PaaT: Probe as a Tool for Proprioceptive Language Agents

Large language models are deployed as autonomous agents that execute multi-step plans through tool use, raising the question of how to keep them aligned at runtime when training-time alignment is insufficient. Yet language agents lack proprioception: they have no read-access to their own internal state, so failure modes such as reasoning loops and growing uncertainty are invisible until they manifest as harmful actions. We introduce PAAT (Probe as a Tool), a framework that exposes activation-derived safety probes as agent-callable functions, letting models query their own confidence and refusal-likelihood signals midtrajectory and self-regulate without weight modification. We organize the design space along an injection–tool spectrum from system-side to agent-initiated delivery. The choice of delivery mechanism flips the sign of the probe’s safety effect: agent-callable access reduces harmful compliance on the AgentHarm benchmark, while passive injection of the same signal can raise it; system-side enforcement more than halves compliance on the small-model regime where alignment is weakest. PAAT reframes safe agent deployment from which probe to train to who decides when the agent sees it, making delivery mechanism a first-class runtime safety variable.