PaperlayerView exact revision on arXiv

Source-linked AI summary

Safety Monitors Mostly Catch What the Model Already Refuses

Sripad Karne

arXiv:2609.05797v3cs.CL

TL;DR

Safety monitors are usually scored on harmful prompts without regard to whether the protected model would answer them, although their practical value is on the prompts it answers. The paper measures monitor recall on that subset, studies wording changes at fixed intent, and finds a shared explicitness blind spot. Training on wording ladders can reduce the gap, with trade-offs on harmless text.

  • Problem

    Standard monitor evaluations score harmful prompts alike, leaving unmeasured whether monitors catch the prompts the protected model would actually answer.

    Source: §1 · p. 1

  • Method

    The study samples target-model responses to condition monitor recall on answered prompts and compares model and monitor behavior across intent-matched rewrites with different explicitness.

    Source: §3 · pp. 3–4

  • Results

    At a common 1% false-positive rate, every tested monitor catches requests the model refuses 1.1 to 6.4 times as often as requests it answers.

    Source: §1 · p. 1

  • Takeaways & Limitations

    Training on explicitness ladders on both sides of the label reduces the gap, while hard negatives can teach guards to discount indirect phrasing.

    Source: §8 · p. 9

    The readouts, steering, and fine-tuning use one target model, and all requests are single-turn and English.

    Source: §9 · pp. 9–10

Abstract

from arXiv · show

Safety monitors are evaluated by recall on harmful prompts, regardless of whether the target model would answer them. Yet a monitor matters most on the prompts the model does answer. We measure recall on exactly those prompts, defined by sampling the target model and judging its responses. Across four text guards, two activation probes, and Latent Guard, recall at a 1% false positive rate falls sharply on this subset: at a common threshold, every monitor catches the requests the model refuses 1.1 to 6.4 times as often as the requests it answers. Standard metrics hide this; AUROC stays above 0.85 for most monitors. Rewriting each request to be less explicit, with intent held fixed and verified, raises compliance 28-fold and lowers every monitor's flag rate. Of the requests newly answered after rewriting, 44 to 93% slip past the monitor, depending on which is used, and most of their completions are graded harmful. We trace the gap to explicitness itself. As wording softens with intent fixed, the target model's harm and refusal readings fall and it answers; the guards' harm readings fall too, and steering a guard along explicitness alone flips its verdict. Model and monitors miss the same prompts, and stacking monitors does not recover them. Fine-tuning a guard on the rewrites at every level of explicitness, on both sides of the label, raises recall on answered requests from .24 to .89 while transferring to unseen benchmarks; hard negatives, the natural alternative, teach the guard to discount indirect phrasing instead.

1 INTRODUCTION

The paper asks whether safety monitors catch the harmful requests a model would actually answer, rather than merely those it would refuse. It finds a shared explicitness blind spot and shows that training on wording ladders can reduce it.

1 INTRODUCTION

  • Rewriting harmful requests to be less explicit while holding intent fixed raises Gemma-4-31B-IT compliance 28-fold, and most answers are harmful against the base request.The benchmark contribution includes 647 harmful requests at three explicitness levels, with intent verified by judges and annotators, alongside matched harmless ladders and evaluation and training code.Source: §1 · pp. 1–2
  • At a common 1% false-positive rate, every tested monitor catches requests the model refuses 1.1 to 6.4 times as often as requests it answers.The gap also appears for activation probes and Latent Guard, and stacking monitors does not close it.Source: §1 · pp. 1–2
  • Fine-tuning a guard on explicitness ladders on both sides of the label improves recall on answered requests and transfers to unseen benchmarks, while hard negatives teach it to discount indirect phrasing.The introduction also reports a trade-off on harmless text and describes reducing remaining false positives with a harmless ladder and distillation term.Source: §1 · p. 2
  • The paper evaluates monitors by conditioning recall on whether the protected model actually answers, finding every tested text guard and activation probe weakest on those prompts.This contrasts with standard harmful-benchmark scoring, which treats every harmful prompt alike.Source: §1 · pp. 1–2
  • Model and monitors share an explicitness blind spot: both treat blunter wording as evidence of harm, and steering a guard along that direction changes its verdict.The paper reports this in model and guard activations and through a steering test.Source: §1 · p. 2

2 RELATED WORK

Prior work studies monitor metrics, wording-driven refusal changes, guard robustness, internal harm and refusal representations, and training with matched data. This paper connects these lines through explicitness as a shared shortcut for models and monitors.

Safety monitors and their evaluation

  • Prior monitor evaluations use recall, F1, or AUROC on labeled harmful sets, but do not ask whether the protected model would answer the prompt.Those scores are also reported as poorly calibrated under shift.Source: §2 · p. 2

Wording and refusal

  • Prior rewording studies raise target-model compliance, while this work verifies fixed intent and measures the same rewording on model and monitors together.The two move in opposite directions, leaving monitors weakest where the model is most compliant.Source: §2 · p. 2

Guard robustness and defense in depth

  • Earlier work documents keyword reliance, paraphrase instability, implicit-harm evasion, and surface-pattern reliance; this paper identifies explicitness read as harm as a shared cause of overlapping failures.The overlap appears under natural rewording without an attacker.Source: §2 · p. 3

Harm and refusal representations

  • Prior representation work distinguishes harmfulness from refusal, while this paper finds that softening wording systematically lowers the harm reading at fixed intent and that monitors inherit the drop.The cited prior work also reports that jailbreak wrappers can suppress refusal while harmfulness remains high.Source: §2 · p. 3

Training with matched data

  • Matched ladders relate to counterfactual augmentation and shortcut learning; this paper diagnoses which shortcut each training-data type teaches and finds hard negatives can introduce one.Related approaches include paraphrase-consistency training and guard fine-tuning with reasoning distillation.Source: §2 · p. 3

3 EXPERIMENTAL SETUP

The setup measures monitor performance against sampled target-model behavior and compares prompts whose intent is held fixed across explicitness levels. It evaluates text-only guards, activation probes, and Latent Guard under a shared calibration protocol.

Experimental setup

  • The harmful evaluation set contains 647 prompts from Aegis 2.0, HarmBench, and StrongREJECT, with the reported pattern holding within each source and harm category.The primary target is Gemma-4-31B-IT, and the main results also replicate on Qwen3-32B.Source: §3 · p. 3

Compliance and elicitability

  • A prompt counts as answered if at least one of eight target-model samples complies, using judge labels that two human annotators independently confirmed.Responses are labeled complied, refused, or deflected.Source: §3 · p. 3

Explicitness rewrites

  • Each harmful request has indirect, direct, and blunt versions that make the same request and differ only in explicitness, with judges and annotators checking intent and ordering.Annotators separated the direct and blunt levels less consistently than the other checks.Source: §3 · p. 3

Monitors

  • The study evaluates four text-only guards, two probes on target-model hidden states, and a reimplementation of Latent Guard.The probes include a linear last-token probe and an attention probe over the full input; the latent score contrasts similarity to harmful and harmless prompt means.Source: §3 · pp. 3–4

Calibration and metrics

  • Monitors are calibrated to flag 1% of 10,000 benign WildChat prompts, then held at that threshold across wording levels; recall is reported separately for answered and refused requests.A leak is a request the monitor misses while the model answers it; results also hold with a second benign calibration pool.Source: §3 · p. 4

4 REWORDING ALONE FLIPS COMPLIANCE

Compliance rises sharply when harmful requests are phrased less explicitly, even though their intent is unchanged. The softened-only answers are mostly harmful when judged against the original requests.

4 REWORDING ALONE FLIPS COMPLIANCE

  • 340 of 647 prompts are answered at indirect wording (52.6%), compared with 12 at blunt wording (1.9%), a 28-fold difference.At the direct level, 71 prompts are answered (11.0%); 344 requests refused at blunt wording are answered at a softer level.Source: §4 · p. 4
  • Two independent harm graders find at least one harmful answer for 297 of the 344 requests answered only after softening (86%), judging against the original request.Human annotators rated nearly all of these answers harmful.Source: §4 · p. 4
  • The wording-driven compliance change means defenses must catch requests the model answers, so the study next tests existing monitors on that subset.Source: §4 · p. 4

5 TEXT GUARDS MISS EXACTLY THESE PROMPTS

At 1% FPR, all four text guards catch refused requests more often than answered requests, even though they rank harmful prompts well. Softer wording increases model compliance while lowering guard coverage, and threshold relaxation leaves the disparity.

5 TEXT GUARDS MISS EXACTLY THESE PROMPTS

  • All four guards flag more as wording blunts, although AUROC remains .94 to 1.00 at L2 and L3 and .70 to .96 at L1.The three wording levels hold intent fixed, so flag-rate differences reflect wording rather than a change in the underlying request.Source: §5 · p. 4
  • At L1, refused-to-answered recall ratios range from 1.1 (gpt-oss-safeguard) to 6.4 (Llama Guard 3), with refused requests higher for every guard at every level.gpt-oss-safeguard is closest to parity at L1, but its ratio reaches 2.0 at L2.Source: Table 1 · p. 5, §5 · p. 5
  • Of 344 flipped requests, guards pass 153 (gpt-oss-safeguard) to 321 (Llama Guard 3) at a level where the model answers.These are requests the model refuses when asked bluntly but answers when asked softly.Source: §5 · p. 5
  • Even at 10% FPR, the mean refused-to-answered recall ratio remains 1.7, and guards still pass more than a third of flipped requests.The mean ratio falls from 3.5 as the threshold is loosened, but stays above one at every tested point.Source: §5 · p. 5
  • The guards’ flag rates rise with bluntness while the model answers more as wording softens, so requests that get through are largely those every guard misses.Recall is lowest at L1, where the model answers 340 requests.Source: §5 · p. 5

6 READING THE MODEL’S INTERNALS DOES NOT HELP

Internal monitors share the text guards’ gap: they catch refused requests more often than answered ones, while model and guard harm readings move with wording. Steering Qwen3Guard along an explicitness direction changes its verdict, but the test is limited to one guard and intervention.

6 READING THE MODEL’S INTERNALS DOES NOT HELP

  • At L1, both probes have refused-to-answered recall ratios of 3.2 and Latent Guard 2.8; answered recall is .21 to .24, with 259 to 270 flipped requests leaked.The evaluation uses two probes and a reimplementation of Latent Guard, each at its own threshold fixed at 1% FPR.Source: §6 · pp. 5–6, Table 2 · p. 6
  • At a shared 1% budget, no pair using either-monitor-flags beats the best single monitor, and stacking all seven leaks 184 flipped requests.Fifteen of 21 pairs miss together more often than independent failures would predict.Source: §6 · p. 6
  • Moving the model harm-reading cut from 0.1% to 10% FPR leaves refused requests clearing it more often; half of answered L1 requests remain below the 10% cut.At 10% FPR, 14% of refused L1 requests remain below the cut.Source: §6 · p. 6
  • Steering Qwen3Guard on answered L1 requests raises its flag rate from .26 to .91 at α = 0.5; a matched-norm random direction stays at .26 to .28.The explicitness direction is the mean activation shift from L1 to L3, fit on half the requests and applied to the other half with text unchanged.Source: Table 3 · p. 6, §6 · p. 7
  • Target-model answered requests stay at +1.2 to +1.5 SD versus refused requests at +3.1 to +4.9; Qwen3Guard readings also rise with bluntness.For Qwen3Guard, answered requests move from +2.2 SD at L1 to +3.7 at L3, while refused requests move from +2.9 to +4.4.Source: §6 · p. 6, Figure 1 · p. 7
  • With the harm component projected out, steering reaches a .85 flag rate at a full step with harm reading essentially unchanged; a harmless-text direction reaches .96.The harmless direction is fit on a ladder of 450 harmless WildChat prompts.Source: §6 · p. 7
  • The steering test covers one guard and one intervention; other harm information may remain in safety directions that need not be independent.The authors treat the intervention as consistent with the preceding results, not proof of them.Source: §6 · p. 7

7 TRAINING THE GUARD TO IGNORE WORDING

The experiments test whether explicitness ladders can make Qwen3Guard less sensitive to wording, and how balancing harmful and harmless training examples affects the gains and costs.

Setup

  • The study splits 647 requests into 450 training and 197 test prompts, with no test-request rung in training, and compares original wording, ladders, and added harmless data.Each arm is a one-epoch LoRA fine-tune with three seeds; thresholds are recalibrated to 1% FPR.Source: §7 · pp. 7–8

Evaluation

  • The table reports held-out answered-L1 recall and flipped-request leaks, harmless-text false-positive rates, and mean recall on 24 unseen benchmarks.The benchmark families include persuasion and adversarial sets; the external benchmarks are decontaminated against training text.Source: §7 · p. 8, Table 4 · p. 8

Results

  • Arm C raises answered-L1 recall from .24 to .98 with no flipped-request leaks and 20-point higher external recall, but flags 16% of indirect harmless text.With indirect text labeled unsafe only, the guard learned indirectness itself as a signal.Source: §7 · p. 8
  • Arm D reaches .89 recall on answered L1 requests with 6% leaks, 1.1% FPR on indirect harmless text, and external recall 11 points above the untouched guard.It adds harmful and harmless wording ladders; the table reports three-seed means at 1% FPR.Source: §7 · p. 8, Table 4 · p. 8
  • Adding 1,350 OR-Bench hard negatives to D barely changes XSTest FPR and gives back all external-transfer gains; added to B, they reduce recall to .04 and leak 99% of flipped requests.The authors report that the guard learns to discount indirect, harm-adjacent phrasing, whether harmful or not.Source: §7 · pp. 8–9
  • Arm H halves XSTest FPR to 4.8%, with answered-L1 recall and leaks unchanged within noise, but persuasion recall falls 13 points below D.H adds a harm-word harmless ladder and a distillation term; its XSTest FPR remains above the untrained guard’s.Source: §7 · p. 9

Inside the fine-tuned guard

  • In D, the harm-direction gap falls from .72 to .12 SD, while in H 69% of answered requests remain above the readout line although verdicts flag 95%.The authors say H’s distillation term anchors harmless-text readings, consistent with more change occurring outside the measured direction.Source: §7 · p. 9

8 DISCUSSION

The discussion argues that monitors should be evaluated on requests the protected model would answer, and that wording-balanced training can reduce the shared blind spot.

Discussion

  • A monitor’s meaningful misses are requests the model answers, and every tested monitor was weakest on that subset because model and monitor both treat blunt wording as evidence of harm.The discussion says conditioning recall on model behavior is inexpensive and that stacking monitors misses the same kinds of requests.Source: §8 · p. 9
  • Training data can turn wording style into a shortcut: indirect harmful-only examples teach “indirect means unsafe,” while safe OR-Bench negatives teach “indirect means safe.”Ladders on both harmful and harmless examples place each wording style under both labels; harm-word false positives required additional treatment and a deployment-specific trade-off.Source: §8 · p. 9

9 CONCLUSION

The conclusion frames monitor value as dependent on the model and traffic, and reports that training on rewrites can reduce the explicitness-related gap, with trade-offs. The experiments have limited model, monitor, language, and interaction coverage.

Conclusion

  • A monitor’s value depends on the model it protects and the traffic it sees; training on rewrites can reduce the gap, but not without harmless-text trade-offs.The paper connects the gap to shared sensitivity to explicitness, including activation readings and a steering intervention.Source: §9 · p. 9

Limitations

  • The readout, steering, and fine-tuning experiments use one target model; steering uses one guard, while readouts and fine-tuning use two.The authors identify crossing several target models with several guards as a fuller study.Source: §9 · pp. 9–10
  • All requests are single-turn and English, and L3 findings rest on 12 answered requests.The authors also note that human validation distinguishes L2 from L3 less consistently.Source: §9 · p. 10

AI USE STATEMENT

The authors disclose using generative AI tools across dataset creation, evaluation, coding, design feedback, interpretation, and drafting, while retaining responsibility for the final work.

AI Use Statement

  • Generative AI tools helped create synthetic harmful and harmless datasets and served as judges and graders for explicitness, intent, compliance, and harm.The authors say they reviewed all AI-assisted work and take responsibility for the final content.Source: AI USE STATEMENT · p. 10
  • The tools also implemented experimental code under the authors’ direction, gave experimental-design feedback, helped interpret results, and assisted with text, figures, and tables.The authors state that AI tools were not used for theoretical or mathematical claims.Source: AI USE STATEMENT · p. 10
  • The authors report reviewing all AI-assisted work and taking responsibility for the final content.Source: AI USE STATEMENT · p. 10

ETHICS STATEMENT

The appendix documents ethical safeguards and evaluation settings, then reports that the monitor gap also appears with Qwen3-32B. That replication includes substantial harmful-answer leakage.

ETHICS STATEMENT

  • The study reports that annotators were warned about harmful material, paid market rates, and allowed to stop; no personal data was collected.The authors judged ethics-board review unnecessary and released ladders without model completions.Source: ETHICS STATEMENT · p. 10

A DECODING

  • Gemma prompts were sampled eight times per prompt at temperature 1.0, with no system prompt, thinking disabled, and a 512-token generation limit.The same settings were used across prompt levels and for the calibration pool.Source: A DECODING · p. 14

B REPLICATION ON A SECOND TARGET MODEL

  • With Qwen3-32B, every guard caught refused requests more often than answered requests at L1, with refused-to-answered ratios from 1.0 to 3.4.The best guard still passed 195 of 470 flipped requests; 186 passed requests received harmful-answer grades.Source: B REPLICATION ON A SECOND TARGET MODEL · p. 14
  • The replication used the same decoding, judge pipeline, flip sets, and frozen guard thresholds as the primary evaluation; only compliance labels changed.Guard scores do not depend on the target model.Source: B REPLICATION ON A SECOND TARGET MODEL · p. 14

C RESULTS BY SOURCE

The supplementary analyses test whether the monitor gap persists across request sources and harm categories, document how the explicitness ladders and labels were constructed and checked, and evaluate monitor variants.

C RESULTS BY SOURCE

  • Across each source, every text guard caught refused L1 requests more often than answered ones, with refused-to-answered ratios from 1.02 to 10.1.The source-level table reports answered counts, flip-set sizes, and each guard’s L1 recall by answer status.Source: C RESULTS BY SOURCE · p. 15, Table 6 · p. 15

C.1 RESULTS BY HARM CATEGORY

  • Pooled over four guards, refused-to-answered recall ratios exceeded one in every harm category, ranging from 1.13 to 1.88.Four of 32 individual guard-category cells fell below one; three were in small groups or within 0.03 of parity.Source: §C.1 · p. 15, Table 7 · p. 16

D.4 HARM GRADERS

  • The harm grader counts unambiguous, non-minimal harmful outputs, including caveated responses when the harmful behavior occurred; coding cases require relevant code artifacts.Annotators were instructed to judge responses against the original request, even when the model saw a reworded version.Source: §D.4 · pp. 19–20

D.5 ANNOTATOR INSTRUCTIONS

  • The study supplies human instructions for ranking ladder explicitness and judging intent, compliance, and harm, with row-independent labels and an option to skip unreadable items.The annotators were instructed not to look up material online.Source: §D.5 · p. 20

E COMPLIANCE JUDGING AND HUMAN VALIDATION

  • On sampled responses, annotators agreed with each other on compliance at κ = .95 and with the judge at κ = .60 and .63; their harm checks rated nearly all flipped-request answers harmful.They rated 198 of 198 and 194 of 200 answers harmful, versus 86% under the two-grader rule.Source: E COMPLIANCE JUDGING AND HUMAN… · p. 21

F EXPLICITNESS VARIANTS

  • The 647-request ladders preserve each original request’s level verbatim and generate other levels with intent held fixed; two judges verify intent and explicitness spacing.Accepted ladders require a two-point adjacent-rung gap; 242 originals needed more than one attempt.Source: §D.2 · p. 18, F EXPLICITNESS VARIANTS · p. 21
  • Annotators judged intent preserved in 97% and 100% of sampled triples, but reproduced the complete explicitness order in 38% and 33%.They placed L1 as least explicit in 88% and 83%; many remaining disagreements put L2 above L3.Source: F EXPLICITNESS VARIANTS · p. 21

G MONITORS AND MONITOR VARIANTS

  • Across text-guard variants, flag rates rose with explicitness and refused requests were caught more often; every tested internal-monitor configuration showed the same pattern.Across seven internal monitors, L1 refused-to-answered ratios ranged from 2.7 to 5.7.Source: G MONITORS AND MONITOR VARIANTS · p. 22, Table 9 · p. 22

H CALIBRATION AND THRESHOLD SWEEPS

Threshold changes, monitor stacking, and internal readouts probe the persistence and mechanism of the gap; the supplementary training analyses test fine-tuning outcomes, including replication in a second guard.

H CALIBRATION AND THRESHOLD SWEEPS

I STACKING MONITORS

  • At matched false-positive budgets, stacking monitors did not reliably reduce leaks: averaging ranks helped one pair and hurt every pair containing Llama Guard 3.The pair analysis compares OR stacking, re-thresholded ranks, and an independence-based leak prediction.Source: I STACKING MONITORS · pp. 23–24, Table 13 · p. 24

J.1 READOUT CONSTRUCTION

  • The harm and refusal readouts use mean activation directions from harmful and harmless reference prompts, with thresholds set at the benign pool’s 99th percentile.The 1% thresholds are +2.11 SD for harm and +3.44 SD for refusal.Source: §J.1 · p. 24

J.2 HARM AND REFUSAL READINGS

  • For the refusal reading, answered requests measured +2.5 to +3.1 SD and refused requests +6.3 to +8.3 SD; flipped requests fell 5.0 SD from L2 to L1.Inside Llama Guard 3, the harm readout largely reproduced its verdict separation; Qwen3Guard’s readout undershot its verdicts by about 14 points on both groups.Source: §J.2 · p. 24, §J.3 · p. 25, Table 14 · p. 25

J.4 STEERING DETAILS

  • Steering adds a scaled L1-to-L3 activation shift at eight layers, with the explicitness direction projected to remove its component along the harm direction.The reported steering strengths are limited to α ≤ 1 because random pushes at α = 2 begin to damage the model.Source: §J.4 · p. 25

K.5 THRESHOLD SWEEP

  • Across the threshold range, fine-tuned arms D and H beat the untouched guard on recall and leaks; H roughly halved D’s XSTest FPR.The untouched guard required 5% to 10% FPR to reach the recall the fine-tuned arms achieved at 1%; external evaluations were decontaminated against training text.Source: §K.5 · p. 26, Table 18 · p. 27, §K.6 · p. 27

K.7 DISTILLATION TERM

  • Distillation arm H adds a KL penalty on harmless rows to keep scores near the untouched guard; changing its weight from 0.3 to 10 moved recall by at most four points.The reported XSTest FPR stayed between 3.6% and 4.4%.Source: §K.7 · p. 27

L A SECOND GUARD: LLAMA GUARD 3

  • Harmful ladders raised Llama Guard 3’s recall on answered L1 requests from .05 to .99, while adding a harmless ladder reduced its XSTest cost from 30% to 13%.The pattern replicated from Qwen3Guard, though external recall was lower for Llama Guard 3 in every arm.Source: L A SECOND GUARD: LLAMA GUARD 3 · p. 28
Loading 2609.05797v3…