AgentLens: Interpretable Safety Steering via Mechanistic Subspaces for Multi-Turn Coding Agent

2026-06-21

AI Summary

This work addresses the dynamic and evolving security risks inherent in multi-turn interactive code agents, which existing external defenses struggle to mitigate with fine-grained control. The authors propose AgentLens, a white-box defense framework that introduces mechanistic interpretability methods into multi-agent scenarios for the first time. By analyzing latent state representations, AgentLens enables real-time detection and intervention of harmful behaviors within a 10-dimensional subspace of a single transformer layer. The study also constructs MAS, a benchmark dataset comprising 194 tasks, demonstrating that AgentLens significantly enhances agent safety, effectively suppresses harmful outputs, and exhibits preliminary capabilities in anticipating emerging risks.

Abstract

Coding agents based on large language models (LLMs) demonstrate remarkable autonomous capabilities, but they also introduce significant safety and misuse risks during multi-turn interactions with external environments. Existing safety mechanisms mainly rely on external guardrails, which have a limited ability to perform fine-grained behavioral control during execution. Meanwhile, recent mechanistic interpretability methods for LLM safety are mostly confined to single-turn or jailbreak-style QA settings, limiting their ability to capture the evolving risk dynamics of multi-turn agent execution. In this paper, we investigate the safety of multi-turn coding agents from an internal perspective. We propose AgentLens (Mechanistic Subspace Intervention and Steering), a white-box defense framework that performs runtime safety detection and representation-level mitigation for coding agents. Unlike conventional agent guardrails, AgentLens detect harmful execution states from step-level hidden representations and mitigate unsafe behavior by intervening in a 10-dimensional subspace within a single layer. To support this research, we introduce the Mechanistic Agent Safety (MAS) benchmark, comprising comprehensively annotated multi-turn execution trajectories across 194 tasks using LLaMA-3.1-8B, Qwen-2.5-7B, and Gemma-2-9B. Extensive experiments show that AgentLens achieves strong safety detection performance, provides preliminary evidence for lookahead risk anticipation, and substantially reduces harmful actions of the coding agent, establishing a foundation for applying mechanistic interpretability to dynamic LLM agent safety. The code is available at: https://github.com/EddyLuo1232/AgentLens

Problem

• multi-turn coding agent
• safety steering
• mechanistic interpretability
• LLM safety
• dynamic risk

Innovation

• mechanistic interpretability
• safety steering
• subspace intervention
• multi-turn agent
• coding agent