mlsanityData to 7 Oct 2026

Internal-State Probes Read the Situation, Not the Action: Three Negative Results for Pre-Action Misalignment Monitoring

arXiv 2606.30449 ↗First posted 29 Jun 2026cs.LGcited by 1

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

Probes on model internals could help monitor agentic systems if they identify harmful text or tool actions before those actions are generated. We ask when an internal readout supports this stronger pre-action claim, rather than merely describing the prompt, construction contrast, or current trajectory. We test three methods across three model families: a Qwen2.5-Coder-32B-Instruct fine-tune/base direction, Llama-3.1-8B-Instruct probes at the last token of unsafe prefills, and Gemma-3-27B-IT emotion-concept vectors used for projection and steering in a blackmail tool-action scenario. Across these cases, construction validity, semantic legibility, and steering effects do not become robust pre-action monitors: each is undercut by a generalization or specificity check. The Qwen direction separates fine-tune from base at AUC 1.000, yet crosses its threshold on 0/143 audited pre-assistant turn contexts and on 0/342 Qwen prefill rows where the model continues the unsafe trajectory. The Llama features decode prompt domain almost perfectly (AUC 0.999), while the best future-behavior probe reaches AUC 0.801 and only +5.1 pp accuracy lift over majority; single-source cross-domain transfer is non-positive on five of six ordered pairs. Gemma emotion projections are semantically meaningful, but a shared-prefix minimal pair has indistinguishable states before the first differing input, and steering specificity weakens against unrelated learned directions such as cats}, weather, sports, and geography. We contribute a methodology for converting internal-readout claims into pre-action tests, and report scoped negative results: monitor claims must survive both scenario/action generalization and concept-specificity controls. Code is released at https://github.com/maxf-zn/misalignment_monitoring

Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 20 of its 23 references that are in the map. First posted on arXiv 29 Jun 2026.

Builds on

20 of 23 references.

Closest ancestors · 2

Same direction, newest first

  1. 2025Agentic Misalignment: How LLMs Could Be Insider Threats5 Oct
  2. 2024Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training10 Jan

Other references · 18

  1. 2023Inference-Time Intervention: Eliciting Truthful Answers from a Language Modelcited by 1,259
  2. 2023Representation Engineering: A Top-Down Approach to AI Transparencycited by 1,239
  3. 2023Steering Llama 2 via Contrastive Activation Additioncited by 1,009
  4. 2023Large Language Models Cannot Self-Correct Reasoning Yetcited by 965
  5. 2023Steering Language Models With Activation Engineeringcited by 824
  6. 2022Discovering Latent Knowledge in Language Models Without Supervisioncited by 733
  7. 2023The Geometry of Truth: Emergent Linear Structure in Large Language Model Representations of True/False Datasetscited by 673
  8. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attackscited by 450
  9. 2024Sparse Feature Circuits: Discovering and Editing Interpretable Causal Graphs in Language Modelscited by 412
  10. 2024Alignment faking in large language modelscited by 316
  11. 2024Frontier Models are Capable of In-context Schemingcited by 252
  12. 2023Automatically Correcting Large Language Models: Surveying the landscape of diverse self-correction strategiescited by 236
6 more
  1. 2026Scaling Monosemanticity: Extracting Interpretable Features from Claude 3 Sonnetcited by 175
  2. 2023Linear Representations of Sentiment in Large Language Modelscited by 157
  3. 2024Analyzing the Generalization and Reliability of Steering Vectorscited by 130
  4. 2023How to Catch an AI Liar: Lie Detection in Black-Box LLMs by Asking Unrelated Questionscited by 82
  5. 2023Bypassing the Safety Training of Open-Source LLMs with Priming Attackscited by 48
  6. 2026Emotion Concepts and their Function in a Large Language Modelcited by 48

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 1.

1 paper.

  1. 2026Unsupervised Features Mining via Activation Geometrycited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026INTENT-AS-A-TOOL Makes it Easy to Track Agentic Misalignment
  2. 2026Readable Before Actionable: Causal Tracing of Indirect Prompt Injection
  3. 2026Agent Safety From Within: Detecting Harmful Trajectories from LLM Internal States
  4. 2026Probing the Misaligned Thinking Process of Language Models
  5. 2026Model Forensics: Investigating Whether Concerning Behavior Reflects Misalignment
  6. 2026When Actions Go Off-Task: Detecting and Correcting Misaligned Actions in Computer-Use Agents
  7. 2026AgentBoundary: Counterfactual Evaluation of Safety in Tool-Using LLM Agents
  8. 2026PreAct-Bench: Benchmarking Predictive Monitoring in LLMs