SMASH 2026 · Paper #10 · Result card
TRACE: Temporal Risk Assessment and Concept Editing for Safer Language Generation
Streaming F1 0.96 for TRACE vs 0.61 for DiffMean. Steering lowers the attack-success analog from 0.94 to 0.18 with no change in refusals; a global refusal direction reaches 0.00 but adds 0.46 refusals.
codebook 48prior a 5ρ 0.5region weight 0.5λ 1hard negatives 30% of safeharm onset 0.4your sequence benign:20, caution:8, benign:6, harmful:14, benign:6seed 3
Streaming F1 (test)
0.96 vs 0.61
TRACE vs DiffMean; FPR 2% vs 33%
ASR analog
0.94 → 0.18
unsteered → TRACE edit at λ = 1 (global: 0.00)
ΔRef analog
+0.00 vs +0.46
safe responses disrupted: TRACE vs global direction
Your sequence stops at
token 39
harm starts at token 35
From the abstract
TRACE learns a codebook of recurring activation patterns and assigns each token activation to its nearest codebook vector, defining a latent concept. During steering, activations assigned to harmful concepts are steered along directions defined by nearby benign targets.
Evidence
Paper vs. your run
| Metric | Paper | Your run | |
|---|---|---|---|
| Harmful-class F1, response / streaming (TRACE) | WildGuard 0.835 / 0.837; S-Eval 0.933 / 0.935 | 0.940 / 0.959 | synthetic activations |
| DiffMean F1, response / streaming | WildGuard 0.491 / 0.491; S-Eval 0.820 / 0.820 | 0.780 / 0.606 | |
| Steering ASR (unsteered → TRACE) | WildGuard 0.873 → 0.306; S-Eval 0.634 → 0.062 | 0.939 → 0.184 | activation-level analog |
| ΔRef, TRACE vs refusal direction | +0.006 vs +0.717 (WildGuard); −0.002 vs +0.439 (S-Eval) | +0.000 vs +0.458 | analog |
| Refusal direction ASR | 0.000 on both datasets | 0.000 at λ = 1 | |
| Stop threshold | threshold = 0.605 (Figure 1 example) | 0.550 | validation-selected |
Try next
- Coarse codebook, no region term, high hard negatives — With only 16 codes and no region signal, harmful and caution tokens share codes; high hard-negative share makes the base rate ambiguous. Expect concept purity to collapse and streaming F1 to drop sharply.
{"codebook_size": 16, "region_weight": 0.0, "hard_negative_share": 0.8, "seed": 3} - Safe-only sequence with no harmful segment — Verifies that TRACE does not false-alarm on a trajectory that is entirely safe sensitive-topic content. The stop token should be None and ΔRef should remain near 0.
{"your_sequence": "caution:15, benign:10, caution:10", "seed": 3} - Weaker edit at λ = 0.5 — Halving the steering strength shows the ASR–ΔRef trade-off: expect ASR to fall less (above 0.18) but the safe-response edit fraction to stay similar, isolating the effect of edit magnitude from concept assignment.
{"steer_strength": 0.5, "seed": 3}
Read this before sharing
- Activations are simulated; no language model is run.
- The codebook and GRU detector are simplified stand-ins for the paper's trained components.