When Words Are Safe But Actions Kill: Probing Physical Danger Beyond Text Safety in Hidden-State Risk Space

2026-07-16

AI Summary

This work addresses the underexplored risk that semantically innocuous instructions can induce physically hazardous behaviors when large language models (LLMs) serve as high-level planners for embodied agents, and investigates whether such physical risks share a common origin with conventional textual harms. The study reveals, for the first time, that representations of these two risk types are linearly separable in LLM hidden states. Building on this insight, the authors propose PRISM—a novel detection paradigm that eschews reliance on harmful keywords by leveraging directional analysis of hidden states and a randomized split null hypothesis test to construct a single-layer L2-regularized logistic probe. Evaluated across multiple model scales—including Qwen2.5, Phi-3.5, and SmolLM2—PRISM significantly outperforms similarly sized LLM-based judges on SafeAgentBench (86.2–87.7% accuracy) and the newly introduced PSB-1K benchmark (99.6% accuracy), while demonstrating strong generalization on SafeText and EARBench.

Abstract

Large language models (LLMs) increasingly serve as high-level planners for embodied agents, where linguistically benign instructions can become unsafe once grounded in the physical world. We study whether this physically grounded danger is the same safety problem as ordinary text-level content danger. Through hidden-state direction analysis and random-split null tests, we show that content danger (CD) and physical danger (PD) form separable signals in LLM representations across Qwen2.5-3B/7B/14B/32B, Phi-3.5 and SmolLM2. Building on the CD/PD separability, we propose PRISM, a single-layer L2-regularized logistic probe over full hidden states. PRISM achieves 86.2--87.7\% accuracy on SafeAgentBench with 11.7--13.7\% FPR, while same-scale LLM judges over-block safe tasks at 24.7--39.0\% FPR. We further introduce PhysicalSafetyBench-1K (PSB-1K), a contrastive benchmark of 1{,}000 physical-risk pairs without direct harm keywords, to test whether methods detect physically grounded danger rather than explicit unsafe wording. On PSB-1K, PRISM reaches 99.6\% accuracy and 0.7\% FPR, whereas a Qwen2.5-3B judge rejects 67.8\% of safe tasks. PRISM also replicates on SafeText and EARBench, supporting hidden-state probing as a representation-level method for physical safety beyond text moderation.

Problem

• physical danger
• text safety
• embodied agents
• hidden-state representations
• safety alignment

Innovation

• physical safety
• hidden-state probing
• content danger vs physical danger
• PRISM
• embodied agents