---
title: "When Words Are Safe But Actions Kill: Probing Physical Danger Beyond Text Safety in Hidden-State Risk Space"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2607.15218v1"
permalink: "https://feed.astralor.com/items/itm_209867803e56e3802153ccca"
published: "2026-07-16T17:20:38.000Z"
score: 79
channel: "ai"
tags: ["Phi-3.5","PRISM","Qwen2.5","SmolLM2","Embodied AI safety","Hidden-state safety probing"]
---

# When Words Are Safe But Actions Kill: Probing Physical Danger Beyond Text Safety in Hidden-State Risk Space

## AI commentary

> This paper hits the core safety blind spot in LLM embodiment: text safety does not guarantee action safety. PRISM, a single-layer logistic probe, outperforms LLM judges by a large margin, offering strong practical value. It is a must-read for researchers working on robotics, autonomous driving, and AI agent safety, providing a new representation-level detection paradigm that could replace traditional text-based moderation.

## At a glance

This paper reveals that physical danger (PD) and content danger (CD) form separable signals in LLM hidden-state representations when LLMs serve as planners for embodied agents. It proposes PRISM, a single-layer L2-regularized logistic probe, achieving 86.2–87.7% accuracy and 11.7–13.7% FPR on SafeAgentBench, outperforming same-scale LLM judges (24.7–39.0% FPR). It also introduces PhysicalSafetyBench-1K (PSB-1K), a contrastive benchmark without explicit harm keywords, where PRISM attains 99.6% accuracy and 0.7% FPR, while a Qwen2.5-3B judge wrongly rejects 67.8% safe tasks. Results replicate on SafeText and EARBench, supporting hidden-state probing as a representation-level method for physical safety beyond text moderation.

## Key points

- Hidden-state direction analysis and random-split null tests show that physical danger (PD) and content danger (CD) are separable signals in LLM representations.
- PRISM, a single-layer logistic probe, achieves high accuracy with low false positive rate on SafeAgentBench.
- PSB-1K benchmark eliminates direct harm keywords to test physical danger detection beyond explicit unsafe wording.
- PRISM replicates across multiple models and benchmarks, suggesting hidden-state probing as a general representation-level method for physical safety.

## Full text

Large language models (LLMs) increasingly serve as high-level planners for embodied agents, where linguistically benign instructions can become unsafe once grounded in the physical world. We study whether this physically grounded danger is the same safety problem as ordinary text-level content danger. Through hidden-state direction analysis and random-split null tests, we show that content danger (CD) and physical danger (PD) form separable signals in LLM representations across Qwen2.5-3B/7B/14B/32B, Phi-3.5 and SmolLM2. Building on the CD/PD separability, we propose PRISM, a single-layer L2-regularized logistic probe over full hidden states. PRISM achieves 86.2--87.7\% accuracy on SafeAgentBench with 11.7--13.7\% FPR, while same-scale LLM judges over-block safe tasks at 24.7--39.0\% FPR. We further introduce PhysicalSafetyBench-1K (PSB-1K), a contrastive benchmark of 1{,}000 physical-risk pairs without direct harm keywords, to test whether methods detect physically grounded danger rather than explicit unsafe wording. On PSB-1K, PRISM reaches 99.6\% accuracy and 0.7\% FPR, whereas a Qwen2.5-3B judge rejects 67.8\% of safe tasks. PRISM also replicates on SafeText and EARBench, supporting hidden-state probing as a representation-level method for physical safety beyond text moderation.

---

Verify against the original before citing; curated by Astral Feed: https://feed.astralor.com/items/itm_209867803e56e3802153ccca