The Entanglement Wall: Activation-Space Probes as Risk Detectors, Not Context Adjudicators

Abstract

An activation-based safety gate must distinguish harmful assistance from legitimate work on the same topic. We test whether probes trained on broad harmful-versus-harmless data provide this decision boundary. Five checkpoint-specific readouts and their source-derived thresholds are transferred unchanged to four matched-pair cohorts containing 450 pairs, manually reviewed for topic and request-frame similarity. On Twin-70, the primary cohort of 70 pairs, central harmful and harmless score intervals overlap. Area under the receiver operating characteristic curve (AUROC) falls from 0.996-0.999 on the broad source task to 0.701-0.860. Pair ranking remains 0.829-0.929, but the transferred thresholds detect 0.943-1.000 of harmful requests while falsely blocking 0.686-0.986 of matched harmless requests. False blocking remains low on XSTest. Even with thresholds refitted within pair-grouped cross-validation, balanced threshold error is 0.229-0.329. Alternative source-trained logistic, radial-basis, and shallow multilayer probes reduce false blocking but detect only 0.200-0.671 of harmful requests at their transferred thresholds. Three primary readouts meet all prespecified Wall criteria, while two yield mixed evidence. Matched-label training recovers the distinction for the three checkpoints tested, and lexical controls also exhibit transfer loss. An automated post-freeze audit finds little numerical sensitivity to arm-label disagreement. The evaluated source operating points fail to combine strong harmful-request detection with access for legitimate same-topic work. This gap between risk ranking and a usable decision boundary is the security concern captured by the Entanglement Wall.