'Put the fork in the microwave' contains no bad words, yet if a robot obeys, something catches fire. As language models start acting as planners for physical robots, this gap matters: an instruction can read as harmless and still be dangerous once carried out. The authors ask whether that physical danger is the same thing text moderation already handles, and find it is not.

Looking inside the models, they show that 'content danger' (bad language) and 'physical danger' (harmful actions) appear as separate signals in the internal activations. So they train a deliberately simple probe, PRISM, that reads those hidden states and flags physically risky plans. It is more accurate and far less trigger-happy than asking another language model to judge, which tends to block many safe tasks. They also build a benchmark of risky action pairs that avoid obvious harm words, where the probe does especially well.

These results are summarized from the abstract, so see the paper for the models and exact figures.