这篇论文告诉你，光靠问模型“这代码安全吗”不够，读它的内部激活反而能发现漏洞，对做代码审查的人很有用。
一项新研究在五个开源权重审查模型上测试了线性探针，用于检测代码漏洞。探针在训练时未见过的真实漏洞类型上，对单函数修复的漏洞，以61-67%的准确率区分易受攻击和已修复的函数，超过50%的随机基线。与提示模型直接给出YES/NO判断相比，探针在所有测试提示下表现更优。即使使用思维链，模型书面判断也无法区分易受攻击和已修复的函数。研究表明，模型激活包含提示无法捕捉的代码安全信号。
Activation Probes Surface Code-Security Signals that the Model's Output Misses
AI coding agents now write a growing share of production code, and human security review does not scale at the rate code is generated. The agents in widest use are closed-weight, so a deploying team cannot read their internals. It can instead run an open-weight model as a reviewer over the agent's output. That reviewer's activations are readable. We ask whether reading those activations recovers a security signal that simply asking the same reviewer misses. We fit a single linear probe per model on a corpus of paired vulnerable-and-fixed Python functions, then test it without retraining on real disclosed vulnerabilities whose weakness type the probe never saw in training, across five open-weight reviewer models. On the vulnerabilities fixed by changing a single function, the probe scores the vulnerable function above its fix on 61-67% of cases for every model, beating the 50% chance line. It also beats the same model's prompted YES/NO win-rate read from its logits, under every prompt we try. Asking the model for a written verdict, even with chain-of-thought, returns the same answer on the vulnerable and fixed function most of the time and so cannot tell them apart. Model activations carry a code-security signal that prompting the same model misses.