WHEN WORDS ARE SAFE BUT ACTIONS KILL: PROB-ING PHYSICAL DANGER BEYOND TEXT SAFETY IN HIDDEN-STATE RISK SPACE
This paper explores how language models can sometimes give safe-sounding instructions that lead to dangerous actions in the real world. It highlights the importance of distinguishing between words that seem safe and actions that can cause harm.
This video presentation explains the key concepts from the paper in plain language.
Content & Liability Disclaimer
This article and its accompanying video are automated summaries derived from the original research paper by Unknown authors. The original research was conducted solely by the paper's authors; PDFdigest did not conduct any of the research and makes no claims of ownership over the underlying scientific work.
The video narration is generated by artificial intelligence and references the paper's authors for attribution. The video is not narrated by any of the paper's authors. This content may contain inaccuracies, omissions, or misinterpretations of the original research. First-person language (e.g., "we found", "our results") reflects the original authors' voice, not PDFdigest's. Always read the original paper for accurate, verified information before making any decisions based on this content.
This content is provided "as is" without any warranties, express or implied. Simulated systems OÜ, its officers, directors, employees, and agents shall not be liable for any direct, indirect, incidental, special, consequential, or punitive damages arising from your use of, reliance on, or access to this content, including but not limited to errors, omissions, or misinterpretations of the original research. This disclaimer applies to the fullest extent permitted by applicable law.
- 1 These findings are consistent with the linear representation hypothesis and the emergent linear geometry of LLM features.
- 2 Linear probes are widely used to examine whether intermediate representations encode conceptual information.
- 3 The goal is to show that embodied physical safety is a distinct modeling target that requires explicit representation-level treatment.
- 4 We define classmean directions at layer L to analyze whether CD and PD are encoded by the same representational signal.
Introduction
LLMs translate natural-language instructions into executable subtasks or action plans for physical environments in both modular LLM+VLM systems and Vision-Language-Action (VLA) models. This creates a safety problem different from ordinary text moderation.
Some instructions are unsafe due to harmful wording, which we call content danger (CD).
Other instructions are unsafe due to physical causality, which we call physical danger (PD).
The ablations clarify why this signal cannot be reduced to a single content-danger direction: CDD-only achieves strong in-domain content detection, but its physical-OOD detection collapses to 19.8%, 31.6%, 32.6%, and 31.6% across 3B-32B, and LPM shows the same failure mode.
Research Question
These findings are consistent with the linear representation hypothesis and the emergent linear geometry of LLM features.
Methodology
Large language models (LLMs) are widely used for high-level task understanding and task decomposition in embodied agents. Smaller judges are unreliable, and fine-tuning a separate small model requires substantial task-specific safety data.
Study Design
We built a hidden state space based analysis framework to analyse unsafe action plans on resource constrained embodied devices.
PRISM uses a single-layer L2regularized logistic-regression probe over middle-to-late hidden states to classify instruction safety while learning from both danger sources.
How PDFdigest Helps You Understand Research
Instant Paper Analysis
Get structured summaries and key findings from dense PDFs in seconds.
Visual Explanations
Turn complex methods, figures, and results into clearer visual breakdowns.
AI-Powered Q&A
Ask focused questions and get answers grounded in the paper.
Results & Findings
We demonstrate that physical safety is a distinct modeling problem for embodied agents rather than merely a text-classification problem. These failures suggest that physically dangerous actions should not be treated as ordinary unsafe text or a single generic unsafe direction.
- We demonstrate that physical safety is a distinct modeling problem for embodied agents rather than merely a text-classification problem.
- These failures suggest that physically dangerous actions should not be treated as ordinary unsafe text or a single generic unsafe direction.
- We find that physical danger actions exhibit distinct distributional characteristics and differ from content danger by constructing data pairs and analysing LLM hiddenlayer states.
- We estimate a content-danger direction (u CDD) and a physical-danger direction (u PDD) across Qwen2.5-3B\/7B\/14B\/32B.
- The directions remain separated with probe-weight angles in the low-to-mid 70 \u2022 range, and the Qwen2.5-3B result is well above a size-matched random-split null.
Linear probes are widely used to examine whether intermediate representations encode conceptual information.
The goal is to show that embodied physical safety is a distinct modeling target that requires explicit representation-level treatment.
Figures Explained
The paper’s visual material highlights the workflow and the main system components.
- Figure 1: Embodied agents require a physical-safety question in addition to text-safety moderation.. This figure illustrates the distinction between content danger and physical danger, emphasizing the need for a separate safety analysis in embodied agents.
Conclusion
PRISM gives the most reliable overall operating point across the Qwen2.5 family, detecting both danger types while holding false positives low. Embodied safety is therefore not captured by a purely content-oriented axis, and prototype distance alone is insufficient for the two-subtype problem.
The central comparison is therefore not that PRISM simply dominates large judges in recall.
Taken together, the ablations support a focused conclusion: PRISM succeeds because embodiedsafety information is present in intermediate hidden states and is extractable by a simple linear probe, but only when the evaluation explicitly includes both content-danger and physical-danger failures.
Frequently Asked Questions
Some instructions are unsafe due to harmful wording, which we call content danger (CD). These findings are consistent with the linear representation hypothesis and the emergent linear geometry of LLM features.
Large language models (LLMs) are widely used for high-level task understanding and task decomposition in embodied agents. 5.4 PHYSICALSAFETYBENCH-1K: PHYSICALLY GROUNDED DANGER WITHOUT CONTENT CUES PSB-1K is designed to answer a different question from ordinary moderation benchmarks: can a method detect unsafe.
Linear probes are widely used to examine whether intermediate representations encode conceptual information. The goal is to show that embodied physical safety is a distinct modeling target that requires explicit representation-level treatment.
Embodied safety is therefore not captured by a purely content-oriented axis, and prototype distance alone is insufficient for the two-subtype problem. The central comparison is therefore not that PRISM simply dominates large judges in recall.
The ablations clarify why this signal cannot be reduced to a single content-danger direction: CDD-only achieves strong in-domain content detection, but its physical-OOD detection collapses to 19.8%, 31.6%, 32.6%, and 31.6% across 3B-32B, and LPM shows the same failure mode even more.
This paper explores how language models can sometimes give safe-sounding instructions that lead to dangerous actions in the real world. It highlights the importance of distinguishing between words that seem safe and actions that can cause harm.