Automated essay scoring (AES) is a challenging task in cross-prompt settings due to the diversity of scoring criteria. While previous studies have focused on the output of large language models (LLMs) to improve scoring accuracy, we believe activations from intermediate layers may also provide valuable information. To explore this possibility, we evaluated the discriminative power of LLMs’ activations in cross-prompt essay scoring task. Specifically, we used activation to fit probes and further analyzed the effects of different models and input content of LLMs on this discriminative power. By computing the directions of essays across various trait dimensions under different prompts, we analyzed the variation in evaluation perspectives of large language models concerning essay types and traits. Results show that the activations possess strong discriminative power in evaluating essay quality and that LLMs can adapt their evaluation perspectives to different traits and essay types, effectively handling the diversity of scoring criteria in cross-prompt settings.

Fast Adversarial Training (FAT) is known for its efficiency but is often constrained by the limited quality of single-step adversarial examples (AEs), which weakens robust learning signals and leads to unstable optimization. Because of its single-step nature, many generated AEs fail to cross decision boundaries effectively, resulting in diluted robustness improvements. We identify that this limitation stems from a fundamental mismatch: single-step perturbations ignore the semantic vulnerability manifold—low-dimensional subspaces where decision boundaries are thinnest due to class semantic relationships (CSRs). While multi-step attacks implicitly navigate this manifold, single-step methods generate isotropic perturbations that rarely align with these fragile directions. Building on this insight, we propose Semantic-Guided Fast Adversarial Training (SG-FAT), a unified framework that steers single-step attacks along CSR subspaces through three synergistic components operating under a common principle: constrain perturbations to semantic vulnerability directions. SG-FAT improves the quality of single-step adversarial examples and stabilizes training while maintaining computational efficiency. Compared with existing fast AT methods, SG-FAT consistently achieves higher robustness across CIFAR-10, CIFAR-100, and Tiny-ImageNet. Under PGD-10 attacks (ϵ = 8/255), SG-FAT improves robust accuracy by +2.38%, +1.49%, and +1.09%, respectively. Our code and training logs are available at https://github.com/SSonnyboy/SG-FAT.