Closing the Activation-Cone Blind Spot: Response-Time Probing and Unified Defense

원문 초록

Note on v2 (Nov 2026): errors found in the evaluation code mean the empirical results reported in v1 are not supported; the theoretical corollary is unaffected. Details are in the notice on page 1 and in KNOWN_ISSUES.md in the linked repository. We compare five inference-time safety paradigms (no defense, static steering, CAST, AlphaSteer, probe-gated steering) across seven instruction-tuned models (7-31B) and five attack types (GCG, AutoDAN, DeepInception, prefilling, intent laundering). We derive a corollary: any defense that gates intervention on a single layer's activation alignment with a benign reference (cone, subspace, or null-space) is blind to attacks that craft activations to lie inside that reference, whether checked at prompt time or per token. For prefilling attacks we propose response-time probing, a linear probe on the hidden state at the first generated tokens combined with a halt, and compose this halt with AlphaSteer's null-space steering. We also examine whether MMLU captures steering's utility cost and how the diversity of negative training sets affects probe false-positive rates. Code, attacks, and per-sample results are released.