Hospitals are starting to deploy AI agents: language models that read referral letters, summarise records, draft notes, and call tools on a clinician's behalf. Every document an agent reads is also a way to instruct it. An instruction hidden in an uploaded PDF, an external report, or a tool's output can steer what the agent recommends, while its answer still reads as ordinary, careful advice.
Filters that read only an agent's output see the answer, not what produced it, and a steered recommendation can look exactly like an honest one. The usual ways to make a model safer, retraining it or adding a black-box classifier, give a hospital nothing it can inspect, adjust, or audit.
A hospital deploying an agent needs to know which instructions are actually steering it, including ones no clinician wrote. It needs safety rules it can read, change, and audit as new threats appear, without retraining the model. Monitoring has to run alongside the agent and hold up against attacks it was not built for.
We monitor models from the inside, using their internal activations rather than the text they produce. PRISM reads the full set of instructions steering a model directly from its activations, without seeing the prompt. GAVEL detects interpretable concepts in the activations with lightweight probes and combines them into logical rules, so safety policies can be written, updated, and shared like firewall rules, without retraining. This work is a collaboration with Amrita's Center for Cybersecurity Systems & Networks and the Offensive AI Lab at Ben-Gurion University of the Negev.
PRISM was trained only on ordinary chat data, with no prompt injections. On 24,953 attacks from three public benchmarks, it caught 94.1% of the injections the model acted on and recovered 98.6% of the legitimate instructions the model carried out. PRISM appears at EMNLP 2026 and GAVEL at ICLR 2026; GAVEL was also presented at Black Hat USA 2026. Both methods have been validated on public benchmarks, not on clinical agents or patient data. Applying them to clinical agents is our next step.