PRISM: Recovering Instruction Sets from Language Model Activations
2026-06-08 • Artificial Intelligence
Artificial IntelligenceMachine Learning
AI summaryⓘ
The authors address the challenge of understanding what exact instructions guide large language models when they act like agents, especially since these models can have hidden goals or be tricked. They introduce PRISM, a new tool that reads the model's internal signals to list out all the active instructions clearly. Unlike past methods, PRISM is trained to find all these instructions at once and does better at spotting important goals, including security-related ones. Their work helps in reliably tracking what the model is really doing behind the scenes.
Large Language ModelsAgentic BehaviorActivation-to-Language MethodsInstruction Set RetrievalHidden StatesPrompt InjectionSubgoalsGRPOModel MonitoringSecurity Objectives
Authors
Gilad Gressel, Rahul Pankajakshan, Julia Diament, Efim Hudis, Krishnashree Achuthan, Yisroel Mirsky
Abstract
As LLMs are deployed as agents, reliable monitoring requires knowing not only what they output, but which instructions are steering their behavior. This is difficult when models infer unintended subgoals, follow contextual cues, or are influenced by prompt injections and hidden objectives. While activation-to-language methods suggest that hidden states can reveal natural-language information, existing approaches are not designed to recover the full set of simultaneous instructions, constraints, prohibitions, and subgoals active in agentic settings. We formalize this problem as instruction set retrieval and introduce PRISM, an activation-conditioned interpreter that decodes hidden states from a frozen target model into a faithful bullet list of active instructions. Unlike prior activation-to-language methods, PRISM is trained to recover instruction sets directly, using judge-guided GRPO to reward covered instructions and penalize unsupported ones. Across benign, constrained, prompt-injection, and hidden-objective settings, PRISM outperforms activation-to-language baselines, especially on security-relevant objectives.