arXiv: CVP monitor reads priority conflicts directly from language model activations

Researchers Tong Che and Rui Wu have published a framework claiming that internal priority conflicts within a language model can be tracked directly from activations — without reading a single generated token. The framework, called Constitutional Value Potentials (CVP), introduces scalar values learned from model hidden states that represent the internal “pressure” to preserve a given constitutional value. The key observation is sharp: output text is the least reliable witness precisely at moments when two values conflict and the model must sacrifice one — and not every model that verbally cites a value genuinely respects its priority.

Priority margin as a measure of internal stance

For each constitutional value, CVP learns a scalar potential from the model’s hidden states. The critical monitoring distinction is this: the potential is not supervised by the prompt itself, but by an independent judge evaluating what the model actually preserved in its response — not what it claimed to value. The signed difference of two potentials forms a priority margin. A constitutional clause is considered satisfied as long as the margin remains positive; once it falls below zero, the monitor flags a potential violation. The entire detection mechanism operates without the monitor reading a single output token from the model — detection lives exclusively in activation space.

Can the monitor flag a violation before the response is complete?

Yes. The signal appears at the tail of the input prompt and the first response token. This means a potential violation is visible while the model is still generating text — preventive detection rather than post-hoc analysis of a finished response. For adversarial scenarios this is especially important. Previous red-teaming tools have mostly answered the question of whether a prompt looks adversarial. CVP poses a different, more precise diagnosis: did an adversarial attempt actually shift the model’s internal priority margin toward a violation, or did the model remain stable despite the adversarial framing? These are two entirely different situations, yet output analysis does not distinguish them reliably.

AUROC 0.95 and generalization to novel conflicts

The monitor achieves AUROC up to 0.95 in detecting value conflicts and outperforms strong probe methods based on hidden states. Experiments cover three scales of Qwen2.5 models, and generalization is tested on held-out synthetic conflicts not seen during training. This is a critical requirement for practical deployment: in real-world settings the actual value conflicts are not known in advance, so a monitor that only works on seen patterns has limited operational value. Results on the held-out set suggest that CVP captures a structural characteristic of priority relationships in activation space, rather than a surface correlation with training patterns.

The same activations for intervention and control

Beyond detection, the authors test activation steering: moving along activation directions associated with a given value shifts the model’s estimated trade-off decisions in the desired direction. The authors describe this as a proof of concept rather than a production-ready tool — but the finding is conceptually important. The distinction between a signal that predicts behavior and a direction that changes that behavior indicates that activation space contains structured, not random, representations relevant to priority decisions. This potentially makes CVP a control mechanism, not just a diagnostic one.

Relevance for red-teaming and Constitutional AI

CVP simultaneously addresses several active research threads. For Constitutional AI as a method: the framework provides a measurable signal of how well a constitution has been internalized in model representations, rather than assessing this solely from verbal behavior on a test. For alignment monitoring: tracking the priority margin offers a proactive signal that does not depend on the final output. For red-teaming: the difference between a prompt that looks adversarial and one that actually shifts the internal priority becomes a quantified value.

The authors stress epistemic precision: CVP does not claim that models have values in a philosophical sense. The finding is that activation space contains signals that co-vary with the model’s priority decisions, and that these signals can be learned, monitored, and used for early warning. CVP requires no weight modifications and is applicable as an external monitor over any system that exposes hidden states. The paper is published on arXiv with transparently documented methodology and metrics, available to the research community for independent reproduction and further development.