, which the paper itself calls 'not leakage-free' and illustrates with 'drop appears in 12 safe and 29 CD cases, and break in 1 safe and 34 CD cases.' The CDD and PDD estimates are class-mean differences from the safe set, and PRISM is trained on these labels. If CD/PD labels correlate strongly with lexical/topic clusters rather than physical causality, the observed angular separation and probe metrics partly reflect label structure. The random-split null in §3.2 destroys all unsafe labels, thereby also destroying the lexical cluster, so it does not control for semantic label leakage. Please test the separability after removing or re-labeling keyword-triggered examples, or provide human reannotation of SafeAgentBench's unsafe split, and report whether the angle and PRISM metrics survive.
  2. [§5.1, §3.2] The formal random-split null was only run for Qwen2.5-3B; §5.1 states 'Null tests for 7B/14B/32B were not completed,' so the cross-scale angle claims (Figure 3a, Table 1) rest on point estimates without significance bounds. Since contribution 1 explicitly claims separability across Qwen2.5 scales, the absence of null tests at least at 7B, and ideally at 14B/32B, leaves a load-bearing part of the generalization claim unsubstantiated. Please either run the identical null at the other scales or soften the cross-scale claim to an observed pattern pending such tests.
  3. [§5.4, Table 4] PSB-1K, the benchmark behind the cleanest result (99.6% accuracy, 0.7% FPR), is self-built, unreleased, and has no reported human-annotation audit, inter-annotator agreement, item examples, or release plan. Pair-wise GroupKFold prevents the same contrast pair from appearing in both train and test folds, but a linear probe can still learn stable within-fold lexical regularities (e.g., risk-family vocabulary such as metal, liquid, bleach, open flame). As written, PSB-1K results may demonstrate learnability of the benchmark's label pattern rather than physical-causal reasoning. Please provide a detailed benchmark construction protocol, human validation with agreement statistics, example items, and a release link, and consider a leakage-filtered analysis that removes pairs decodable from family-specific keywords alone.
minor comments (5)
  1. [Figure 2] The caption says the 'combined PRISM boundary misclassifies 148/600,' but Table 2 reports PRISM accuracy of 86.2–87.7%, which corresponds to about 74–83 errors, not 148. Clarify that Figure 2 uses a two-dimensional CDD/PDD projection rather than the full hidden-state probe.
  2. [§3.2] For the cross-scale angles in Table 1, consider reporting bootstrap confidence intervals around the point estimates, especially since the formal null is only available at 3B.
  3. [§5.1] The sentence introducing the keyword split is a bit awkward: 'This split is reproducible but not leakage-free' is followed by parenthetical examples. I suggest moving this disclosure to a dedicated 'Threats to validity' paragraph and discussing what the leakage does and does not affect.
  4. [Table 2] For CDD-only/PDD-only rows, the FPR column is reported as 0.0%. Please clarify whether this is the FPR on the safe set at default threshold τ=0.5, and how the threshold is applied in OOD evaluation; the number is surprisingly exact and deserves an explicit statement.
  5. [§5.6, Appendix A.1] The matched-FPR McNemar comparison selects a threshold on the test data (τ≈0.029). Since this is a post hoc threshold choice, please state whether the reported χ² values account for this selection, or treat the comparison as exploratory.

Circularity Check

0 steps flagged

No significant circularity: the angular separability claim is checked against an explicit random-split null built from the identical fitting pipeline, and PRISM is an independently evaluated linear probe with fixed hyperparameters and fold-internal layer selection.

full rationale

The paper's derivation chain is not circular. The CDD/PDD directions are class-mean differences computed from the CD/PD labels, but the paper does not treat their angle as evidence by itself; it compares the observed probe-weight angle to a random-split null generated by the identical fitting pipeline (§3.2, §5.1: 'we calibrate θpw against a random-split null built by the identical fitting pipeline'). This is explicitly an anti-circular control. PRISM is a single-layer L2-regularized logistic probe with fixed hyperparameters (C=1.0, max_iter=2000), with the probe layer selected by training-fold 5-fold CV before evaluation; its SafeAgentBench, SafeText, and EARBench results are within-dataset fold-internal evaluations on external benchmarks, so no headline accuracy, FPR, or recall figure reduces to a fitted parameter. PSB-1K is author-built, unreleased, and lacks an independent human-annotation audit, and the SafeAgentBench CD/PD split is a leaky deterministic 25-keyword rule that the paper itself discloses as 'reproducible but not leakage-free' (§5.1). These are benchmark-validity and construct-validity limitations, not circularity, because the labels are not derived from PRISM or from the hidden-state directions being tested. The random-split null was only run at Qwen2.5-3B, which weakens the cross-scale statistical claim but does not make it definitional or reduce the cross-scale angle observations to their own inputs. No load-bearing step in the paper is, by its own equations or by self-citation, equivalent to its input by construction.

Axiom & Free-Parameter Ledger

4 free parameters · 4 axioms · 2 invented entities

The central claim rests on (1) the linear-representation premise for interpreting hidden-state directions; (2) the keyword-derived CD/PD taxonomy of SafeAgentBench, whose leakage the paper admits; (3) the authors' unreleased PSB-1K; and (4) a null test run only at Qwen2.5-3B. No novel physical constants are introduced; CDD/PDD are data-derived constructs with in-paper-only validation. The most honest measure: a careful, mostly-disclosed empirical study that becomes fully reproducible only after release of PSB-1K and code, and fully convincing only after null tests at larger scales.

free parameters (4)
  • Probe layer ℓ* (per backbone) = 27/36, 20/28, 26/48, 41/64, 24/32, 14/24 (Qwen2.5-3B/7B/14B/32B, Phi-3.5-mini, SmolLM2-1.7B)
    Chosen by per-layer 5-fold CV accuracy on the training set (§4.2, §5.1). The paper admits this is 'a selected-layer estimate rather than a fully nested layer-selection protocol,' so reported angles, accuracies, and FPRs are conditioned on a layer fit to the same data.
  • Matched-FPR threshold τ for McNemar comparison = τ≈0.029 (Qwen2.5-3B)
    Post hoc threshold chosen so PRISM's FPR matches the judge's before the significance test (§5.6, Appendix Figure 8). Statistical equality at a threshold selected after seeing the data is a weak comparison.
  • PSB-1K benchmark design = 1,000 pairs across 10 risk families (100 per family)
    Hand-authored by the authors; no release URL, no human-annotation audit, no inter-annotator agreement, no item examples reported (§5.1). The headline 99.6%/0.7% result depends entirely on this unreleased artifact.
  • Logistic regression hyperparameters = C=1.0, max_iter=2000, random_state=42
    Fixed constants disclosed in §4.2; mild standard values, but hand-chosen and not swept.
axioms (4)
  • domain assumption Last-token hidden states at selected middle-to-late layers carry linearly decodable, concept-level safety geometry (linear representation hypothesis).
    The entire CDD/PDD analysis and PRISM presuppose this; supported by cited prior work (Alain & Bengio 2016; Burns et al. 2023; Arditi et al. 2024; Park et al. 2024) but not re-established here (§3.1, §4.1).
  • domain assumption SafeAgentBench's deterministic 25-keyword substring rule yields valid content-danger vs physical-danger labels.
    The separability claim and all CD/PD-specific metrics inherit this taxonomy. The paper itself flags leakage: 'drop appears in 12 safe and 29 CD cases, break in 1 safe and 34 CD cases' (§5.1).
  • standard math The random-split null distribution is approximately Gaussian, so z=(θ_obs−μ_null)/σ_null is meaningful.
    Used in §5.1 for the 3B null test with 200 repeats; a reasonable CLT-style approximation, but the null is only computed at one layer of one model.
  • domain assumption PSB-1K's ten risk families correctly instantiate 'physical danger without harm keywords'.
    The benchmark is self-built, with no item examples shown, no external validation, and no release (§5.4). The cleanest result in the paper depends entirely on it.
invented entities (2)
  • CDD (Content Danger Direction) no independent evidence
    purpose: Class-mean direction (μ_CD − μ_safe) used to test whether content danger occupies a distinct hidden-state axis.
    Computed from benchmark labels; its only falsifiability handle is the in-paper random-split null at Qwen2.5-3B. No external, code- or data-reproducible handle is provided (§3.1).
  • PDD (Physical Danger Direction) no independent evidence
    purpose: Class-mean direction (μ_PD − μ_safe); the paper claims it captures physically grounded danger beyond content cues.
    Same status as CDD: angles at non-3B scales are point estimates without nulls (§5.1), and PSB-1K — which would be the external handle — is unreleased.

pith-pipeline@v1.3.0-alltime-deepseek · 18159 in / 22404 out tokens · 170489 ms · 2026-08-01T23:49:43.011866+00:00 · methodology

0 comments
read the original abstract

Large language models (LLMs) increasingly serve as high-level planners for embodied agents, where linguistically benign instructions can become unsafe once grounded in the physical world. We study whether this physically grounded danger is the same safety problem as ordinary text-level content danger. Through hidden-state direction analysis and random-split null tests, we show that content danger (CD) and physical danger (PD) form separable signals in LLM representations across Qwen2.5-3B/7B/14B/32B, Phi-3.5 and SmolLM2. Building on the CD/PD separability, we propose PRISM, a single-layer L2-regularized logistic probe over full hidden states. PRISM achieves 86.2--87.7\% accuracy on SafeAgentBench with 11.7--13.7\% FPR, while same-scale LLM judges over-block safe tasks at 24.7--39.0\% FPR. We further introduce PhysicalSafetyBench-1K (PSB-1K), a contrastive benchmark of 1{,}000 physical-risk pairs without direct harm keywords, to test whether methods detect physically grounded danger rather than explicit unsafe wording. On PSB-1K, PRISM reaches 99.6\% accuracy and 0.7\% FPR, whereas a Qwen2.5-3B judge rejects 67.8\% of safe tasks. PRISM also replicates on SafeText and EARBench, supporting hidden-state probing as a representation-level method for physical safety beyond text moderation.

Figures

Figures reproduced from arXiv: 2607.15218 by Chuanpu Fu, Ke Xu, Qi Li, Weimeng Wang, Zihang Zhan, Ziqiang Wang.

Figure 1
Figure 1. Figure 1: Embodied agents require a physical-safety question in addition to text-safety moderation. CD is [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Decision boundaries in the CDD/PDD projection plane on Qwen2.5-3B layer 27 (5-fold CV). CDD [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: CDD/PDD probe-weight angles exceed random-split null angles. (a) Qwen2.5-3B versus the [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: PRISM maps hidden states from a frozen LLM to a safe/unsafe decision boundary in hidden-state [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Cross-model scaling: PRISM accuracy and FPR stay flat while the LLM judge’s physical-danger [PITH_FULL_IMAGE:figures/full_fig_p010_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Cross-architecture universality of CDD/PDD. (a) CDD–PDD probe-weight angles cluster between [PITH_FULL_IMAGE:figures/full_fig_p012_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Per-layer PRISM 5-fold accuracy for Qwen2.5-3B/7B/14B/32B; circles mark the selected layer. [PITH_FULL_IMAGE:figures/full_fig_p013_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: PRISM ROC analysis on Qwen2.5-3B (5-fold-CV out-of-fold probabilities). Left: overall safe-vs [PITH_FULL_IMAGE:figures/full_fig_p018_8.png] view at source ↗
Figure 9
Figure 9. Figure 9: PRISM blocking decisions at the matched-FPR threshold [PITH_FULL_IMAGE:figures/full_fig_p018_9.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

33 extracted references · 24 linked inside Pith

  1. [1]

    Phi-3 technical re- port: A highly capable language model locally on your phone.arXiv preprint arXiv:2404.14219,

    Marah Abdin, Sam Ade Jacobs, Ammar Ahmad Awan, Jyoti Aneja, Ahmed Awadallah, Hany Awadalla, Nguyen Bach, Amit Bahree, Arash Bakhtiari, Harkirat Behl, et al. Phi-3 technical re- port: A highly capable language model locally on your phone.arXiv preprint arXiv:2404.14219,

    Pith/arXiv arXiv

  2. [4]

    Constitutional AI: Harmlessness from AI feedback.arXiv preprint arXiv:2212.08073,

    Yuntao Bai, Saurav Kadavath, Sandipan Kundu, Amanda Askell, Jackson Kernion, Andy Jones, Anna Chen, Anna Goldie, Azalia Mirhoseini, Cameron McKinnon, et al. Constitutional AI: Harmlessness from AI feedback.arXiv preprint arXiv:2212.08073,

    Pith/arXiv arXiv

  3. [5]

    SmolLM2: When smol goes big – data-centric training of a small language model.arXiv preprint arXiv:2502.02737,

    Loubna Ben Allal, Anton Lozhkov, Elie Bakouch, Gabriel Martín Blázquez, Guilherme Penedo, Lewis Tunstall, Andrés Marafioti, Hynek Kydlíˇcek, Agustín Piqueres Lajarín, Vaibhav Srivastav, et al. SmolLM2: When smol goes big – data-centric training of a small language model.arXiv preprint arXiv:2502.02737,

    Pith/arXiv arXiv

  4. [9]

    Samuel Gehman, Suchin Gururangan, Maarten Sap, Yejin Choi, and Noah A. Smith. RealToxici- tyPrompts: Evaluating neural toxic degeneration in language models. InFindings of the Associa- tion for Computational Linguistics: EMNLP 2020,

    2020

  5. [10]

    AEGIS: On- line adaptive AI content safety moderation with ensemble of LLM experts.arXiv preprint arXiv:2404.05993,

    Shaona Ghosh, Prasoon Varshney, Erick Galinkin, and Christopher Parisien. AEGIS: On- line adaptive AI content safety moderation with ensemble of LLM experts.arXiv preprint arXiv:2404.05993,

    Pith/arXiv arXiv

  6. [11]

    Language models as zero-shot planners: Extracting actionable knowledge for embodied agents

    Wenlong Huang, Pieter Abbeel, Deepak Pathak, and Igor Mordatch. Language models as zero-shot planners: Extracting actionable knowledge for embodied agents. InInternational Conference on Machine Learning (ICML), 2022a. Wenlong Huang, Fei Xia, Ted Xiao, Harris Chan, Jacky Liang, Pete Florence, Andy Zeng, Jonathan Tompson, Igor Mordatch, Yevgen Chebotar, et ...

    Pith/arXiv arXiv

  7. [12]

    Llama guard: LLM- based input-output safeguard for human-AI conversations.arXiv preprint arXiv:2312.06674,

    Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, and Madian Khabsa. Llama guard: LLM- based input-output safeguard for human-AI conversations.arXiv preprint arXiv:2312.06674,

    Pith/arXiv arXiv

  8. [13]

    AI2-THOR: An interactive 3D environment for visual AI.arXiv preprint arXiv:1712.05474,

    Eric Kolve, Roozbeh Mottaghi, Winson Han, Eli VanderBilt, Luca Weihs, Alvaro Herrasti, Daniel Gordon, Yuke Zhu, Abhinav Gupta, and Ali Farhadi. AI2-THOR: An interactive 3D environment for visual AI.arXiv preprint arXiv:1712.05474,

    Pith/arXiv arXiv

  9. [15]

    AGENTSAFE: Benchmarking the safety of embodied agents on hazardous instructions.arXiv preprint arXiv:2506.14697,

    Aishan Liu, Zonghao Ying, Le Wang, Junjie Mu, Jinyang Guo, Jiakai Wang, Yuqing Ma, Siyuan Liang, Mingchuan Zhang, Xianglong Liu, and Dacheng Tao. AGENTSAFE: Benchmarking the safety of embodied agents on hazardous instructions.arXiv preprint arXiv:2506.14697,

    arXiv

  10. [16]

    G-Eval: NLG evaluation using GPT-4 with better human alignment

    15 Yang Liu, Dan Iter, Yichong Xu, Shuohang Wang, Ruochen Xu, and Chenguang Zhu. G-Eval: NLG evaluation using GPT-4 with better human alignment. InProceedings of the 2023 Conference on Empirical Methods in Natural Language Processing (EMNLP),

    2023

  11. [17]

    The llama 3 herd of models.arXiv preprint arXiv:2407.21783,

    Llama Team, AI @ Meta. The llama 3 herd of models.arXiv preprint arXiv:2407.21783,

    Pith/arXiv arXiv

  12. [18]

    IS-Bench: Evaluating interactive safety of VLM-driven embodied agents in daily household tasks.arXiv preprint arXiv:2506.16402,

    Xiaoya Lu, Zeren Chen, Xuhao Hu, Yijin Zhou, Weichen Zhang, Dongrui Liu, Lu Sheng, and Jing Shao. IS-Bench: Evaluating interactive safety of VLM-driven embodied agents in daily household tasks.arXiv preprint arXiv:2506.16402,

    arXiv

  13. [19]

    The geometry of truth: Emergent linear structure in LLM repre- sentations of true/false datasets.arXiv preprint arXiv:2310.06824,

    Samuel Marks and Max Tegmark. The geometry of truth: Emergent linear structure in LLM repre- sentations of true/false datasets.arXiv preprint arXiv:2310.06824,

    Pith/arXiv arXiv

  14. [20]

    Don’t let your robot be harmful: Responsible robotic manipulation via safety- as-policy.arXiv preprint arXiv:2411.18289,

    Minheng Ni, Lei Zhang, Zihan Chen, Kaixin Bai, Zhaopeng Chen, Jianwei Zhang, Lei Zhang, and Wangmeng Zuo. Don’t let your robot be harmful: Responsible robotic manipulation via safety- as-policy.arXiv preprint arXiv:2411.18289,

    arXiv

  15. [21]

    Ike Obi, Vishnunandan L. N. Venkatesh, Weizheng Wang, Ruiqi Wang, Dayoon Suh, Temitope I. Amosa, Wonse Jo, and Byung-Cheol Min. SafePlan: Leveraging formal logic and chain-of- thought reasoning for enhanced safety in LLM-based robotic task planning.arXiv preprint arXiv:2503.06892,

    Pith/arXiv arXiv

  16. [22]

    GPT-4 technical report.arXiv preprint arXiv:2303.08774,

    OpenAI. GPT-4 technical report.arXiv preprint arXiv:2303.08774,

    Pith/arXiv arXiv

  17. [25]

    Llama 2: Open founda- tion and fine-tuned chat models.arXiv preprint arXiv:2307.09288,

    Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Niko- lay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. Llama 2: Open founda- tion and fine-tuned chat models.arXiv preprint arXiv:2307.09288,

    Pith/arXiv arXiv

  18. [26]

    Vazquez, Ulisse Mini, and Monte MacDiarmid

    Alexander Matt Turner, Lisa Thiergart, Gavin Leech, David Udell, Juan J. Vazquez, Ulisse Mini, and Monte MacDiarmid. Steering language models with activation engineering.arXiv preprint arXiv:2308.10248,

    Pith/arXiv arXiv

  19. [27]

    V oyager: An open-ended embodied agent with large language models

    Guanzhi Wang, Yuqi Xie, Yunfan Jiang, Ajay Mandlekar, Chaowei Xiao, Yuke Zhu, Linxi Fan, and Anima Anandkumar. V oyager: An open-ended embodied agent with large language models. arXiv preprint arXiv:2305.16291,

    Pith/arXiv arXiv

  20. [28]

    Advancing embodied agent security: From safety benchmarks to input moderation.arXiv preprint arXiv:2504.15699,

    Ning Wang, Zihan Yan, Weiyang Li, Chuan Ma, He Chen, and Tao Xiang. Advancing embodied agent security: From safety benchmarks to input moderation.arXiv preprint arXiv:2504.15699,

    Pith/arXiv arXiv

  21. [29]

    SafeAgentBench: A benchmark for safe task planning of embodied LLM agents.arXiv preprint arXiv:2412.13178,

    Sheng Yin, Xianghe Pang, Yuanzhuo Ding, Menglan Chen, Yutong Bi, Yichen Xiong, Wenhao Huang, Zhen Xiang, Jing Shao, and Siheng Chen. SafeAgentBench: A benchmark for safe task planning of embodied LLM agents.arXiv preprint arXiv:2412.13178,

    arXiv

  22. [30]

    R-Judge: Bench- marking safety risk awareness for LLM agents

    Tongxin Yuan, Zhiwei He, Lingzhong Dong, Yiming Wang, Ruijie Zhao, Tian Xia, Lizhen Xu, Binglin Zhou, Fangqi Li, Zhuosheng Zhang, Rui Wang, and Gongshen Liu. R-Judge: Bench- marking safety risk awareness for LLM agents. InFindings of the Association for Computational Linguistics: EMNLP 2024,

    2024

  23. [31]

    ShieldGemma: Generative AI content moderation based on gemma.arXiv preprint arXiv:2407.21772,

    Wenjun Zeng, Yuchi Liu, Ryan Mullins, Ludovic Peran, Joe Fernandez, Hamza Harkous, Karthik Narasimhan, Drew Proud, Piyush Kumar, Bhaktipriya Radharapu, Olivia Sturman, and Oscar Wahltinez. ShieldGemma: Generative AI content moderation based on gemma.arXiv preprint arXiv:2407.21772,

    Pith/arXiv arXiv

  24. [32]

    EARBench: Towards evaluating physical risk awareness for task planning of foundation model-based embod- ied AI agents.arXiv preprint arXiv:2408.04449,

    Zihao Zhu, Bingzhe Wu, Zhengyou Zhang, Lei Han, Qingshan Liu, and Baoyuan Wu. EARBench: Towards evaluating physical risk awareness for task planning of foundation model-based embod- ied AI agents.arXiv preprint arXiv:2408.04449,

    Pith/arXiv arXiv

  25. [33]

    SDD”/“PGD

    Andy Zou, Long Phan, Sarah Chen, James Campbell, Phillip Guo, Richard Ren, Alexander Pan, Xuwang Yin, Mantas Mazeika, Ann-Kathrin Dombrowski, et al. Representation engineering: A top-down approach to AI transparency.arXiv preprint arXiv:2310.01405, 2023a. Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J. Zico Kolter, and Matt Fredrikson. Universal an...

    Pith/arXiv arXiv

  26. [2017]

    SafeText: A benchmark for exploring physical safety in language models

    Sharon Levy, Emily Allaway, Melanie Subbiah, Lydia Chilton, Desmond Patton, Kathleen McKe- own, and William Yang Wang. SafeText: A benchmark for exploring physical safety in language models. InProceedings of the 2022 Conference on Empirical Methods in Natural Language Processing (EMNLP), pp. 2407–2421,

    2022

  27. [2018]

    Qwen2.5 technical report.arXiv preprint arXiv:2412.15115,

    Qwen Team. Qwen2.5 technical report.arXiv preprint arXiv:2412.15115,

    Pith/arXiv arXiv

  28. [2019]

    Gen- erating robot constitutions & benchmarks for semantic safety.arXiv preprint arXiv:2503.08663,

    16 Pierre Sermanet, Anirudha Majumdar, Alex Irpan, Dmitry Kalashnikov, and Vikas Sindhwani. Gen- erating robot constitutions & benchmarks for semantic safety.arXiv preprint arXiv:2503.08663,

    Pith/arXiv arXiv

  29. [2020]

    RT-2: Vision-language-action models transfer web knowledge to robotic control.arXiv preprint arXiv:2307.15818,

    Anthony Brohan, Noah Brown, Justice Carbajal, Yevgen Chebotar, Xi Chen, Krzysztof Choroman- ski, Tianli Ding, Danny Driess, Avinava Dubey, Chelsea Finn, et al. RT-2: Vision-language-action models transfer web knowledge to robotic control.arXiv preprint arXiv:2307.15818,

    Pith/arXiv arXiv

  30. [2022]

    Understanding intermediate layers using linear classifier probes.arXiv preprint arXiv:1610.01644,

    Guillaume Alain and Yoshua Bengio. Understanding intermediate layers using linear classifier probes.arXiv preprint arXiv:1610.01644,

    Pith/arXiv arXiv

  31. [2023]

    SafeMind: Benchmarking and mitigating safety risks in embodied LLM agents

    Ruolin Chen et al. SafeMind: Benchmarking and mitigating safety risks in embodied LLM agents. arXiv preprint arXiv:2509.25885,

    arXiv

  32. [2024]

    Do as I can, not as I say: Grounding language in robotic affordances.arXiv preprint arXiv:2204.01691,

    Michael Ahn, Anthony Brohan, Noah Brown, Yevgen Chebotar, Omar Cortes, Byron David, Chelsea Finn, Chuyuan Fu, Keerthana Gopalakrishnan, Karol Hausman, et al. Do as I can, not as I say: Grounding language in robotic affordances.arXiv preprint arXiv:2204.01691,

    Pith/arXiv arXiv

  33. [2025]

    Efficient LLM moderation with multi-layer latent prototypes.arXiv preprint arXiv:2502.16174,

    Maciej Chrab ˛ aszcz, Filip Szatkowski, Bartosz Wójcik, Jan Dubi´nski, Tomasz Trzci ´nski, and Se- bastian Cygert. Efficient LLM moderation with multi-layer latent prototypes.arXiv preprint arXiv:2502.16174,

    Pith/arXiv arXiv