We have 4 of 4 papers
We haven’t gathered this author’s papers yet. Follow them and we’ll fetch their work.
Not the right person? Other researchers publish under this name.
LLM agents increasingly rely on activation probes as runtime monitors for prompt injection, jailbreaks, and unsafe requests, reading the model's own hidden state to catch a harmful input before the agent acts on it. A cheap, increasingly common move, borrowed from LLM-as-judge prompting, is to append a short classifica...
A KV-cache fork is introduced for single-position probes: a short fixed suffix appended after the user message lets the probe read a few tokens downstream of the perturbation, exploiting its rapid spatial decay.
The same method is used to select the best training datasets for prompt-injection classifier probes: while similarity between ordinary activations is almost unrelated to downstream performance, RFD-based similarity achieves Top-1 and Top-2 accuracy.
This work shows that context is king: the structure a model actually uses is set by the in-context specification, and whether the model builds this geometry anew or reconfigures a stored one the authors leave open is the one the context specifies.
We use cookies to run the site and, with your consent, for analytics and to show ads. See our Cookie Policy.
