跳转至

文章背景与核心概要

随着大语言模型（LLM）越来越多地被用作具身智能体的高级规划器，那些在文本层面上看起来完全良性的指令，一旦转化为实际的物理行动，就可能演变成危险行为。这种现象被称为“物理越狱”（Physical Jailbreak, PJ）。本文旨在探讨物理越狱是否本质上与普通“文本越狱”（Textual Jailbreak, TJ）属于同一种安全挑战，并通过严谨的表征空间分析给出了否定答案。

研究团队通过隐状态方向分析（hidden-state direction analysis）和随机划分零假设检验（random-split null tests），发现在包括 Qwen2.5-3B/7B/14B/32B、Phi-3.5 和 SmolLM2 在内的多种模型中，文本越狱与物理越狱构成了可明显区分的信号。基于这一可分离性，作者推出了 PRISM——一个作用于完整隐状态的单层 \(\text{L}_2\) 正则化逻辑回归探针。实验表明，PRISM 在基准测试中显著优于传统的 LLM 裁判，在保持高准确率的同时大幅降低了误报率（FPR），为具身 AI 安全提供了一种全新的表征级范式。

When Words Are Safe But Actions Kill: Probing Physical Jailbreak Beyond Textual Jailbreak in Hidden-State Risk Space

arXiv ID: 2607.15218v2 [cs.AI]
Submitted: July 16, 2026 (Last revised August 21, 2026)
Subjects: Artificial Intelligence (cs.AI); Cryptography and Security (cs.CR)
Authors: Weimeng Wang, Ziqiang Wang, Zihang Zhan, Chuanpu Fu, Qi Li, Ke Xu

📌 Summary

As large language models (LLMs) increasingly act as high-level planners for embodied agents, instructions that appear completely benign in text can become hazardous once translated into physical actions. This paper investigates whether this physical jailbreak (PJ) is fundamentally the same safety challenge as ordinary textual jailbreak (TJ).

Through hidden-state direction analysis and random-split null tests, the authors demonstrate that textual and physical jailbreaks form distinctly separable signals across various models (Qwen2.5-3B/7B/14B/32B, Phi-3.5, and SmolLM2). To address this, they introduce PRISM, a single-layer \(\text{L}_2\)-regularized logistic probe operating over full hidden states. PRISM significantly outperforms traditional LLM judges by achieving high accuracy with drastically lower false-positive rates on benchmark evaluations, highlighting a representation-level paradigm for physical AI safety.

👥 Authors & Affiliations

  • Weimeng Wang, Ziqiang Wang, Zihang Zhan, Chuanpu Fu, Qi Li, and Ke Xu

📖 Abstract

Large language models (LLMs) increasingly serve as high-level planners for embodied agents, where linguistically benign instructions can become unsafe once grounded in the physical world. We study whether this physically grounded jailbreak is the same safety problem as ordinary textual jailbreak.

随着大语言模型（LLMs）越来越多地充当具身智能体的高级规划器，在语言学上看来完全无害的指令一旦落实在物理世界中，就可能变得不安全。我们研究了这种物理落地的越狱是否与普通的文本越狱属于同一个安全问题。

Through hidden-state direction analysis and random-split null tests, we show that textual jailbreak (TJ) and physical jailbreak (PJ) form separable signals in LLM representations across Qwen2.5-3B/7B/14B/32B, Phi-3.5 and SmolLM2. Building on this separability, we propose PRISM, a single-layer \(\text{L}_2\)-regularized logistic probe over full hidden states. PRISM achieves 86.2–87.7% accuracy on SafeAgentBench with 11.7–13.7% false-positive rates (FPRs), while same-scale LLM judges over-block safe tasks at 24.7–39.0% FPR.

通过隐状态方向分析和随机划分零假设检验，我们表明文本越狱（TJ）和物理越狱（PJ）在 Qwen2.5-3B/7B/14B/32B、Phi-3.5 和 SmolLM2 的 LLM 表征中构成了可分离的信号。基于这种可分离性，我们提出了 PRISM，这是一个针对完整隐状态的单层 \(\text{L}_2\) 正则化逻辑回归探针。PRISM 在 SafeAgentBench 上实现了 86.2–87.7% 的准确率，其误报率（FPR）为 11.7–13.7%，而同等规模的 LLM 裁判对安全任务的过度拦截率则高达 24.7–39.0% FPR。

To test whether the result survives lexical-shortcut controls, we introduce an interaction-balanced revision of PhysicalJailbreakBench-2K (PJB-2K): a fixed 2,000-row comparison set sampled by label and physical mechanism from a larger object–site construction. On the underlying 10,000-row pool, word-TFIDF and the embedding layer remain at chance (AUC 0.497 and 0.500). At layer 25, selected by an i.i.d. sweep, cell-grouped cross-validation gives PRISM 0.718 AUC, compared with 0.398 for a physics-free label control under the same protocol.

为了检验该结果是否经得起词汇捷径（lexical-shortcut）控制的考验，我们引入了 PhysicalJailbreakBench-2K (PJB-2K) 的交互平衡修订版：这是一个固定的 2000 行对比集，按标签和物理机制从更大的对象-地点结构中采样得出。在底层的 10,000 行数据池中，单词 TF-IDF 和嵌入层保持在随机水平（AUC 分别为 0.497 和 0.500）。在通过独立同分布（i.i.d.）搜索选定的第 25 层，单元格分组交叉验证赋予了 PRISM 0.718 的 AUC，而在相同协议下，无物理特征的标签对照组的 AUC 仅为 0.398。

On the identical 2,000 comparison rows, these PRISM predictions obtain 0.671 balanced accuracy, while Qwen2.5 judges from 3B to 72B obtain 0.538–0.577 and exhibit high FPR. These results support hidden-state probing as a representation-level method for physical safety beyond text moderation, without relying on the near-perfect scores of shortcut-prone paired templates.

在相同的 2,000 个对比行上，这些 PRISM 预测获得了 0.671 的平衡准确率，而 3B 到 72B 的 Qwen2.5 裁判模型仅获得 0.538–0.577 且表现出高误报率。这些结果支持了隐状态探测作为一种超越文本审核的物理安全表征级方法，且不依赖于易产生捷径问题的配对模板那近乎完美的得分。