Reading Intent, Not Output: Cheap Activation Safety Monitors That Transfer Across Languages and Models

This is one of the stronger papers in the set, both in scope and execution. The core argument that activation probes provide a complementary safety signal that is cheap, early, language-agnostic, and works even when the text channel is degenerate is well-supported across several distinct experiments. The three settings where text fails (near-identical boilerplate refusals, covert goals, and first-token latency) are well-chosen and together make a strong case for why the activation channel is worth maintaining alongside text monitoring.

The cross-lingual transfer result (English-trained probe, 0.927 on Spanish, 0.921 on Vietnamese with no target-language labels) is impressive and the comparison against both a fair multilingual encoder and TF-IDF baseline is the right way to contextualize it. The author is honest that the fair encoder nearly ties on accuracy the case for activations rests on cost, latency, and degenerate-text cases rather than raw AUC, and stating this directly prevents overclaiming. The cross-model bridge result (0.004 AUC loss mapping to Gemma-3-12B) is genuinely surprising and, if it holds at scale, has real practical implications for monitoring new or opaque models. The finding that NLA stacking doesn't improve triage performance is a clean negative result that's worth publishing on its own. A few things would strengthen the paper: the forced-language reasoning methodology is well-validated in the appendix, but the evaluation sets are in the low hundreds per language, which limits confidence in the fine-behavior AUC estimates. The hidden-goal experiment (n=40) is small enough that the 0.45 vs. 0.15 comparison should probably include a confidence interval. And the pipeline description in Section 7 is useful but would benefit from a concrete latency estimate "close to free" is a qualitative claim that practitioners will want to see quantified. Overall this is work I'd expect to see developed into a full paper with high impact.

Very good and rigorous work. You go well beyond demonstrating a multilingual gap and instead build a cheap, portable monitor with several genuinely novel pieces: zero-label cross-lingual probe transfer, a cross-model affine bridge whose "geometry is lost but the safety direction survives" result is backed by a shuffled-bridge control, and a borrowed NLA explainer that travels across models.

The methodological discipline is what stands out - you actively debunk your own potential overclaim (activations only tie a fair multilingual encoder on raw accuracy, and you say so), report the NLA-stacking result as a negative and stress-test it across 19 behaviors, and validate the forced-language manipulation with a McNemar ablation. The dual-use section and single-GPU reproducibility are spot on.

Suggestions: the method needs white-box access, the cross-lingual results rest on forced-language reasoning (artificial by design), and evaluation is at small scale on 9–12B models - worth confirming at larger scale and on naturally occurring multilingual generation.

This is a well-executed and clearly presented monitoring pipeline combining cross-lingual probe transfer, cross-model affine bridging, and NLA explanation. The paper is admirably honest about where its advantages lie — cost and latency, degenerate-text cases, and portability — rather than overclaiming on raw accuracy.

The core method is established. Linear probes on residual streams and cross-model activation bridging both build directly on prior work (Arditi et al., Zou et al., Turturean et al. 2025). The fine-grained behavior taxonomy is carried over from the authors' own prior dataset rather than introduced here. The multilingual accuracy advantage over a fair multilingual encoder is modest (0.93 vs 0.90 on Spanish, 0.92 vs 0.90 on Vietnamese), meaning the practical case rests on cost, latency, and degenerate-text cases rather than a clear accuracy win.

Scale the weakest experiment. The hidden-goals result — recovering a covert agenda from activations when the answer text is near-chance — is the most safety-relevant finding, with direct implications for deceptive alignment detection. It currently runs on n=40 across 8 classes. This is the result most worth scaling and extending cross-lingually, since the fine-grained behavior transfer to Spanish and Vietnamese already demonstrates the probe generalizes.

Validate on naturally multilingual prompts. The cross-lingual transfer forces the reasoning language with a prefilled opener while keeping the English prompt fixed. Testing on prompts where both input and reasoning are naturally in the target language would directly address real deployment relevance.

Great use of modern methodologies like NLAs. Methodology is strong. Hypothesis can be more clearly scoped as it covers multiple goals. Section 4 onwards could be rewritten in a more clear way.