PRISM: Recovering Instruction Sets from Language Model Activations

Researchers introduce PRISM, a new AI system that decodes hidden states from language models to reveal the complete set of active instructions guiding their behavior. This advancement addresses a critical security gap in monitoring deployed LLM agents by detecting unintended objectives, prompt injections, and hidden constraints that models may follow without explicit output indication.

PRISM represents a significant advancement in AI interpretability with direct implications for LLM safety and deployment. The system solves a previously unaddressed problem: while language models output their responses visibly, the internal instructions actually steering their behavior often remain opaque. This gap creates security vulnerabilities when models follow hidden objectives, respond to prompt injections, or infer unintended subgoals that never surface in their output.

The research builds on recent activation-to-language methods that convert neural network hidden states into interpretable text. However, prior approaches lacked the precision to recover complete instruction sets operating simultaneously in agentic contexts. PRISM improves upon this by training specifically for instruction set recovery using judge-guided GRPO (a reinforcement learning technique), which rewards the system for covering all active instructions while penalizing false positives.

For the AI industry, this work addresses a critical monitoring challenge as LLMs move beyond text generation into autonomous agent deployment. Organizations deploying AI agents now gain a technical method to verify which instructions their models actually follow, independent of output content. This becomes especially valuable in security-sensitive environments where prompt injections or hidden training objectives could cause models to behave unexpectedly.

The benchmarking across benign, constrained, prompt-injection, and hidden-objective settings demonstrates practical applicability. Future developments likely include integration into LLM monitoring systems and potential regulatory adoption as compliance tools. The research highlights how interpretability research directly enables safer AI deployment at scale.

• →PRISM decodes hidden model states into readable instruction sets, revealing what actually steers LLM behavior internally
• →The system outperforms existing activation-to-language methods, particularly on security-relevant objectives like detecting prompt injections
• →This addresses a critical gap in AI monitoring for deployed agents that follow hidden instructions not visible in their outputs
• →The technique uses judge-guided reinforcement learning to ensure complete and accurate instruction recovery without false positives
• →Practical applications extend to compliance, safety verification, and autonomous agent monitoring across enterprise deployments