{ "schema_version": 1, "builder_plan": { "scenario": "An agent reads external documents or tool responses that may contain malicious instructions.", "change": "Replay attacks and legitimate lookalikes in an isolated copy of your agent workflow.", "baseline": "Your existing checks with the same tasks, permissions, and tool responses.", "steps": [ "Locate the paper's implementation and check its license, model support, data needs, and hardware requirements. Stop here if you cannot obtain the required artifacts.", "Save a small set of representative product tasks and expected outcomes. Keep evaluation tasks out of any training or tuning, and choose quality and cost limits before running.", "Run the baseline and the proposed change on identical inputs. Keep other settings fixed and repeat paired runs to expose variation.", "Save per-task outputs, failures, timings, and all usage costs. Review regressions before expanding the test." ], "measure": "Successful attacks missed, legitimate actions blocked, detection delay, and review cost.", "decision": "Keep the change only if it meets your preselected quality and latency limits and improves the metric you care about after setup and operating costs. Otherwise retain the baseline. This is an exploration plan, not a validated recommendation." }, "builder_review": null, "arxiv_id": "2610.20808", "title": "PRISM: Transfer and Limits of Activation Interventions in Tool-Calling Language Models", "summary": "Replaces prompt-level guardrails or safety fine-tuning with inference-time activation interventions whose steering directions are estimated from a quantized NF4 copy and transferred across languages and model scales. Costs are activation-access instrumentation, per-direction estimation experiments, and a residual inference overhead, all feasible on a single 24 GB GPU for 8B-class open models but requiring weight access that third-party APIs do not provide. Can fail when directions estimated on few scenarios do not generalize to unseen tools or domains, when interventions degrade benign tool-calling behavior, or when transfer to larger models (up to 70B) exceeds the available memory budget.", "rationale": "The method is low-cost and reproducible on constrained infrastructure with open-weight models, but its robustness for a specific production tool-calling workload must be validated before adoption.", "technique": "Activation steering for safer tool calling", "family": "seguranca_e_guardrails", "recommendation": "testar", "published": "2026-10-14", "as_of": "2026-10-18", "editorial_status": "indexed", "source_url": "https://arxiv.org/abs/2610.20808", "independent_implementations": 0, "total_implementations": 1, "stars": 122, "citations": 0, "claims": [ { "claim_id": "claim-01", "statement": "Replaces prompt-level guardrails or safety fine-tuning with inference-time activation interventions whose steering directions are estimated from a quantized NF4 copy and transferred across languages and model scales. Costs are activation-access instrumentation, per-direction estimation experiments, and a residual inference overhead, all feasible on a single 24 GB GPU for 8B-class open models but requiring weight access that third-party APIs do not provide. Can fail when directions estimated on few scenarios do not generalize to unseen tools or domains, when interventions degrade benign tool-calling behavior, or when transfer to larger models (up to 70B) exceeds the available memory budget.", "basis": "inferred", "result": "", "baseline": "", "conditions": "", "source_url": "https://arxiv.org/abs/2610.20808", "source_page": null, "source_excerpt": "" }, { "claim_id": "claim-02", "statement": "Cross-lingual NF4-supervised steering directions reduced unsafe tool-call violations in Llama-3.1-8B by 21.95 percentage points on held-out Arabic without target-language tuning.", "basis": "inferred", "result": "", "baseline": "", "conditions": "", "source_url": "https://arxiv.org/abs/2610.20808", "source_page": null, "source_excerpt": "" } ], "exposure_map": [ { "dimension": "quality", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "compute", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "latency", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "operations", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "compatibility", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "security", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "data_and_training", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" }, { "dimension": "reproducibility", "basis": "not_evaluated", "finding": "", "interpretation": "", "limitation": "", "next_check": "", "source_url": "", "source_page": null, "source_excerpt": "" } ], "risks": [], "minimum_test": [], "open_questions": [], "independent_tests": [], "lab_reproductions": [], "report_available": false, "validation_tier": "unknown", "evidence_tier": "unknown", "infrastructure_basis": "unknown", "equations": [], "equations_status": "not_fetched", "core_kind": "", "equations_fetched_at": "", "equations_source_url": "", "equations_source_sha256": "", "exposures_reviewed_at": "", "exposures_source_sha256": "" }