arXiv:2607.15218: When Words Are Safe But Actions Kill — PRISM Separates Physical Danger from Text

Why can text be “safe” but an action dangerous?

Weimeng Wang and colleagues show that classic text-safety checks don’t catch the risk when a language model controls a physical agent — a robot or system that carries out actions in the real world. By analyzing the hidden-state space (hidden state, the internal numerical representations a model builds while processing input) on the Qwen2.5, Phi-3.5, and SmolLM2 models, the team shows that “content danger” (danger of the text’s content) and “physical danger” (danger of the action) are two separable signals within the network, not the same phenomenon measured twice.

The PRISM method

PRISM exploits that separability and classifies risk directly from the model’s internal activations, instead of relying on textual judgment. On the SafeAgentBench benchmark, the method achieves 86.2-87.7% accuracy with a false positive rate (FPR — the percentage of safe tasks wrongly flagged as dangerous) of 11.7-13.7%.

Results versus a standard LLM judge

The standard approach, an LLM-judge (a language model that itself judges the safety of another model based on text), over-blocks safe tasks in the same test, with a 24.7-39.0% FPR — two to three times the error rate of PRISM. The difference is even more pronounced on the new PhysicalSafetyBench-1K benchmark, which contains 1,000 contrastive task pairs: there, PRISM achieves 99.6% accuracy with just 0.7% FPR, while Qwen2.5-3B as judge rejects as many as 67.8% of tasks that are actually safe.

Why it matters

The gap between 0.7% and 67.8% in false rejection rates shows that textual judgment alone isn’t sufficient for agents operating in the physical world. PRISM suggests that the safety layer needs to look at the model’s internal state, not just the generated text, before an agent carries out a potentially dangerous action.