Internal-State Probes Read the Situation, Not the Action: Three Negative Results for Pre-Action Misalignment Monitoring

Technical Summary: Internal-State Probes Read the Situation, Not the Action

Problem Statement
The paper addresses the feasibility of using internal-state probes to monitor agentic AI systems for misaligned behavior before harmful actions (such as tool calls or unsafe text generation) are executed. While recent work has demonstrated that linear directions and probes can distinguish between aligned and misaligned models or decode specific concepts, a critical methodological gap remains: do these internal readouts support a strong pre-action claim? Specifically, can a probe trained on a construction contrast (e.g., base model vs. fine-tuned misaligned model) reliably identify the imminent generation of a misaligned action in a new, in-context trajectory, rather than merely describing the current prompt, the construction dataset, or the general trajectory stage?

The authors argue that for a probe to serve as a robust safety monitor, it must survive two distinct failure modes:

1. Scenario Generalization: The feature must activate in the target agentic scenario (e.g., tool-mediated actions) if it was extracted from a different context (e.g., text-only stories).
2. Concept Specificity: The feature must be causally or specifically related to the misaligned behavior, rather than being a general correlate of the surrounding situation or a property of any learned direction.

Methodology
The study evaluates three distinct families of probes across three model families (Qwen2.5-Coder-32B, Llama-3.1-8B, and Gemma-3-27B), applying specific "monitor-relevant" tests to each:

1. Disposition Directions (Qwen2.5-Coder-32B):

   • Construction: A unit difference-of-means vector ($d_\ell$) is computed between a misaligned fine-tune (Qwen-Coder-Insecure) and its base model at layer 24.
   • Test: The authors check if the base model's hidden states cross the construction-set midpoint threshold ($\tau$) before it generates misaligned actions in multi-turn audits and behavioral prefill contexts.
   • Metric: Threshold crossing rate (0/143 pre-action contexts).

2. Behavioral Prefill Probes (Llama-3.1-8B):

   • Construction: A logistic regression classifier is trained on hidden states at the last token of a partially pre-filled assistant response to predict whether the model will continue a misaligned trajectory or correct it.
   • Test: Evaluation of predictive accuracy (AUC, accuracy lift over majority baseline) and single-source cross-domain transfer (training on one domain, e.g., medical, testing on another, e.g., legal).
   • Metric: AUC and accuracy lift; transfer performance across ordered domain pairs.

3. Emotion-Concept Vectors (Gemma-3-27B-IT):

   • Construction: Difference-of-means vectors extracted from emotion-tagged stories, denoised via neutral-PCA, and used for projection readouts and activation steering.
   • Test:
     • Descriptive: Do projections track transcript stages semantically?
     • Predictive (Minimal Pair): Do hidden states differ before the first differing input in transcripts that later diverge behaviorally?
     • Specificity (Steering): Does steering with emotion vectors change action rates (blackmail attempts) more than steering with random vectors or learned semantic controls (cats, weather, sports, geography)?
   • Metric: Blackmail rate changes under matched-norm steering; cross-model consistency (tested on Qwen3-32B).

Key Results
The paper reports three "negative results," indicating that these natural probe families fail to function as robust pre-action monitors under the specified tests:

• Disposition Directions Fail to Generalize: While the Qwen fine-tune/base direction perfectly separates the construction populations (AUC 1.000), it never crosses its threshold in pre-action contexts. In 143 pre-assistant turn contexts from misaligned multi-turn transcripts and 342 prefill rows where the model continued an unsafe trajectory, the activation remained below the decision boundary. The direction describes the population (base vs. fine-tune) but does not light up when the base model drifts into misalignment in-context.
• Prefill Probes Show Small, Non-Transferable Signals: The Llama prefill probes can predict future continuation vs. correction with a modest lift (+5.1 percentage points over majority baseline, AUC 0.801). However, this signal is domain-bound. Single-source cross-domain transfer resulted in non-positive lifts on five of six domain pairs. Furthermore, the same hidden states decode prompt domain content with near-perfect accuracy (AUC 0.999), suggesting the probe reads the situation (domain) rather than the specific action intent.
• Emotion Vectors Lack Specificity: While emotion projections are semantically meaningful (tracking transcript stages) and steering can alter blackmail rates, the effects are not specific to emotion. Learned directions for unrelated topics (cats, weather, sports, geography) and even random Gaussian vectors produced significant changes in action rates. Additionally, in a minimal-pair test, hidden states were indistinguishable before the first differing input, ruling out pre-cue prediction. Cross-model checks on Qwen3-32B further weakened the specificity claims.

Contributions

1. Methodological Framework: The authors propose a rigorous methodology for converting internal-readout claims into pre-action tests, emphasizing the need for both scenario generalization and concept-specificity controls.
2. Scoped Negative Results: The paper provides a synthesis of negative results across three major model families and three probe types, demonstrating that current "natural" probe families do not yield robust pre-action signals.
3. Enhanced Controls: The study introduces learned semantic controls (e.g., cats, weather) for steering experiments, arguing that random-vector controls are insufficient to establish emotion-specific mechanisms.
4. Open Adaptation: An open-weight adaptation of the emotion-concept approach (Sofroniew et al., 2026) is released, including the new control directions.

Significance and Claims
The paper's primary significance is modest and negative: it does not claim that no internal pre-action signal exists. Instead, it demonstrates that the specific classes of probes currently popular in the literature (contrastive directions, prefill classifiers, and emotion-concept vectors) do not support strong pre-action monitoring claims when subjected to generalization and specificity checks.

The authors conclude that these probes tend to "read the situation, not the action." They successfully distinguish between populations or decode context but fail to predict the next misaligned action in a generalizable, specific manner. The paper asserts that for a monitor to be viable, it must survive both the generalization to the target agentic scenario and the specificity controls against unrelated learned directions. The failure of these natural probe families suggests that current linear readout techniques may be insufficient for the "stronger pre-action claim" required for real-time safety monitoring of agentic systems.