线性探针可提前识别智能体即将泄密：Qwen3-32B 上召回 82%
Pre-Crime for Agents, at the Last Second: Probing When a Recruited Agent Gives In
arXiv 这篇论文挺有意思：智能体被别的智能体劝到泄密前，探针读内部激活能提前发现，82% 召回比零样本监控的 26% 高不少。
arXiv 论文研究多智能体场景下被同伙施压泄露秘密（如 deploy token）的问题，测试智能体在最多 20 轮劝说后从拒绝转为屈服的过程。在智能体输出前读取其内部激活的线性探针，可在保留集 Qwen3-32B 上以 5% 误报率捕获 82% 的泄密调用，而零样本决策模型监控只能捕获 26%。在 gpt-oss-20b 上，基于推理过程的探针达到 AUROC 0.91。论文也指出局限：探针会把许可性披露也标记为风险，且若对每次告警都中止，会拦下大多数良性任务。
Pre-Crime for Agents, at the Last Second: Probing When a Recruited Agent Gives In
When AI agents share channels and credentials, one agent can press another to break its operator's rule, a first step towards collusion. Output filters check only what an agent has already written. Can an overseer tell beforehand that an agent is about to give in? We show that a linear probe on the agent's activations can, in a controlled multi-agent setting. Across six scenarios, a peer presses a target for up to 20 rounds to reveal a secret, such as a deploy token; the target often refuses, then gives in. Read at each model call before its output is written, the probe picks out the one that leaks. On held-out Qwen3-32B episodes, at a threshold set to flag 5% of benign calls, it catches 82% of leaking calls. At a similar flag rate, a zero-shot decision-model monitor catches 26%. On gpt-oss-20b, a probe on its reasoning reaches AUROC 0.91. A bag-of-words classifier trained on the same calls comes close, so most of the gain comes from training on labels, not activations. The probe also flags permitted disclosures: it reads the coming disclosure more than the violation. The warning is short-range, and halting on any alarm would stop most benign episodes, which a second text check does not fix. A warning raised before generation could let an overseer stop an agent that is about to give in, ahead of others acting on its messages or recruitment spreading through a swarm.
