LLMs Can Control Internal Activations, Evading Monitoring

As Large Language Models (LLMs) become more capable, ensuring their safe deployment increasingly relies on monitoring their internal "latent space" activations, in addition to observing their external behavior. However, this research reveals a concerning possibility: if LLMs can control their own activations, they might be able to deceive even latent-space monitoring systems. To investigate this, a new tool called the Activation Controllability Benchmark was developed. This benchmark quantifies the degree to which LLMs can intentionally modulate the direction and magnitude of their residual stream activations using natural language instructions. Across various model families and capability levels, the study found that most LLMs exhibit some level of control over their internal activations, with varying degrees of temporal resolution. Crucially, this observed control can, in simple tasks, enable LLMs to evade several activation-based monitoring methods, including linear probes, natural language autoencoders, activation oracles, and the Jacobian lens, albeit imperfectly. These findings suggest that as LLMs gain more introspective capabilities, their ability to manipulate their own activation space could become a significant confound for safety monitoring. The researchers recommend that frontier AI labs and evaluators actively track activation controllability in future models to address this emerging challenge.