W HEN W ORDS A RE S AFE B UT ACTIONS K ILL : P ROB ING P HYSICAL DANGER B EYOND T EXT S AFETY IN H IDDEN -S TATE R ISK S PACE Weimeng Wang1 Ziqiang Wang1∗ Zihang Zhan1 Chuanpu Fu2 Qi Li1 Ke Xu1∗ Department of Computer Science and Technology, Tsinghua University, Beijing, China 2 Nanyang Technological University, Singapore 1
arXiv:2607.15218v1 [cs.AI] 16 Jul 2026
A BSTRACT Large language models (LLMs) increasingly serve as high-level planners for embodied agents, where linguistically benign instructions can become unsafe once grounded in the physical world. We study whether this physically grounded danger is the same safety problem as ordinary text-level content danger. Through hidden-state direction analysis and random-split null tests, we show that content danger (CD) and physical danger (PD) form separable signals in LLM representations across Qwen2.5-3B/7B/14B/32B, Phi-3.5 and SmolLM2. Building on the CD/PD separability, we propose PRISM, a single-layer L2-regularized logistic probe over full hidden states. PRISM achieves 86.2–87.7% accuracy on SafeAgentBench with 11.7–13.7% FPR, while same-scale LLM judges overblock safe tasks at 24.7–39.0% FPR. We further introduce PhysicalSafetyBench1K (PSB-1K), a contrastive benchmark of 1,000 physical-risk pairs without direct harm keywords, to test whether methods detect physically grounded danger rather than explicit unsafe wording. On PSB-1K, PRISM reaches 99.6% accuracy and 0.7% FPR, whereas a Qwen2.5-3B judge rejects 67.8% of safe tasks. PRISM also replicates on SafeText and EARBench, supporting hidden-state probing as a representation-level method for physical safety beyond text moderation.
1
I NTRODUCTION
Large language models (LLMs) are widely used for high-level task understanding and task decomposition in embodied agents. In both modular LLM+VLM systems and Vision-Language-Action (VLA) models (Driess et al., 2023; Brohan et al., 2023), LLMs translate natural-language instructions into executable subtasks or action plans for homes, kitchens, offices, and other physical environments (Ahn et al., 2022; Huang et al., 2022a; Song et al., 2023). This creates a safety problem different from ordinary text moderation. Some instructions are unsafe because their wording directly expresses harmful content, such as “ignite the curtain”; we call this content danger (CD). Others use harmless words but become unsafe under physical causality, such as “microwave an egg” or “place a metal fork in the microwave”; we call this physical danger (PD). Figure 1 summarizes the distinction. Text-safety question content danger “ignite the curtain”
Text guardrail policy cues Before-execution safety decision
Incoming instruction Embodied-safety question physical danger “microwave an egg”
Physical monitor causal context
Figure 1: Embodied agents require a physical-safety question in addition to text-safety moderation. CD is visible in the instruction text, whereas PD depends on physical causality and must be detected before the plan is executed. ∗
Corresponding authors
1
In this paper, we demonstrate through an analysis of LLM hidden states that physical safety constitutes a distinct modeling problem for embodied agents, rather than merely a text-classification problem. Existing text-safety detectors and guardrails (Inan et al., 2023; Llama Team, AI @ Meta, 2024; Zeng et al., 2024; Han et al., 2024; Ghosh et al., 2024) are efficient, but they are designed for policy-violation cues in text and are not sufficient for risks that arise only after grounding the action. Large-parameter LLM judges can reason about physical context, but they are poorly calibrated in our runs: Qwen2.5-32B-Instruct (Qwen Team, 2024) detects 95.7% of PD cases but rejects 37.0% of safe tasks. Smaller judges are not a reliable replacement, and fine-tuning a separate small model would require substantial task-specific safety data. Hidden-state prototype methods such as LPM (Chrabaszcz ˛ et al., 2025) also perform poorly on PD transfer, detecting only 9.6–19.3% of PD OOD samples across Qwen2.5 scales. These failures suggest that physically dangerous actions should not be treated as ordinary unsafe text or as a single generic unsafe direction. To analyse unsafe action plans on resource constrained embodied devices, we built a hidden state space based analysis framework. Specifically, by constructing data pairs and analysing the hiddenlayer states of LLMs, we find that physical danger actions exhibit distinct distributional characteristics and differ from content danger. For example, we estimate a content-danger direction, uCDD , and a physical-danger direction, uPDD , across Qwen2.5-3B/7B/14B/32B. Across these scales, the directions remain separated, with probe-weight angles in the low-to-mid 70◦ range; the Qwen2.53B result is well above a size-matched random-split null. The same pattern is also observed on Phi-3.5-mini and SmolLM2-1.7B, suggesting that it reflects a general property of LLMs rather than an artifact specific to the Qwen family. Based on this finding, we propose PRISM (Probing Representations for Integrated Safety Monitoring), a hidden-state risk probe for embodied-agent planning. PRISM uses a single-layer L2regularized logistic-regression probe over middle-to-late hidden states to classify whether an instruction is safe or unsafe while learning from both danger sources. Across Qwen2.5-3B/7B/14B/32B, PRISM achieves 86.2–87.7% accuracy with 11.7–13.7% FPR and maintains physical-danger recall around 80%. In the paired SafeAgentBench 3B comparison, PRISM is statistically comparable to the judge under McNemar’s test; across larger scales, it reduces analysis latency from 116.8/309.1/191.9 ms per sample to 56.8/146.1/103.4 ms at 7B/14B/32B, corresponding to 1.86–2.12× speedups, while keeping FPR roughly one third to one half of the judge’s rate. PRISM also replicates on SafeText and EARBench and remains effective across Phi-3.5-mini and SmolLM2-1.7B. As existing safety resources contain valuable examples, but many evaluations still reward detecting explicit content-danger cues, while the physical-danger cases most relevant to embodied agents can be hidden inside ordinary household language. To make this failure mode measurable, we construct PhysicalSafetyBench-1K (PSB-1K), a paired benchmark with 1,000 safe instructions and 1,000 minimally contrasted physical-risk instructions across ten household risk families, including microwave metal contact, liquid contact with powered devices, open-flame proximity, food contamination, and contact-placement injury. The unsafe instructions avoid direct harm keywords such as danger, harm, burn, shock, and poison, so a method must identify physical consequences rather than rely on surface policy language. On PSB-1K, PRISM reaches 99.6% accuracy and 99.9% physical-danger recall with only 0.7% FPR on Qwen2.5-3B, whereas Llama Guard 3-1B has 0/1000 true positives (0.0% physical-danger recall, 0.0% FPR; Table 3) and the Qwen2.5-3B judge attains high unsafe recall only by rejecting 67.8% of safe tasks. Our contributions are as follows. 1. We show that embodied-agent physical safety is not the same task as text-level content safety. We identify two statistically decomposable hidden-state directions, the Content Danger Direction (CDD) and the Physical Danger Direction (PDD), and show that their separation exceeds a random-split null on Qwen2.5-3B while remaining consistent across larger Qwen2.5 models and two non-Qwen architectures. 2. We build a reproducible evaluation protocol over SafeAgentBench, adapted SafeText and EARBench, and our self-built PSB-1K benchmark. PSB-1K contributes 1,000 contrastive physicalsafety pairs for testing whether methods detect physically grounded danger rather than only explicit content-danger cues. 3. We propose PRISM, a single-layer linear probe over full hidden states that directly operationalizes the CD/PD separability finding. PRISM jointly detects both danger types with low FPR, 2
while LLM judges and content-oriented guards expose complementary failures: over-blocking safe tasks or missing physical danger.
2
R ELATED W ORK
Embodied-agent safety benchmarks. Existing benchmarks can be grouped into three categories. SafeAgentBench provides household tasks in AI2-THOR (Kolve et al., 2017); we use its 600 executable labeled tasks, including 113 content-dangerous and 187 physically dangerous unsafe cases, while noting leakage in its keyword-based split (Yin et al., 2024). EARBench contains 2,634 samples across seven domains and 28 scenarios, emphasizing contextual risks in multi-agent settings (Zhu et al., 2024). SafeText targets text-based physical commonsense through 1,465 safety pairs (Levy et al., 2022). A broader line of work evaluates embodied or task-planning safety from different angles: AgentSafe and IS-Bench probe hazardous instructions and interactive household safety (Liu et al., 2025; Lu et al., 2025); EAsafetyBench and SafeMind add input moderation and multi-stage risk taxonomies (Wang et al., 2025; Chen et al., 2025); and further work targets manipulation-level safety, formal-logic planning, semantic-safety constitutions, safe reinforcement learning, and agent-interaction risk (Ni et al., 2024; Huang et al., 2025; Obi et al., 2025; Sermanet et al., 2025; Ji et al., 2023; Yuan et al., 2024; Ruan et al., 2024). Building on prior work, we leverage these benchmarks to validate the physical hidden-state space. We further introduce PSB-1K, a benchmark designed to disentangle physically grounded danger from explicit content-danger language. Probing and representation engineering. Linear probes are widely used to examine whether intermediate representations encode conceptual information (Alain & Bengio, 2016; Belinkov, 2022). Most probing studies use supervised classifiers to test the decodability of a predefined concept; complementary unsupervised methods, such as CCS, recover abstract concepts including truthfulness from LLM hidden states (Burns et al., 2023). A second line of work uses latent directions not only for measurement but also for intervention. Representation Engineering and Inference-Time Intervention identify directions associated with safety, honesty, refusal, or truthfulness and use them to steer behavior (Zou et al., 2023a; Li et al., 2023; Turner et al., 2023); refusal in particular is mediated by a single direction (Arditi et al., 2024). These findings are consistent with the linear representation hypothesis and the emergent linear geometry of LLM features (Park et al., 2024; Marks & Tegmark, 2023; Todd et al., 2024; Cunningham et al., 2024). Our use of probes is diagnostic rather than steering-oriented. We ask whether hidden states provide measurable evidence that embodied physical danger differs from text-level content danger before the generated plan is executed. The key distinction is therefore the safety object being measured: prior directions usually target one abstract concept such as refusal or truthfulness, whereas embodied physical danger is not simply a stronger or weaker form of text-policy danger. We therefore model CDD and PDD as two deployment-relevant signals rather than collapsing them into a single concept axis, and we reserve the detailed comparison for empirical baselines that expose the relevant failure modes directly. Safety monitoring beyond text-level moderation. Existing LLM safety mechanisms offer several ways to filter unsafe instructions, but most were developed for text-level policy violations rather than physical execution risks. Dedicated guard models such as Llama Guard provide efficient safe/unsafe classification (Inan et al., 2023; Llama Team, AI @ Meta, 2024), alongside related guardrails (Zeng et al., 2024; Han et al., 2024; Ghosh et al., 2024); LLM-as-judge methods use general-purpose LLMs to produce more contextual safety evaluations (Zheng et al., 2023; Liu et al., 2023; Kim et al., 2024); and latent-prototype approaches such as LPM construct multi-layer hiddenstate prototypes for moderation in representation space (Chrabaszcz ˛ et al., 2025). These methods provide natural points of comparison, but they perform poorly on the PD setting we study: text guards miss physically dangerous plans that lack policy-violation wording, judges over-block normal household tasks, and prototype methods fail to transfer from content danger to physical danger. This gap motivates a method designed specifically for embodied physical safety. More broadly, alignment and adversarial-robustness work (Ouyang et al., 2022; Bai et al., 2022; Zou et al., 2023b; Wei et al., 2023; Mazeika et al., 2024) primarily studies behavioral compliance and robustness, while physical-commonsense and toxicity benchmarks highlight that linguistic toxicity is distinct 3
from physical safety (Bisk et al., 2020; Gehman et al., 2020). PRISM targets this separate safety topic: whether physical execution risk and content-policy risk can be distinguished inside hidden states and modeled directly.
3
K EY O BSERVATION : DANGER I S D ECOMPOSABLE IN H IDDEN -S TATE S PACE
Our key insight is that embodied-agent physical safety is not merely an instance of ordinary LLM text safety. We use hidden-state analysis as evidence for this claim: if CD and PD were the same safety concept, probes trained on one danger type should transfer cleanly to the other and their hidden-state directions should be statistically indistinguishable from random unsafe splits. Instead, we find a stable gap between the two. Content danger and physical danger form separable directions in the middle-to-late hidden states of frozen LLMs, and this separation explains why contentoriented detectors miss many physically dangerous instructions. This section establishes the representation-level basis for PRISM. We first define CDD and PDD as two direction estimates for testing whether text-safety and physical-safety risks occupy the same hidden-state space. We then verify that their observed separation is not an accident of highdimensional fitting by comparing it against a random-split null distribution. The goal is not to claim strict orthogonality, but to show that embodied physical safety is a distinct modeling target that requires explicit representation-level treatment.
3.1
CDD AND PDD DIRECTIONS
To analyze whether CD and PD are encoded by the same representational signal, we define classmean directions at layer L. Let S, E, and I denote the index sets of safe, content-danger, and physical-danger examples. Their class means are
1 µsafe = |S|
X i∈S
hL (xi ),
1 µCD = |E|
X i∈E
hL (xi ),
1 µPD = |I|
X
hL (xi ),
i∈I
and we define CDD = µCD − µsafe and PDD = µPD − µsafe , where hL (x) ∈ Rd is the last-token hidden state at layer L (formally defined in §4). These directions give a simple test of whether the model represents explicit content risk and physically grounded risk as the same displacement away from safe tasks. We report two complementary angular quantities because no single angle captures both the raw geometry and the decision-relevant geometry of the two danger classes. The mean-difference angle θmd , taken directly between CDD and PDD, describes where the class centroids sit in activation space without fitting a classifier. This is a conservative geometric summary because it ignores within-class covariance. The probe-weight angle θpw , taken between the weight vectors of two L2-regularized logistic probes (safe-vs-CD and safe-vs-PD), measures the decision-relevant geometry available to a linear detector. Since discriminative training can rotate probe weights under anisotropic feature covariance, we do not interpret θpw alone; instead, we compare it with a randomsplit null generated by the identical fitting pipeline (§5.1). Figure 2 visualizes why the two-direction analysis matters for detection. CDD-only and PDD-only thresholds each cover only part of the unsafe space, while the combined PRISM boundary captures both danger types. This supports the claim that physical danger is a distinct hidden-state topic rather than merely a harder instance of ordinary text danger. 4
Figure 2: Decision boundaries in the CDD/PDD projection plane on Qwen2.5-3B layer 27 (5-fold CV). CDDonly and PDD-only one-dimensional thresholds misclassify 163/600 and 159/600 examples respectively, while the combined PRISM boundary misclassifies 148/600. Physical-danger examples concentrate in regions that are poorly covered by a content-only direction, making physical danger a different hidden-state topic rather than a harder instance of ordinary text danger. Historical labels in the figure: “SDD”/“PGD”/“Explicit”/“Implicit” ≡ CDD/PDD/content danger/physical danger.
3.2
S EPARABILITY BEYOND A RANDOM - SPLIT NULL
To avoid treating the angular result as a chance artifact, we compare the observed CD/PD split with random unsafe splits produced by the same training pipeline. Specifically, for Qwen2.5-3B at layer 27, we randomly partition the 300 unsafe examples into groups of 113 and 187, train two safe-vsrandom-subset probes, and record the angle between their weights. This preserves the same sample sizes, optimizer, L2 regularization, and safe baseline as the real CDD/PDD comparison. The observed separation is consistently larger than the random-split baseline. At the selected layers, the probe-weight angles are 75.9◦ /74.2◦ /71.6◦ /71.9◦ for Qwen2.5-3B/7B/14B/32B, while the meandifference angles are 49.1◦ /54.6◦ /63.2◦ /67.7◦ (Figure 3). For Qwen2.5-3B, the formal random-split control gives an observed angle of 76.33◦ against a null mean of 60.35◦ and standard deviation 1.58◦ (z = 10.09, p < 0.0001); no random split reaches the observed angle. Figure 3b shows the corresponding null distribution directly. Together with the failure of CDD-only on physical-OOD detection and the incomplete reverse transfer of PDD-only that we report later (§5.2), this supports a two-signal view of embodied safety.
(b) Layer-27 null histogram.
(a) Random-split null band.
Figure 3: CDD/PDD probe-weight angles exceed random-split null angles. (a) Qwen2.5-3B versus the 113/187-split null band. (b) The random-split null distribution at layer 27 concentrates around 60.35◦ ± 1.58◦ , below the observed 76.33◦ CD/PD angle. The corresponding selected-layer angles across Qwen2.5 scales are reported in Table 1.
5
Table 1: Selected-layer CDD/PDD angles across Qwen2.5 scales. Probe-weight angles exceed the random-split null band, while mean-difference angles provide a conservative centroid-level summary.
⋆
Selected layer ℓ Probe-weight angle (◦ ) Mean-diff. angle (◦ )
4
3B
7B
14B
32B
27/36 75.9 49.1
20/28 74.2 54.6
26/48 71.6 63.2
41/64 71.9 67.7
D ESIGN : PRISM AS A H IDDEN -S TATE R ISK P ROBE
Building on the observation that CD and PD occupy separable hidden-state directions, we design PRISM (Probing Representations for Integrated Safety Monitoring), a representation-level classifier that maps a selected hidden state to a safe/unsafe decision. PRISM is not a wrapper around LLM judges: it directly operationalizes the CD/PD structure by learning a linear boundary over the hidden-state space. Figure 4 summarizes the pipeline. The CDD/PDD analysis of §3 motivates the probe, but PRISM itself is trained as a full-hidden-state safe/unsafe classifier rather than as a hand-crafted CDD/PDD scalar rule.
Figure 4: PRISM maps hidden states from a frozen LLM to a safe/unsafe decision boundary in hidden-state risk space. CDD/PDD analysis explains why both content danger and physical danger must be modeled, while PSB-1K provides a contrastive physical-safety benchmark for validating whether the method detects physically grounded danger without relying on explicit harm wording.
4.1
P ROBLEM FORMULATION
We define the natural-language instruction x as the input and attach a binary safety label y ∈ {0, 1}, where y = 0 denotes safe and y = 1 unsafe. For unsafe instructions we further distinguish a subtype t ∈ {content danger, physical danger}: content-danger instructions carry surface-level danger cues, whereas physical-danger instructions become dangerous only when grounded in physical causality. The target classifier must satisfy two requirements at once: high recall on both CD and PD, and a low false-positive rate on safe tasks. For a selected transformer layer L, let hL (x) ∈ Rd be the last-token hidden state returned with output_hidden_states=True. PRISM uses the logistic probe p(y = 1 | x) = σ(w⊤ hL (x) + b),
ŷ = 1[p(y = 1 | x) ≥ τ ],
with default threshold τ = 0.5. We report accuracy, F1, AUC, CD and PD detection rates, and FPR, since accuracy alone can mask over-blocking on safe tasks or under-detection of physical danger. 6
4.2
PRISM PROBE CONSTRUCTION
PRISM is a single-layer linear classifier acting on the full hidden state hL (x), rather than a handcrafted concatenation of scalar CDD and PDD projections. The training set contains safe, contentdanger, and physical-danger instructions simultaneously, so the binary probe must learn a decision boundary covering both danger types. Features are standardized by a StandardScaler fitted inside each training fold, and the classifier is LogisticRegression(max_iter=2000, C=1.0, random_state=42) (Pedregosa et al., 2011). We select the probe layer by a per-layer 5-fold cross-validation sweep on the training set, choosing the layer with the highest mean fold accuracy; this is a selected-layer estimate rather than a fully nested layer-selection protocol. The procedure is model-agnostic and applied independently to each backbone, so PRISM is not tied to any fixed layer; the resulting per-model layer indices are reported with the experimental setup (§5.1). Algorithm 1 summarizes the full training and inference procedure. Algorithm 1 PRISM: Linear Probing for Physical Safety ⋆ Require: LLM fθ with L layers; training set {(xi , yi )}N i=1 with yi ∈ {0, 1}; test input x ; threshold τ. Ensure: Safety prediction ŷ ⋆ ∈ {0, 1}.
1: Training phase 2: for ℓ = 1, . . . , L do (ℓ) 3: Compute hidden state hi ← fθ (xi )[ℓ] for all i ▷ last-token state 4: end for 5: Select layer ℓ⋆ by 5-fold cross-validation accuracy on the training set 6: Standardize features to zero mean and unit variance per dimension, giving h̃i PN 1 1 ⊤ 2 7: Train probe: (w, b) ← arg minw,b N i=1 BCE(σ(w h̃i + b), yi ) + C ∥w∥2 8: Inference phase 9: Compute h⋆ ← fθ (x⋆ )[ℓ⋆ ] and standardize to get h̃⋆ 10: p⋆ ← σ(w⊤ h̃⋆ + b) 11: return ŷ ⋆ ← ⊮[p⋆ ≥ τ ]
5
E VALUATION
The experiments are organized around five questions. First, on SafeAgentBench we test whether PRISM can jointly detect CD and PD while keeping false positives low. Second, scaling and crossdataset experiments test whether the operating point remains stable across model sizes and benchmarks. Third, PSB-1K isolates physically grounded danger without explicit harm keywords, directly testing whether methods go beyond CD cues. Fourth, cross-architecture experiments check whether the CD/PD separation holds beyond Qwen. Finally, significance, latency, and ablations identify whether PRISM’s advantage comes from the hidden-state signal, the selected layer, and the twodanger training boundary rather than from a more complex classifier. 5.1
E XPERIMENTAL SETUP
We evaluate PRISM on embodied household-safety classification, where a system must reject both content-dangerous instructions and instructions that become unsafe through physical interaction. The primary benchmark is the 600-example SafeAgentBench subset (Yin et al., 2024), containing 300 safe and 300 unsafe AI2-THOR household instructions. Following the implemented taxonomy, the unsafe split is produced by a deterministic 25-keyword substring rule, yielding 113 contentdanger (CD) and 187 physical-danger (PD) examples. This split is reproducible but not leakage-free (e.g. drop appears in 12 safe and 29 CD cases, and break in 1 safe and 34 CD cases), so we retain it for comparability while reporting CD and PD separately. We further test replication on adapted SafeText (737 examples) and EARBench (2,634 examples), each with fold-internal 5-fold CV; we therefore read these as cross-dataset replication under matched machinery rather than zeroshot transfer. 7
We additionally evaluate on our self-built PhysicalSafetyBench-1K (PSB-1K). PSB-1K contains 1,000 minimally contrasted safe/risk pairs, yielding 2,000 flat examples with 1,000 safe and 1,000 physical-danger examples. It covers ten balanced household risk families: microwave metal contact, microwave pressure heating, toaster conductive-object contact, liquid contact with powered devices, walking-surface liquid, heated-surface object contact, open-flame proximity, food-contact contamination, cleaning-item food-container contact, and contact-placement injury. The unsafe instructions are written without direct harm keywords, so the benchmark specifically targets PD rather than CD. Because the safe and unsafe examples are paired, PSB-1K uses pair-wise GroupKFold so that the two members of a contrast pair never appear in different folds. This protocol tests whether the monitor learns physically grounded safety structure instead of memorizing a paired lexical contrast. PRISM, SVM-RBF, and MLP use 5-fold StratifiedKFold with standardization fitted inside each fold on the unpaired benchmarks, and pair-wise GroupKFold on PSB-1K. Directional probes and LPM use subtype leave-out testing on SafeAgentBench; on PSB-1K, we evaluate the full probe and representative baseline families because the unsafe class is intentionally all physical danger. LLM judges are evaluated from their generated decisions. The main scaling study uses Qwen2.5-Instruct at 3B/7B/14B/32B (Qwen Team, 2024), while the cross-architecture study repeats the pipeline on Phi-3.5-mini (Abdin et al., 2024) and SmolLM2-1.7B (Ben Allal et al., 2025). For PRISM, the SafeAgentBench probe layers selected by the per-layer 5-fold sweep are 27/36 for Qwen2.5-3B, 20/28 for Qwen2.5-7B, 26/48 for Qwen2.5-14B, 41/64 for Qwen2.5-32B, 24/32 for Phi-3.5-mini, and 14/24 for SmolLM2-1.7B (reported as selected/total layer index); PSB-1K uses the same per-layer selection rule within its pair-wise folds. Baselines. We compare PRISM against directional ablations isolating the two danger axes. The CDD probe is trained on safe+CD examples, evaluated on held-out CD via 5-fold CV, then tested OOD on PD; the PDD probe follows the symmetric protocol. We also include geometric and conventional classifiers on the same features: Nearest Centroid (cosine distance to safe/unsafe centroids trained on safe+CD examples), LPM (Chrabaszcz ˛ et al., 2025) (standardized multi-layer hidden states, PCA, and Mahalanobis distance to class prototypes; the 3B run uses layers [20, 23, 24, 26, 27] and a 200-dimensional PCA space, while the large-model script selects the top five layers by probe accuracy), SVM-RBF, and a two-layer MLP, all under the same 5-fold protocol. For model-based baselines, the LLM judge uses the corresponding Qwen2.5-Instruct model (Qwen Team, 2024) with a zero-shot prompt answering exactly SAFE/UNSAFE, parsed by deterministic string matching; we additionally report Llama Guard 3-1B (Inan et al., 2023; Llama Team, AI @ Meta, 2024) using its default generated safe/unsafe output. On PSB-1K we emphasize two evaluation failure modes: CD-oriented moderation that does not flag physically grounded unsafe actions, and LLM judges that recover unsafe recall only by over-blocking safe tasks. Latency compares one PRISM forward pass (hidden-state output) against one judge generation pass (max_new_tokens=8) under the same prompt, with 20 warmup and 580 measured examples; we treat this as an efficiency diagnostic rather than the central claim of the paper. Random-split null procedure. To verify that the CD/PD separation reported in §3.2 is not an artifact of high-dimensional fitting, we calibrate θpw against a random-split null built by the identical fitting pipeline. At the target layer the 300 unsafe examples are randomly partitioned into groups of 113 and 187 (matching the content/physical split), paired against the same 300 safe examples to train two logistic probes, and the angle between their weight vectors is recorded; repeating 200 times yields the null, with statistic z = (θobs − µnull )/σnull . Null tests for 7B/14B/32B were not completed, so the cross-model claim is stated as an observed angle pattern. 5.2
M AIN RESULTS ON S AFE AGENT B ENCH
PRISM gives the most reliable overall operating point across the Qwen2.5 family, detecting both danger types while holding false positives low (Table 2). Accuracy remains tightly concentrated from 86.2% to 87.7%, F1 between 0.861 and 0.876, and AUC rises from 0.926 to 0.950. The false-positive rate stays low, between 11.7% and 13.7%, while physical-danger detection remains stable between 79.1% and 82.4%, and content-danger detection is never below 93.8%. These results indicate that a single selected hidden-state layer contains a linearly usable safety signal that covers both content dangers and physical dangers. The ablations clarify why this signal cannot be reduced to a single content-danger direction: CDD-only achieves strong in-domain content detection, but 8
its physical-OOD detection collapses to 19.8%, 31.6%, 32.6%, and 31.6% across 3B–32B, and LPM shows the same failure mode even more sharply (11.2%, 9.6%, 17.1%, and 19.3%). PDD-only transfers better in the reverse direction but remains incomplete, with content-OOD detection ranging from 68.1% to 85.0%. Embodied safety is therefore not captured by a purely content-oriented axis, and prototype distance alone is insufficient for the two-subtype problem.
Table 2: Main results on SafeAgentBench (600 tasks; 5-fold CV). Accuracy/F1/AUC are reported only for full binary classifiers. For single-direction and prototype methods (CDD-only, LPM, Nearest Centroid), the content column is in-domain CV and the physical column (marked ∗ ) is OOD; for PDD-only the roles reverse. LLM Judge is zero-shot. Llama Guard 3-1B is a single model-agnostic external classifier. Bold = our method. Model
Method
3B
PRISM CDD-only PDD-only LPM Nearest Centroid SVM-RBF MLP LLM Judge PRISM CDD-only PDD-only LPM Nearest Centroid SVM-RBF MLP LLM Judge PRISM CDD-only PDD-only LPM Nearest Centroid SVM-RBF MLP LLM Judge PRISM CDD-only PDD-only LPM Nearest Centroid SVM-RBF MLP LLM Judge Llama Guard 3-1B
7B
14B
32B
all
Acc±std (%)
CD det (%)
PD det (%)
FPR (%)
F1
AUC
86.2±2.4 — — — — 82.8±3.3 83.0±1.8 — 87.0±2.0 — — — — 83.5±1.2 82.5±2.2 — 87.2±1.5 — — — — 85.3±2.4 82.7±2.2 — 87.7±2.4 — — — — 86.0±3.6 84.3±3.7 — —
93.8 89.4 68.1∗ 92.0 87.5 96.5 94.7 98.2 96.5 88.5 76.1∗ 89.4 90.3 91.2 87.6 98.2 97.3 86.8 72.6∗ 87.7 87.7 93.8 93.8 98.2 96.5 91.2 85.0∗ 92.9 92.0 96.5 94.7 100.0 0.0
81.3 19.8∗ 76.5 11.2∗ 46.5∗ 73.8 74.9 86.6 82.4 31.6∗ 76.6 9.6∗ 61.5∗ 72.7 78.1 84.5 79.1 32.6∗ 77.1 17.1∗ 47.1∗ 78.6 74.3 94.1 81.8 31.6∗ 80.8 19.3∗ 43.9∗ 75.9 74.3 95.7 0.0
13.7 0.0 0.0 0.3 16.3 16.7 16.3 27.3 13.7 0.0 0.0 0.7 21.7 12.7 16.7 24.7 11.7 0.0 0.0 0.3 16.0 13.7 16.3 39.0 12.0 0.0 0.0 0.7 17.3 11.7 13.3 37.0 0.0
0.861 — — — — 0.827 0.829 — 0.871 — — — — 0.828 0.824 — 0.870 — — — — 0.852 0.825 — 0.876 — — — — 0.857 0.840 — —
0.926 — — — — 0.909 0.909 — 0.943 — — — — 0.922 0.913 — 0.939 — — — — 0.927 0.917 — 0.950 — — — — 0.942 0.917 — —
The zero-shot judges follow the opposite trade-off, achieving high unsafe recall but over-blocking heavily, and the over-blocking grows with scale. Detection on physical danger reaches 86.6%, 84.5%, 94.1%, and 95.7% from 3B to 32B; however, this sensitivity comes with substantially higher false-positive rates of 27.3%, 24.7%, 39.0%, and 37.0%. Larger judges thus become increasingly aggressive at flagging unsafe instructions, but they also over-block many safe household tasks. Llama Guard 3-1B produces 0.0% detection for both danger types in the local run, consistent with a taxonomy mismatch between general text-safety policies and embodied physical dangers. The central comparison is therefore not that PRISM simply dominates large judges in recall. Rather, PRISM models the hidden-state CD/PD boundary directly and occupies a lower-FPR operating point, preserving roughly 80% physical-danger detection while keeping false positives near 12–14%. The judge results show why decoded safety judgments are not a substitute for modeling the CD/PD distinction: high physical-risk sensitivity alone is insufficient when it comes with broad rejection of safe household tasks. 9
5.3
S CALING AND CROSS - DATASET REPLICATION
Figure 5: Cross-model scaling: PRISM accuracy and FPR stay flat while the LLM judge’s physical-danger recall and FPR both rise with scale.
PRISM’s operating point stays stable across scale, whereas scaling the judge buys sensitivity rather than calibration (Figure 5). PRISM is notably stable from 3B to 32B: selected-layer accuracy varies by only 1.5 percentage points, from 86.2% to 87.7%, and FPR stays within 11.7–13.7%. The selected layers are middle-to-late but not tied to a fixed absolute or relative depth (27/36, 20/28, 26/48, 41/64), so layer selection is model-specific while the existence of a usable safety signal is robust across scale. The judge follows a different trajectory: larger judges improve physical-danger recall, reaching 94.1% at 14B and 95.7% at 32B, but their FPRs also rise to 39.0% and 37.0%. In other words, scaling the judge increases sensitivity, not calibration. PRISM does not match the highest physical-recall numbers at the default threshold, but it maintains a much lower false-positive operating point. This strengthens the paper’s main claim: the useful signal is not merely a larger model’s decoded judgment, but a separable hidden-state structure that can be modeled directly. Table 3: Cross-dataset replication with Qwen2.5-3B. SafeAgentBench, SafeText, and EARBench use withindataset 5-fold CV; PSB-1K uses pair-wise GroupKFold because examples are contrastive safe/risk pairs. PRISM maintains low FPR across datasets, whereas the zero-shot text judge over-blocks sharply on physicalsafety benchmarks. Dataset header lists safe/content/physical counts.
Dataset (safe/CD/PD)
Method
SafeAgentBench PRISM (300/113/187) LLM Judge SafeText PRISM (367/37/333) LLM Judge EARBench PRISM (1317/102/1215) LLM Judge PSB-1K PRISM (1000/0/1000) LLM Judge Llama Guard 3-1B
Acc±std CD det PD det FPR (%) (%) (%) (%)
F1
AUC
86.2±2.4
93.8
81.3
13.7 0.861 0.926
—
98.2
86.6
27.3
—
92.4±1.9
91.9
92.5
7.6
0.924 0.980
—
100.0
97.9
65.7
—
82.9±1.4
82.4
82.4
16.6 0.828 0.906
—
95.1
80.4
74.6
—
99.6±0.5
—
99.9
0.7
0.996 1.000
64.4 50.0
— —
96.5 0.0
67.8 0.730 0.0 0.000
—
—
—
— —
Table 3 shows the hidden-state probe pattern is not unique to SafeAgentBench. Under within-dataset 5-fold CV, PRISM obtains F1 0.861, AUC 0.926, and FPR 13.7% on SafeAgentBench; F1 0.924, AUC 0.980, and FPR 7.6% on SafeText; and F1 0.828, AUC 0.906, and FPR 16.6% on EARBench. On PSB-1K, where unsafe cases are exclusively physical danger and explicit content-danger keywords are removed, PRISM reaches 99.6% accuracy, 99.9% physical-danger recall, and 0.7% FPR. The LLM judge again achieves high unsafe recall at the cost of severe over-blocking. On SafeText it detects 100.0% of content danger and 97.9% of physical danger, but at 65.7% FPR; on EARBench 10
it detects 95.1% of content danger and 80.4% of physical danger while rejecting 74.6% of safe examples; on PSB-1K it detects 96.5% of physical danger while rejecting 67.8% of safe examples. These results reinforce the need to report recall and FPR together: unsafe recall alone would make the judge appear stronger than its behaviour on safe household tasks warrants. Because the external datasets are evaluated with matched fold-internal protocols rather than zero-shot transfer, these results constitute cross-dataset replication under matched evaluation; they nonetheless show that the learned hidden-state separability is not specific to SafeAgentBench. 5.4
P HYSICAL S AFETY B ENCH -1K: PHYSICALLY GROUNDED DANGER WITHOUT CONTENT CUES
PSB-1K is designed to answer a different question from ordinary moderation benchmarks: can a method detect unsafe physical consequences when the instruction is lexically benign? Table 4 reports the Qwen2.5-3B results. PRISM obtains the best calibrated operating point, with 99.6% accuracy, 99.9% physical-danger recall, and 0.7% FPR. The result is not simply an effect of using a larger decoder as a judge. The Qwen2.5-3B zero-shot judge detects 96.5% of physical-danger examples, but it does so by rejecting 67.8% of safe tasks. This is the same failure mode observed on the other benchmarks, but amplified by PSB-1K: a judge can be made sensitive to hidden physical risk, yet this sensitivity comes with severe over-blocking. Llama Guard 3-1B shows the complementary failure: as a content-safety guard, it accepts all safe examples but also misses the physical-danger class entirely. Table 4: Results on PhysicalSafetyBench-1K with Qwen2.5-3B (1,000 safe / 1,000 physical-danger examples; pair-wise 5-fold GroupKFold). PSB-1K removes direct harm keywords, so the unsafe class requires physicalcausal reasoning rather than content-danger cue detection. Method PRISM MLP LPM SVM-RBF Nearest Centroid Qwen2.5-3B Judge Llama Guard 3-1B
Acc±std (%)
PD det (%)
FPR (%)
F1
AUC
99.6±0.5 95.5±1.9 95.4 90.4±0.8 61.3 64.4 50.0
99.9 95.0 96.2 94.3 63.9 96.5 0.0
0.7 4.0 5.4 13.5 41.3 67.8 0.0
0.996 0.955 0.954 0.908 0.623 0.730 0.000
1.000 0.993 0.992 0.962 0.648 — —
The PSB-1K comparison separates two failure modes that are easy to conflate. Content-oriented guards have low false positives because they do not see a policy-violation phrase, but this also causes near-total under-detection of physical danger. LLM judges have the opposite problem: they can recognize many unsafe physical actions, but their uncertainty is expressed as broad rejection of normal household tasks. PRISM avoids both extremes because the probe is trained directly on hidden representations of paired physical-risk examples, while retaining a low-FPR decision boundary. Table 5: Cross-model PSB-1K operating points. PRISM remains calibrated across backbones, while zero-shot judges preserve high physical-danger recall only with high false-positive rates. Backbone Qwen2.5-3B Qwen2.5-7B Qwen2.5-14B Qwen2.5-32B Phi-3.5-mini SmolLM2-1.7B
PRISM Acc (%)
PRISM PD det (%)
PRISM FPR (%)
Judge PD det (%)
Judge FPR (%)
99.6 99.4 99.3 99.2 98.8 97.5
99.9 99.7 99.6 99.4 99.0 98.2
0.7 1.0 1.2 1.4 1.8 3.2
96.5 97.8 98.6 99.0 97.0 99.5
67.8 70.0 73.0 76.0 68.0 90.0
Table 5 extends the PSB-1K comparison to the model families used elsewhere in the paper. The key trend mirrors SafeAgentBench: PRISM’s selected-layer probe remains calibrated as scale and architecture change, while the judge becomes a high-recall but high-FPR detector. This matters because PSB-1K safe examples are ordinary household tasks; rejecting most of them would make high unsafe recall misleading. 5.5
C ROSS - ARCHITECTURE GENERALIZATION
The two-signal structure and PRISM’s operating point hold beyond the Qwen2.5 family. We repeat the full pipeline on two different architectures, Phi-3.5-mini (Abdin et al., 2024) and SmolLM211
1.7B (Ben Allal et al., 2025). The CDD/PDD probe-weight angle stays in the same range as Qwen2.5-3B (75.9◦ ), at 77.3◦ for Phi-3.5-mini and 71.1◦ for SmolLM2-1.7B (Figure 6a), so the content/physical separation is not specific to one model family. PRISM again jointly detects both danger types, reaching 86.2/87.7/82.7% accuracy and 81.3/86.6/77.0% physical-danger detection at 13.7/13.3/18.0% FPR for Qwen2.5-3B/Phi-3.5-mini/SmolLM2-1.7B (Table 6), whereas the CDDonly probe still collapses out-of-distribution on physical danger (19.8/38.0/25.7%; Figure 6b). An orthogonalisation check confirms that PDD carries variance not duplicated by CDD (< 1.5pp drop; Figure 6c), ruling out trivial duplication of the two axes. The judge comparison transfers as well and exposes a sharper small-scale failure: the SmolLM2-1.7B judge blocks 294/300 safe tasks (98.0% FPR), confirming that small instruct models are not viable stand-alone safety classifiers in this setting, while PRISM on the same backbone keeps FPR at 18.0%.
Figure 6: Cross-architecture universality of CDD/PDD. (a) CDD–PDD probe-weight angles cluster between 71◦ and 78◦ in all three architectures (Qwen2.5-3B 75.9◦ , SmolLM2-1.7B 71.1◦ , Phi-3.5-mini 77.3◦ ). (b) PRISM achieves 81/77/87% physical-danger detection while CDD-only collapses to 20/26/38%. (c) PDD’s unique variance survives orthogonalisation against CDD (< 1.5pp drop), ruling out trivial duplication. Historical label “SDD” ≡ CDD. Table 6: Cross-architecture PRISM and baseline results on SafeAgentBench (600 tasks; 5-fold CV), with architectures as columns and metrics as rows for readability. θmd /θpw are the mean-difference and probeweight CDD/PDD angles; CDD→PD, PDD→CD, and LPM→PD are out-of-distribution detection rates. The SmolLM2 LLM-judge blocks 294/300 safe tasks (FPR 98%)—small instruct models are not viable stand-alone safety classifiers in this setting.
5.6
Qwen2.5-3B
Phi-3.5-mini
SmolLM2-1.7B
Selected layer (sel./total) θmd (◦ ) θpw (◦ )
27/36 49.1 75.9
24/32 32.9 77.3
14/24 58.9 71.1
PRISM Acc±std (%) PRISM CD det (%) PRISM PD det (%) PRISM FPR (%)
86.2±2.4 93.8 81.3 13.7
87.7±3.1 92.0 86.6 13.3
82.7±2.2 93.8 77.0 18.0
CDD→PD (OOD, %) PDD→CD (OOD, %) LPM→PD (OOD, %)
19.8 68.1 11.2
38.0 67.3 27.8
25.7 71.7 13.9
Judge CD (%) Judge PD (%) Judge FPR (%)
98.2 86.6 27.3
99.1 90.9 29.7
100.0 100.0 98.0
S TATISTICAL COMPARISON AND EFFICIENCY
At matched FPR, PRISM is statistically indistinguishable from the same-scale judge in accuracy while requiring less analysis time. We use McNemar’s test for the paired 3B comparison between PRISM at the matched-FPR operating point and the cached 3B zero-shot judge. On the physical subset, χ2 = 1.94, p = 0.1637; on all 600 examples, χ2 = 0.56, p = 0.4557. Neither rejects equal accuracy: PRISM is statistically comparable to the judge while, at its default threshold, retaining a substantially lower FPR (Appendix Figure 8 shows the ROC and the matched-FPR operating point). Latency provides a secondary efficiency check: PRISM versus the judge averages 56.8 vs. 12
116.8 ms/sample at 7B (2.06×), 146.1 vs. 309.1 ms at 14B (2.12×), and 103.4 vs. 191.9 ms at 32B (1.86×); Table 7 reports the full latency distribution. Since PRISM needs only a forward pass while the judge generates, the setup favors PRISM by roughly a factor of two. We read these as a controlled local comparison rather than a hardware-general throughput claim: the benchmark fixes warmup/measured counts, prompt, and sequence length but not the exact GPU and software stack. 5.7
A BLATIONS
The ablations localize where PRISM’s advantage comes from: the right hidden-state layer and training on the full two-subtype boundary, not a more expressive classifier.
Figure 7: Per-layer PRISM 5-fold accuracy for Qwen2.5-3B/7B/14B/32B; circles mark the selected layer.
Figure 7 and the classifier ablations show the relevant representation is already close to linearly usable. SVM-RBF reaches 82.8%, 83.5%, 85.3%, and 86.0% accuracy across 3B–32B, and MLP reaches 83.0%, 82.5%, 82.7%, and 84.3%, yet PRISM’s logistic-regression probe remains the strongest or tied-strongest selected-layer classifier while being simpler, faster, and easier to calibrate. The gain is therefore not driven by a complex nonlinear classifier; it comes from using the appropriate hidden-state layer and training on the full safe/unsafe boundary that contains both danger subtypes. The direction ablations give the sharper evidence: CDD-only and LPM fail on physicalOOD detection, while PDD-only remains incomplete on content-OOD detection, and PRISM improves because it learns from the full binary label set (Figure 2 and Appendix Figure 9 visualize these errors and PRISM’s blocking decisions in the CDD/PDD plane). The dataset-level ablation comes from PSB-1K. By removing explicit harm words and making every unsafe item a physical-danger case, PSB-1K suppresses the easiest content-danger cues and forces methods to choose between three behaviours: miss the physical risk, over-block safe tasks, or learn a physically grounded signal. Llama Guard falls into the first regime, the Qwen judge into the second, and PRISM into the third. This supports the central design choice of the paper: embodied-agent safety should be evaluated and trained on physical danger directly, not treated as a side effect of content moderation. Taken together, the ablations support a focused conclusion: PRISM succeeds because embodiedsafety information is present in intermediate hidden states and is extractable by a simple linear probe, but only when the evaluation explicitly includes both content-danger and physical-danger failures. Single-axis baselines miss one side of the problem, zero-shot judges over-block safe tasks, and PSB-1K shows that physically grounded danger remains a distinct evaluation target even when the wording is benign.
6
C ONCLUSION
Embodied-agent safety is not identical to prior LLM text safety. We verify this through experimental hidden-state analysis: content-danger and physical-danger directions are separable beyond a random-split null on Qwen2.5-3B and show consistent angular patterns across larger Qwen2.5 models and two non-Qwen architectures. We also introduce PSB-1K, a contrastive physical-safety benchmark that removes direct content-danger cues and exposes the high-FPR behaviour of LLM 13
judges on physically grounded household tasks. PRISM turns this observation into a representationlevel method: a single-layer linear probe that detects both danger types, achieves 86.2–87.7% accuracy at 11.7–13.7% FPR across Qwen2.5-3B to 32B, replicates on SafeText and EARBench, and reaches 99.6% accuracy with 0.7% FPR on PSB-1K. The claim is deliberately bounded—PRISM is not a complete embodied-agent safety system, and the directions are separable rather than strictly orthogonal—but its contribution is clear: physical danger should be modeled as a distinct hiddenstate safety structure rather than as a supplement to text-safety judgment.
R EFERENCES Marah Abdin, Sam Ade Jacobs, Ammar Ahmad Awan, Jyoti Aneja, Ahmed Awadallah, Hany Awadalla, Nguyen Bach, Amit Bahree, Arash Bakhtiari, Harkirat Behl, et al. Phi-3 technical report: A highly capable language model locally on your phone. arXiv preprint arXiv:2404.14219, 2024. Michael Ahn, Anthony Brohan, Noah Brown, Yevgen Chebotar, Omar Cortes, Byron David, Chelsea Finn, Chuyuan Fu, Keerthana Gopalakrishnan, Karol Hausman, et al. Do as I can, not as I say: Grounding language in robotic affordances. arXiv preprint arXiv:2204.01691, 2022. Guillaume Alain and Yoshua Bengio. Understanding intermediate layers using linear classifier probes. arXiv preprint arXiv:1610.01644, 2016. Andy Arditi, Oscar Obeso, Aaquib Syed, Daniel Paleka, Nina Panickssery, Wes Gurnee, and Neel Nanda. Refusal in language models is mediated by a single direction. In Advances in Neural Information Processing Systems (NeurIPS), 2024. Yuntao Bai, Saurav Kadavath, Sandipan Kundu, Amanda Askell, Jackson Kernion, Andy Jones, Anna Chen, Anna Goldie, Azalia Mirhoseini, Cameron McKinnon, et al. Constitutional AI: Harmlessness from AI feedback. arXiv preprint arXiv:2212.08073, 2022. Yonatan Belinkov. Probing classifiers: Promises, shortcomings, and advances. Computational Linguistics, 48(1):207–219, 2022. Loubna Ben Allal, Anton Lozhkov, Elie Bakouch, Gabriel Martín Blázquez, Guilherme Penedo, Lewis Tunstall, Andrés Marafioti, Hynek Kydlíček, Agustín Piqueres Lajarín, Vaibhav Srivastav, et al. SmolLM2: When smol goes big – data-centric training of a small language model. arXiv preprint arXiv:2502.02737, 2025. Yonatan Bisk, Rowan Zellers, Ronan Le Bras, Jianfeng Gao, and Yejin Choi. PIQA: Reasoning about physical commonsense in natural language. In Proceedings of the AAAI Conference on Artificial Intelligence, 2020. Anthony Brohan, Noah Brown, Justice Carbajal, Yevgen Chebotar, Xi Chen, Krzysztof Choromanski, Tianli Ding, Danny Driess, Avinava Dubey, Chelsea Finn, et al. RT-2: Vision-language-action models transfer web knowledge to robotic control. arXiv preprint arXiv:2307.15818, 2023. Collin Burns, Haotian Ye, Dan Klein, and Jacob Steinhardt. Discovering latent knowledge in language models without supervision. In International Conference on Learning Representations (ICLR), 2023. Ruolin Chen et al. SafeMind: Benchmarking and mitigating safety risks in embodied LLM agents. arXiv preprint arXiv:2509.25885, 2025. Maciej Chrabaszcz, ˛ Filip Szatkowski, Bartosz Wójcik, Jan Dubiński, Tomasz Trzciński, and Sebastian Cygert. Efficient LLM moderation with multi-layer latent prototypes. arXiv preprint arXiv:2502.16174, 2025. Hoagy Cunningham, Aidan Ewart, Logan Riggs, Robert Huben, and Lee Sharkey. Sparse autoencoders find highly interpretable features in language models. In International Conference on Learning Representations (ICLR), 2024. 14
Danny Driess, Fei Xia, Mehdi S. M. Sajjadi, Corey Lynch, Aakanksha Chowdhery, Brian Ichter, Ayzaan Wahid, Jonathan Tompson, Quan Vuong, Tianhe Yu, et al. PaLM-E: An embodied multimodal language model. In International Conference on Machine Learning (ICML), 2023. Samuel Gehman, Suchin Gururangan, Maarten Sap, Yejin Choi, and Noah A. Smith. RealToxicityPrompts: Evaluating neural toxic degeneration in language models. In Findings of the Association for Computational Linguistics: EMNLP 2020, 2020. Shaona Ghosh, Prasoon Varshney, Erick Galinkin, and Christopher Parisien. AEGIS: Online adaptive AI content safety moderation with ensemble of LLM experts. arXiv preprint arXiv:2404.05993, 2024. Seungju Han, Kavel Rao, Allyson Ettinger, Liwei Jiang, Bill Yuchen Lin, Nathan Lambert, Yejin Choi, and Nouha Dziri. WildGuard: Open one-stop moderation tools for safety risks, jailbreaks, and refusals of LLMs. In Advances in Neural Information Processing Systems (NeurIPS) Datasets and Benchmarks Track, 2024. Wenlong Huang, Pieter Abbeel, Deepak Pathak, and Igor Mordatch. Language models as zero-shot planners: Extracting actionable knowledge for embodied agents. In International Conference on Machine Learning (ICML), 2022a. Wenlong Huang, Fei Xia, Ted Xiao, Harris Chan, Jacky Liang, Pete Florence, Andy Zeng, Jonathan Tompson, Igor Mordatch, Yevgen Chebotar, et al. Inner monologue: Embodied reasoning through planning with language models. In Conference on Robot Learning (CoRL), 2022b. Yuting Huang, Leilei Ding, Zhipeng Tang, Tianfu Wang, Xinrui Lin, Wuyang Zhang, Mingxiao Ma, and Yanyong Zhang. A framework for benchmarking and aligning task-planning safety in LLM-based embodied agents. arXiv preprint arXiv:2504.14650, 2025. Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, and Madian Khabsa. Llama guard: LLMbased input-output safeguard for human-AI conversations. arXiv preprint arXiv:2312.06674, 2023. Jiaming Ji, Borong Zhang, Jiayi Zhou, Xuehai Pan, Weidong Huang, Ruiyang Sun, Yiran Geng, Yifan Zhong, Juntao Dai, and Yaodong Yang. Safety-gymnasium: A unified safe reinforcement learning benchmark. In Advances in Neural Information Processing Systems (NeurIPS) Datasets and Benchmarks Track, 2023. Seungone Kim, Jamin Shin, Yejin Cho, Joel Jang, Shayne Longpre, Hwaran Lee, Sangdoo Yun, Seongjin Shin, Sungdong Kim, James Thorne, and Minjoon Seo. Prometheus: Inducing finegrained evaluation capability in language models. In International Conference on Learning Representations (ICLR), 2024. Eric Kolve, Roozbeh Mottaghi, Winson Han, Eli VanderBilt, Luca Weihs, Alvaro Herrasti, Daniel Gordon, Yuke Zhu, Abhinav Gupta, and Ali Farhadi. AI2-THOR: An interactive 3D environment for visual AI. arXiv preprint arXiv:1712.05474, 2017. Sharon Levy, Emily Allaway, Melanie Subbiah, Lydia Chilton, Desmond Patton, Kathleen McKeown, and William Yang Wang. SafeText: A benchmark for exploring physical safety in language models. In Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing (EMNLP), pp. 2407–2421, 2022. Kenneth Li, Oam Patel, Fernanda Viégas, Hanspeter Pfister, and Martin Wattenberg. Inferencetime intervention: Eliciting truthful answers from a language model. In Advances in Neural Information Processing Systems (NeurIPS), 2023. Jacky Liang, Wenlong Huang, Fei Xia, Peng Xu, Karol Hausman, Brian Ichter, Pete Florence, and Andy Zeng. Code as policies: Language model programs for embodied control. In IEEE International Conference on Robotics and Automation (ICRA), 2023. Aishan Liu, Zonghao Ying, Le Wang, Junjie Mu, Jinyang Guo, Jiakai Wang, Yuqing Ma, Siyuan Liang, Mingchuan Zhang, Xianglong Liu, and Dacheng Tao. AGENTSAFE: Benchmarking the safety of embodied agents on hazardous instructions. arXiv preprint arXiv:2506.14697, 2025. 15
Yang Liu, Dan Iter, Yichong Xu, Shuohang Wang, Ruochen Xu, and Chenguang Zhu. G-Eval: NLG evaluation using GPT-4 with better human alignment. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing (EMNLP), 2023. Llama Team, AI @ Meta. The llama 3 herd of models. arXiv preprint arXiv:2407.21783, 2024. Xiaoya Lu, Zeren Chen, Xuhao Hu, Yijin Zhou, Weichen Zhang, Dongrui Liu, Lu Sheng, and Jing Shao. IS-Bench: Evaluating interactive safety of VLM-driven embodied agents in daily household tasks. arXiv preprint arXiv:2506.16402, 2025. Samuel Marks and Max Tegmark. The geometry of truth: Emergent linear structure in LLM representations of true/false datasets. arXiv preprint arXiv:2310.06824, 2023. Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, David Forsyth, and Dan Hendrycks. HarmBench: A standardized evaluation framework for automated red teaming and robust refusal. In International Conference on Machine Learning (ICML), 2024. Minheng Ni, Lei Zhang, Zihan Chen, Kaixin Bai, Zhaopeng Chen, Jianwei Zhang, Lei Zhang, and Wangmeng Zuo. Don’t let your robot be harmful: Responsible robotic manipulation via safetyas-policy. arXiv preprint arXiv:2411.18289, 2024. Ike Obi, Vishnunandan L. N. Venkatesh, Weizheng Wang, Ruiqi Wang, Dayoon Suh, Temitope I. Amosa, Wonse Jo, and Byung-Cheol Min. SafePlan: Leveraging formal logic and chain-ofthought reasoning for enhanced safety in LLM-based robotic task planning. arXiv preprint arXiv:2503.06892, 2025. OpenAI. GPT-4 technical report. arXiv preprint arXiv:2303.08774, 2023. Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. Training language models to follow instructions with human feedback. In Advances in Neural Information Processing Systems (NeurIPS), 2022. Joon Sung Park, Joseph C. O’Brien, Carrie J. Cai, Meredith Ringel Morris, Percy Liang, and Michael S. Bernstein. Generative agents: Interactive simulacra of human behavior. In Proceedings of the 36th Annual ACM Symposium on User Interface Software and Technology (UIST), 2023. Kiho Park, Yo Joong Choe, and Victor Veitch. The linear representation hypothesis and the geometry of large language models. In International Conference on Machine Learning (ICML), 2024. Fabian Pedregosa, Gaël Varoquaux, Alexandre Gramfort, Vincent Michel, Bertrand Thirion, Olivier Grisel, Mathieu Blondel, Peter Prettenhofer, Ron Weiss, Vincent Dubourg, Jake Vanderplas, Alexandre Passos, David Cournapeau, Matthieu Brucher, Matthieu Perrot, and Édouard Duchesnay. Scikit-learn: Machine learning in Python. Journal of Machine Learning Research, 12: 2825–2830, 2011. Xavier Puig, Kevin Ra, Marko Boben, Jiaman Li, Tingwu Wang, Sanja Fidler, and Antonio Torralba. VirtualHome: Simulating household activities via programs. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2018. Qwen Team. Qwen2.5 technical report. arXiv preprint arXiv:2412.15115, 2024. Yangjun Ruan, Honghua Dong, Andrew Wang, Silviu Pitis, Yongchao Zhou, Jimmy Ba, Yann Dubois, Chris J. Maddison, and Tatsunori Hashimoto. Identifying the risks of LM agents with an LM-emulated sandbox. In International Conference on Learning Representations (ICLR), 2024. Manolis Savva, Abhishek Kadian, Oleksandr Maksymets, Yili Zhao, Erik Wijmans, Bhavana Jain, Julian Straub, Jia Liu, Vladlen Koltun, Jitendra Malik, Devi Parikh, and Dhruv Batra. Habitat: A platform for embodied AI research. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2019. 16
Pierre Sermanet, Anirudha Majumdar, Alex Irpan, Dmitry Kalashnikov, and Vikas Sindhwani. Generating robot constitutions & benchmarks for semantic safety. arXiv preprint arXiv:2503.08663, 2025. Noah Shinn, Federico Cassano, Edward Berman, Ashwin Gopinath, Karthik Narasimhan, and Shunyu Yao. Reflexion: Language agents with verbal reinforcement learning. In Advances in Neural Information Processing Systems (NeurIPS), 2023. Mohit Shridhar, Jesse Thomason, Daniel Gordon, Yonatan Bisk, Winson Han, Roozbeh Mottaghi, Luke Zettlemoyer, and Dieter Fox. ALFRED: A benchmark for interpreting grounded instructions for everyday tasks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2020. Ishika Singh, Valts Blukis, Arsalan Mousavian, Ankit Goyal, Danfei Xu, Jonathan Tremblay, Dieter Fox, Jesse Thomason, and Animesh Garg. ProgPrompt: Generating situated robot task plans using large language models. In IEEE International Conference on Robotics and Automation (ICRA), 2023. Chan Hee Song, Jiaman Wu, Clayton Washington, Brian M. Sadler, Wei-Lun Chao, and Yu Su. LLM-Planner: Few-shot grounded planning for embodied agents with large language models. In Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), 2023. Eric Todd, Millicent L. Li, Arnab Sen Sharma, Aaron Mueller, Byron C. Wallace, and David Bau. Function vectors in large language models. In International Conference on Learning Representations (ICLR), 2024. Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. Llama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288, 2023. Alexander Matt Turner, Lisa Thiergart, Gavin Leech, David Udell, Juan J. Vazquez, Ulisse Mini, and Monte MacDiarmid. Steering language models with activation engineering. arXiv preprint arXiv:2308.10248, 2023. Guanzhi Wang, Yuqi Xie, Yunfan Jiang, Ajay Mandlekar, Chaowei Xiao, Yuke Zhu, Linxi Fan, and Anima Anandkumar. Voyager: An open-ended embodied agent with large language models. arXiv preprint arXiv:2305.16291, 2023. Ning Wang, Zihan Yan, Weiyang Li, Chuan Ma, He Chen, and Tao Xiang. Advancing embodied agent security: From safety benchmarks to input moderation. arXiv preprint arXiv:2504.15699, 2025. Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. Jailbroken: How does LLM safety training fail? In Advances in Neural Information Processing Systems (NeurIPS), 2023. Shunyu Yao, Jeffrey Zhao, Dian Yu, Nan Du, Izhak Shafran, Karthik Narasimhan, and Yuan Cao. ReAct: Synergizing reasoning and acting in language models. In International Conference on Learning Representations (ICLR), 2023. Sheng Yin, Xianghe Pang, Yuanzhuo Ding, Menglan Chen, Yutong Bi, Yichen Xiong, Wenhao Huang, Zhen Xiang, Jing Shao, and Siheng Chen. SafeAgentBench: A benchmark for safe task planning of embodied LLM agents. arXiv preprint arXiv:2412.13178, 2024. Tongxin Yuan, Zhiwei He, Lingzhong Dong, Yiming Wang, Ruijie Zhao, Tian Xia, Lizhen Xu, Binglin Zhou, Fangqi Li, Zhuosheng Zhang, Rui Wang, and Gongshen Liu. R-Judge: Benchmarking safety risk awareness for LLM agents. In Findings of the Association for Computational Linguistics: EMNLP 2024, 2024. Wenjun Zeng, Yuchi Liu, Ryan Mullins, Ludovic Peran, Joe Fernandez, Hamza Harkous, Karthik Narasimhan, Drew Proud, Piyush Kumar, Bhaktipriya Radharapu, Olivia Sturman, and Oscar Wahltinez. ShieldGemma: Generative AI content moderation based on gemma. arXiv preprint arXiv:2407.21772, 2024. 17
Lianmin Zheng, Wei-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zi Lin, Zhuohan Li, Dacheng Li, Eric P. Xing, Hao Zhang, Joseph E. Gonzalez, and Ion Stoica. Judging LLM-as-a-judge with MT-Bench and chatbot arena. In Advances in Neural Information Processing Systems (NeurIPS), 2023. Zihao Zhu, Bingzhe Wu, Zhengyou Zhang, Lei Han, Qingshan Liu, and Baoyuan Wu. EARBench: Towards evaluating physical risk awareness for task planning of foundation model-based embodied AI agents. arXiv preprint arXiv:2408.04449, 2024. Andy Zou, Long Phan, Sarah Chen, James Campbell, Phillip Guo, Richard Ren, Alexander Pan, Xuwang Yin, Mantas Mazeika, Ann-Kathrin Dombrowski, et al. Representation engineering: A top-down approach to AI transparency. arXiv preprint arXiv:2310.01405, 2023a. Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J. Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043, 2023b.
A
A DDITIONAL FIGURES AND CROSS - ARCHITECTURE RESULTS
Beyond the main-text figures and tables, we present a broader set of analyses from earlier iterations of our pipeline. A.1
ROC ANALYSIS AND MATCHED -FPR OPERATING POINT
Figure 8: PRISM ROC analysis on Qwen2.5-3B (5-fold-CV out-of-fold probabilities). Left: overall safe-vsunsafe (AUC= 0.925); the LLM judge sits at (FPR 27.3%, TPR 86.6%), PRISM at matched FPR reaches TPR ≈ 91% (threshold τ ≈ 0.029). Right: physical-danger-only ROC (AUC= 0.901); at matched FPR PRISM detects 91.4% of physical-danger examples versus the judge’s 86.6%.
A.2
PRISM’ S DECISIONS IN THE CDD/PDD PROJECTION PLANE
Figure 9: PRISM blocking decisions at the matched-FPR threshold τ =0.35 on Qwen2.5-3B, projected onto CDD (horizontal) and PDD (vertical). Left: safe—47/300 blocked (15.7% FPR at this operating point). Middle: content danger—108/113 blocked. Right: physical danger—159/187 blocked. Physical-danger examples cluster in the high-PDD/low-CDD region, illustrating why CDD-only probes miss them. Historical axis labels “SDD”/“PGD” ≡ CDD/PDD.
18
A.3
L ATENCY BENCHMARK DETAILS
Table 7: Per-sample latency distribution (ms) for PRISM versus the same-scale zero-shot LLM judge on SafeAgentBench, measured with 20 warmup and 580 timed examples under an identical prompt. PRISM cost is one forward pass to the selected probe layer; judge cost is one generation pass (max_new_tokens=8). Speedup is the ratio of mean latencies. PRISM (ms)
LLM judge (ms)
Scale
mean±std
median
p95
mean±std
median
p95
Speedup
7B 14B 32B
56.8±11.2 146.1±19.0 103.4±0.9
61.3 156.9 103.2
64.4 158.9 105.3
116.8±29.1 309.1±60.5 191.9±25.8
114.6 321.3 206.4
147.7 364.3 216.6
2.06× 2.12× 1.86×
19