6 papers
Prompted to Discriminate: Generalizing Malicious-Input Probes in the Wild
Elad David, Max Fomin
LLM agents increasingly rely on activation probes as runtime monitors for prompt injection, jailbreaks, and unsafe requests, reading the model's own hidden state to catch a harmful…
Latent Undertow: How Ordinary Typos Break Probes
Elad David, Max Fomin, Amit LeVi
LLMs handle ordinary typing variation fluently: a typo or missing punctuation leaves both user intent and the model's response substantively unchanged. Yet probes that detect malic…
Context Is King: How In-Context Specification Shapes the Geometry of Concepts
Elad David, Max Fomin
Large language models place structured concepts on geometrically faithful manifolds: weekdays lie on a circle, months on another, usually taken to be a fixed world-model the networ…
Unsupervised Features Mining via Activation Geometry
Amit LeVi, Elad David, Max Fomin
Interpretability methods aim to reveal the features represented inside large language models (LLMs). Many existing methods begin with labeled examples of a human-defined concept th…
Internal-State Probes Read the Situation, Not the Action: Three Negative Results for Pre-Action Misalignment Monitoring
Max Fomin, Elad David, Amit LeVi
Probes on model internals could help monitor agentic systems if they identify harmful text or tool actions before those actions are generated. We ask when an internal readout suppo…
When Benchmarks Lie: Evaluating Malicious Prompt Classifiers Under True Distribution Shift
Max Fomin
Detecting prompt injection, jailbreak attacks, and harmful requests is critical for deploying LLM-based agents safely, yet current evaluation practices in this literature overestim…