---
title: "当语言无害但行为致命：在隐态风险空间中探测超越文本安全的物理危险"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2607.15218v1"
permalink: "https://feed.astralor.com/items/itm_209867803e56e3802153ccca"
published: "2026-07-16T17:20:38.000Z"
score: 79
channel: "ai"
tags: ["Phi-3.5","PRISM","Qwen2.5","SmolLM2","具身智能安全","隐态安全探测"]
---

# 当语言无害但行为致命：在隐态风险空间中探测超越文本安全的物理危险

## AI 点评

> 这篇论文直击LLM具身化中的核心安全盲点：文本无害不代表行为安全。PRISM探针仅依赖一层逻辑回归，却显著优于大语言模型法官，实用性极强。对从事机器人、自动驾驶、AI Agent安全的研究者而言，是必读工作。它提供了一个全新的表征级检测范式，有望取代传统的纯文本审核。

## 速览

本文揭示大语言模型作为具身Agent规划器时，物理危险（PD）与文本内容危险（CD）在隐态表征中形成可分离信号。基于此，提出单层L2正则化逻辑探针PRISM，在SafeAgentBench上达到86.2-87.7%准确率及11.7-13.7%假阳性率，显著优于同规模LLM法官（24.7-39.0%假阳性率）。同时构建无直接伤害关键词的对比基准PSB-1K，PRISM达到99.6%准确率、0.7%假阳性率，而Qwen2.5-3B法官误拒67.8%安全任务。实验在SafeText和EARBench上复现，表明隐态探测可作为文本审核之外的物理安全表征级方法。

## 关键点

- 通过隐态方向分析和随机分割零假设检验，证明LLM表征中物理危险与文本内容危险是可分离的。
- 提出PRISM探针，仅需单层逻辑回归，在SafeAgentBench上以低假阳性率实现高准确率安全检测。
- 构建PSB-1K对比基准，去除直接伤害关键词，测试模型对物理危险而非显式不安全用语的感知能力。
- PRISM在多个模型和基准上复现，证明隐态探测可推广为物理安全的表征级通用方法。

## 全文

Large language models (LLMs) increasingly serve as high-level planners for embodied agents, where linguistically benign instructions can become unsafe once grounded in the physical world. We study whether this physically grounded danger is the same safety problem as ordinary text-level content danger. Through hidden-state direction analysis and random-split null tests, we show that content danger (CD) and physical danger (PD) form separable signals in LLM representations across Qwen2.5-3B/7B/14B/32B, Phi-3.5 and SmolLM2. Building on the CD/PD separability, we propose PRISM, a single-layer L2-regularized logistic probe over full hidden states. PRISM achieves 86.2--87.7\% accuracy on SafeAgentBench with 11.7--13.7\% FPR, while same-scale LLM judges over-block safe tasks at 24.7--39.0\% FPR. We further introduce PhysicalSafetyBench-1K (PSB-1K), a contrastive benchmark of 1{,}000 physical-risk pairs without direct harm keywords, to test whether methods detect physically grounded danger rather than explicit unsafe wording. On PSB-1K, PRISM reaches 99.6\% accuracy and 0.7\% FPR, whereas a Qwen2.5-3B judge rejects 67.8\% of safe tasks. PRISM also replicates on SafeText and EARBench, supporting hidden-state probing as a representation-level method for physical safety beyond text moderation.

---

引用前请核对原文;本文由星际流动整理:https://feed.astralor.com/items/itm_209867803e56e3802153ccca