When Words Are Safe But Actions Kill: Probing Physical Danger Beyond Text Safety in Hidden-State Risk Space
Weimeng Wang, Ziqiang Wang, Zihang Zhan, Chuanpu Fu, Qi Li, Ke Xu
Why It Matters
What makes this one worth your time
Understanding the difference between text-based safety and real-world risks is crucial for the safe deployment of AI systems in physical environments.
This research reveals how language model instructions can lead to physical dangers, proposing a novel detection method.
Summary
The paper investigates the distinction between content danger and physical danger in large language models, proposing a method called PRISM to effectively identify physical risks in grounded actions, supported by experimental results on new benchmarks.
Key contributions
- Development of PRISM, a logistic probe for detecting physical danger in LLMs.
- Introduction of the PhysicalSafetyBench-1K benchmark for evaluating physical risk detection.
- Demonstration of the separability of content danger and physical danger in LLM representations.
Notable insights
- The study introduces a hidden-state direction analysis to differentiate between content danger and physical danger in LLMs.
- The creation of the PhysicalSafetyBench-1K benchmark allows for a more nuanced evaluation of physical risk detection beyond traditional text moderation.
Possible limitations
- Not stated in the abstract.
Abstract
arXiv:2607.15218v1 Announce Type: new Abstract: Large language models (LLMs) increasingly serve as high-level planners for embodied agents, where linguistically benign instructions can become unsafe once grounded in the physical world. We study whether this physically grounded danger is the same safety problem as ordinary text-level content danger. Through hidden-state direction analysis and random-split null tests, we show that content danger (CD) and physical danger (PD) form separable signals in LLM representations across Qwen2.5-3B/7B/14B/32B, Phi-3.5 and SmolLM2. Building on the CD/PD separability, we propose PRISM, a single-layer L2-regularized logistic probe over full hidden states. PRISM achieves 86.2--87.7\% accuracy on SafeAgentBench with 11.7--13.7\% FPR, while same-scale LLM judges over-block safe tasks at 24.7--39.0\% FPR. We further introduce PhysicalSafetyBench-1K (PSB-1K), a contrastive benchmark of 1{,}000 physical-risk pairs without direct harm keywords, to test whether methods detect physically grounded danger rather than explicit unsafe wording. On PSB-1K, PRISM reaches 99.6\% accuracy and 0.7\% FPR, whereas a Qwen2.5-3B judge rejects 67.8\% of safe tasks. PRISM also replicates on SafeText and EARBench, supporting hidden-state probing as a representation-level method for physical safety beyond text moderation.