PaperlayerView exact revision on arXiv

Source-linked AI summary

The Safety Operator: Modulating the Expression of Safety Instructions via Spectral Optimization

Benoit Dherin, Michael Munn, Xavier Gonzalvo, Adrian Goldwaser, Blaz Bratanic, Ananth Balashankar, Andrey Vlasov, Pinzhi Huang, Cecile Loge, Nicole Mitchell, Andre Fernandes, Trilok Acharya, Wendy Kan, Ziyue Wang, Hanna Mazzawi, Felipe Tiengo Ferreira, Mor Geva

arXiv:2609.36434v1cs.AI

TL;DR

Safety instructions are adjusted by trial and error, without a formal mathematical objective for balancing refusals of harmful requests against over-refusal of harmless ones. The paper represents their effect with a multiplicative Safety Operator and tunes its eigenvalue through a contrastive loss. Sweeping the suppression weight traces an ASR–ORR tradeoff with Pareto-improving configurations, while the eigenvalue’s usefulness beyond safety remains untested.

  • Problem

    Production safety instructions are written and adjusted by trial and error, with no formal mathematical objective for balancing refusals of harmful requests against over-refusal of harmless ones.

    Source: §1 · p. 1

  • Method

    The paper represents safety instructions as rank-1 multiplicative Safety Operators and optimizes their eigenvalue contrastively across query classes using suppression weight ρ.

    Source: §1 · p. 2, §6 · p. 11

  • Results

    Sweeping ρ traces a continuous ASR–ORR tradeoff and yields Pareto-improving configurations that generalize to held-out queries across parameterizations.

    Source: §1 · p. 2, §6 · p. 11

  • Takeaways & Limitations

    The results are consistent with the safety eigenvalue serving as a continuous dial for instruction expression.

    Source: §1 · p. 2, §6 · p. 11

    Whether the eigenvalue is a useful proxy for steering behaviors beyond safety remains an open empirical question.

    Source: §6 · p. 11

Abstract

from arXiv · show

Context tokens in a transformer-based language model can be absorbed into the model's weights as a multiplicative operator. We study this operator in the setting of safety instructions and show that influencing its dominant eigenvalue modulates how strongly the instruction shapes generation. We derive a Contrastive Safety Loss with a suppression weight that controls the tradeoff between emphasizing the safety instruction on harmful queries while suppressing it on harmless queries. Varying the suppression weight maps a relationship between the attack success and the over-refusal rates, supporting the hypothesis that the operator's eigenvalue acts as a continuous dial for the instruction's influence. Moreover, this relationship holds relatively independently of how the Safety Loss is parameterized, yielding Pareto-improved safety instructions for appropriate values of suppression weight.

1 Introduction

The paper formalizes how safety instructions affect generation through a Safety Operator and derives a loss that tunes their expression across harmful and harmless queries. Sweeping its suppression weight traces an ASR–ORR tradeoff and yields Pareto-improving configurations.

1 Introduction

  • Safety instructions are commonly adjusted by trial and error because production prompt engineering lacks a formal mathematical objective for balancing harmful-query refusals against harmless-query over-refusals..Source: §1 · p. 1
  • The Contrastive Safety Loss maximizes the safety eigenvalue on harmful queries while driving it toward 1 on harmless queries, with ρ controlling the balance.Larger ρ penalizes over-expression on harmless queries more aggressively; smaller ρ prioritizes safety expression on harmful queries.Source: §1 · p. 2
  • The Safety Operator represents a safety instruction’s effect as a rank-1 perturbation of the identity, with its eigenvalue controlling dilation along one safety direction.The eigenvalue decomposes geometrically into activation magnitude ratio and directional alignment.Source: §1 · p. 2
  • Sweeping ρ traces a continuous ASR–ORR tradeoff and yields Pareto-improving safety instructions that generalize to held-out queries.The relationship holds relatively independently of how the Safety Loss is parameterized.Source: §1 · p. 2
  • The approach is tested across Soft, Hard GCG, HardR, and Mixed parameterizations, while competitive benchmarking against existing steering and prompt-defense methods is left for future work.The paper focuses on the Safety Operator as a tool rather than on a particular algorithm.Source: §1 · p. 2

2 Related Work

The paper situates its operator framework among work on implicit context-to-weight updates, activation steering, and safety alignment. It contrasts the operator’s input-dependent multiplicative effect with several additive, conditional, and prompt-optimization approaches.

2 Related Work

  • The work builds on interpretability results linking in-context tokens to implicit weight updates and connects safety alignment to refusal-direction analysis.The cited foundations include Dherin et al. (2025), Innocenti & Achour (2025), Goldwaser et al. (2026), von Oswald et al. (2023), Akyürek et al. (2023), Geva et al. (2021), and Arditi et al. (2024).Source: §2 · pp. 2–3
  • Unlike static additive steering vectors, the Safety Operator is a context-dependent multiplicative update implicit in the forward pass rather than a training-time intervention.Related approaches include conditional activation steering and attention-score or key-projection reweighting.Source: §2 · p. 3
  • Among compared methods, DRO shares Soft’s harmful-versus-harmless objective, RPO resembles Hard GCG but lacks contrastive suppression, and DefensiveTokens parallels Mixed but lacks a fixed safety-instruction span.HardR has no direct counterpart in the cited comparison.Source: §2 · p. 3

3 The Safety Operator and Contrastive Loss

The section derives a multiplicative operator for the effect of safety instructions, characterizes its single nontrivial eigenvalue, and uses that eigenvalue in a contrastive loss. The suppression weight controls the expression–suppression balance, while alternative objectives and positions remain areas for future work.

3 The Safety Operator and Contrastive Loss

  • The safety instruction’s context effect can be absorbed as an implicit multiplicative update to the feedforward input weights, motivating the Safety Operator framework.The framework proceeds from the induced operator to its spectral structure and then to an objective for optimizing that structure.Source: §3.1 · pp. 3–4, §3 · p. 3

3.1 The Safety Operator

  • The Safety Operator S(Y) maps clean query-token activations to safe activations, and its deviation from identity measures the instruction’s influence for that query.It is derived by constructing a minimal weight update that reproduces the safety-instruction effect without including the instruction in the context.Source: §3.1 · p. 4

3.2 The Safety Eigenvalue

  • Because the operator’s perturbation is rank-1, it dilates one safety direction while leaving the orthogonal subspace fixed; λsafe measures that dilation, with values nearer 1 indicating weaker influence.The eigenvalue combines activation-magnitude scaling and alignment between safe and clean activations.Source: §3.2 · p. 4

3.3 The Safety Loss

  • The Contrastive Safety Loss maximizes λsafe on harmful queries and pulls it toward 1 on harmless queries; ρ controls the tradeoff between safety expression and over-refusal.Alternative spectral objectives and higher-order or other loss shapes are left for future work; the operator is computed at the last query token, with extending it to other positions also left open.Source: §3.3 · p. 5
  • Exploring higher-order loss functions and alternative loss shapes is left for future work.The paper also leaves systematic exploration of alternative spectral objectives for future work.Source: §3.3 · p. 5

4 Optimization Landscape

The Contrastive Safety Loss is defined over the Safety Operator’s eigenvalue, separating what to optimize from how to search. Four parameterizations vary which instruction or suffix components are optimized and whether they remain readable.

4 Optimization Landscape

  • The eigenvalue-based loss separates the optimization target from the search algorithm, allowing it to be applied across continuous, discrete, and hybrid representations.The paper also identifies fixed steering vectors, low-rank activation perturbations, discrete tokens, and model weights as possible representation spaces.Source: §4 · p. 5
  • Soft optimization updates every instruction-token embedding jointly, yielding a continuous instruction that cannot be expressed as readable text.The original instruction is not frozen in this parameterization.Source: §4 · p. 5, Figure 1 · p. 6
  • Hard optimization freezes the safety instruction and searches for a discrete suffix, while HardR adds a readability regularizer to favor relatively fluent English suffixes.Hard GCG uses greedy single-token substitutions; HardR samples mutations from a human-written seed under a joint safety-readability score.Source: §4 · p. 6, Figure 1 · p. 6
  • Mixed optimization adapts a continuous suffix appended to a frozen, human-written instruction, combining fixed semantic grounding with continuous adaptation.Suffix-based methods evaluate the instruction together with the appended suffix as the effective safety instruction.Source: §4 · p. 6, Figure 1 · p. 6

5 Experiments

The experiments test whether adjusting the suppression weight traces an expression–suppression continuum and yields Pareto-improving instructions across parameterizations. On Gemma 3 1B, Soft, Hard GCG, and HardR find test-confirmed Pareto improvements, while Mixed produces near-Pareto candidates with mild over-refusal increases.

5.1 Experimental Protocol

  • All three predictions are verified on Gemma 3 1B and replicated on 4B; expanded JBB has 300 pairs in disjoint 100-pair train/eval/test splits, each with baseline ASR ≈14–15% and ORR ≈18–19%.Source: §5.1 · p. 7
  • All variants sweep 16 suppression weights; checkpoints selected on eval are re-evaluated on test using five responses per prompt, five autorater passes, and paired 95% confidence intervals.In-training Pareto checkpoints have both ∆ASR < 0 and ∆ORR < 0 relative to Original SI.Source: §5.1 · pp. 7–8

5.2 Results

  • Varying ρ traces an expression–suppression continuum; Soft, Hard GCG, and HardR find test-confirmed Pareto improvements, while Mixed yields only near-Pareto candidates.At ρ ≤5, ASR falls below 2% while ORR exceeds 50%; at ρ ≥1000, results approach the Original SI baseline. The figures show eval trajectories and test-set re-evaluations.Source: Figure 2 · p. 8, §5.2 · pp. 9–10, Figure 3 · p. 9
  • Soft confirms 10 of 11 in-training Pareto-improving checkpoints (90.9%); its strongest candidate reduces ASR by 3.86% and ORR by 4.04%.The strongest candidate is at ρ = 10, step 235; both reductions are statistically significant.Source: §5.2 · p. 10
  • Hard GCG confirms 10 of 11 in-training Pareto-improving candidates (90.9%); its strongest candidate reduces ASR by 2.81% and ORR by 3.59%.The strongest candidate is at ρ = 5, step 125; both reductions are statistically significant.Source: §5.2 · p. 10
  • HardR confirms 31 of 65 in-training Pareto-improving checkpoints (47.7%); its overall winner reduces ASR by 2.96% with neutral over-refusal.At ρ = 350, step 200, ∆ORR = −0.82% (95% CI [−9.58%, +7.94%]); another candidate reduces ORR by 4.47% with ∆ASR = −1.11%. The unoptimized seed increases ORR by 5.96%.Source: §5.2 · p. 10
  • Mixed yields no strictly Pareto-improving checkpoints; its best trade-off reaches ASR = 9.13% and ORR = 20.92%, with less than 1.4 percentage points of over-refusal cost.All 10 near-Pareto test candidates have statistically significant ASR reductions but retain small, non-significant ORR increases; the mild bias shrinks but does not eliminate the feasible improvement set.Source: §5.2 · p. 10
  • Continuous optimization follows smooth ASR–ORR trajectories, while discrete search advances in jumps; readable suffixes retain partial lexical coherence despite grammatical fragmentation.Supplementary experiments examine Gemma 4B, longer safety instructions, and OOD benchmarks; OOD transfer depends on parameterization, while DRO appears to reduce metrics more but generalize less.Source: §5.2 · pp. 10–11

6 Conclusion and Future Work

The paper presents the Safety Operator and Contrastive Safety Loss as a framework for modulating how safety instructions affect generation. It identifies optimization extensions and scope limits for future work.

Conclusion

  • The Safety Operator is a rank-1 perturbation of identity whose eigenvalue provides a continuous dial for safety-instruction expression, and sweeping its suppression weight yields Pareto-improving ASR–ORR configurations.The reported configurations span continuous, discrete, and hybrid parameterizations.Source: §6 · p. 11

Future Work

  • Future work proposes exploring higher eigenvalue powers, perturbation-matrix norms, and adaptive scheduling of the expression–suppression balance.These are proposed directions for improving safety modulation.Source: §6 · p. 11
  • Further directions include optimizing alternative representation spaces and testing cross-domain steering, where eigenvalue usefulness remains an open empirical question.The proposed spaces include fixed steering vectors, low-rank residual adapters, and activation perturbation tensors.Source: §6 · p. 11

Limitations

  • Experiments cover only Gemma at two scales and two safety-instruction templates; other model families, larger scales, and multi-turn settings remain open.Out-of-distribution transfer depends on parameterization and dataset, and no single parameterization transfers uniformly across all OOD benchmarks.Source: §6 · p. 11
  • Optimizing all continuous embeddings of a long safety instruction can overfit the evaluation split and inflate test over-refusal; short-suffix adaptation or regularization mitigates this effect.Fixed hyperparameters chosen to reduce in-distribution ASR most can create a structural bias that sweeping suppression weight alone cannot always compensate.Source: §6 · p. 12

Appendices

The appendices establish spectral properties of the Safety Operator and compare the framework with related steering and prompt-defense methods. They also distinguish its prompt-level, contrastive objective from approaches that intervene elsewhere.

A.1 Eigenvalue and Trace Identity

  • The rank-1 operator has eigenvalue 1 on directions orthogonal to v and λsafe = 1 + tr(∆q(Y)) along u, with a non-diagonalizable shear exception when u is nonzero and orthogonal to v.When u is not orthogonal to v, the operator is diagonalizable.Source: §A.1 · pp. 17–18

A.2 Geometric Expansion of the Eigenvalue

  • The geometric expansion relates the safety eigenvalue to the safe and clean activations and the angle between them.The appendix derives the expansion using the outer-product trace and the geometric definition of the inner product.Source: §A.2 · p. 18

A.3 Distance to the Identity Operator

  • When safe and clean activations remain closely aligned, driving λsafe toward 1 makes the operator approach identity; the experiments report alignment near cos θ ≈ 1 without added regularization.The appendix suggests penalizing tan^2 θ or the perturbation norm as possible remedies if empirical alignment is not relied upon.Source: §A.3 · p. 19

B Extended Related Work and Baseline Taxonomy

  • The related-work taxonomy contrasts prompt-level spectral optimization with prior steering, prompt-optimization, and deployment-layer approaches.The paper frames spectral optimization as defense-oriented and grounded in transformer internal spectral structure rather than output likelihoods or black-box rewards.Source: B Extended Related Work and Baseline… · p. 20

B.1 Static Additive Latent Steering

  • Static additive steering injects a fixed vector, whereas the Safety Operator scales a context-dependent update by the activation's projection and contrastively optimizes prompt expression across query classes.Static injection shifts the global refusal threshold, while the proposed objective targets λsafe > 1 on harmful inputs and λsafe → 1 on benign inputs.Source: §B.1 · pp. 20–21

B.2 Conditional and Dynamic Latent Interventions

  • Conditional steering uses external runtime controllers, while this framework optimizes the prompt representation offline without inference-time hooks, classifiers, or auxiliary energy models.The cited approaches include similarity switches, classifiers, and energy networks.Source: §B.2 · p. 21

B.3 Inference-Time Attention Reweighting and Instruction Boosting

  • Attention-boosting methods amplify instruction adherence but lack a mechanism to suppress its effect below baseline on benign queries; the proposed objective does both contrastively.The comparison also distinguishes their inference-time attention hooks from offline prompt-token optimization.Source: §B.3 · pp. 21–22

B.4 Discrete and Output-Likelihood Prompt Defenses

  • Prior prompt defenses generally optimize output likelihoods or static rule priority, while the Safety Operator optimizes internal spectral structure across query classes.RPO targets worst-case refusal robustness without a symmetric contrastive suppression term for borderline benign queries.Source: §B.4 · p. 22

B.5 Directed Representation Optimization (DRO): Detailed Comparison

DRO steers hidden representations with a fitted refusal probe, whereas the Safety Operator optimizes an intrinsic eigenvalue and can isolate a designated instruction span. In the reported comparison, operator-based Soft optimization generalizes more reliably to test, and the continuous-embedding procedure jointly optimizes instruction embeddings across layers.

B.5 Directed Representation Optimization (DRO): Detailed Comparison

  • DRO fits a refusal classifier in a four-dimensional PCA subspace and optimizes contrastive margins that steer hidden states in opposite directions for harmful and harmless queries.Its regularizer penalizes movement outside that subspace.Source: §B.5 · p. 23
  • The Safety Operator characterizes a designated instruction span through an intrinsic rank-1 multiplicative operator and its non-unit eigenvalue, rather than DRO’s Euclidean hidden-state shift.The operator is derived from context-token effects in feedforward blocks.Source: §B.5 · p. 23
  • Unlike DRO’s fitted PCA and logistic-regression probe, the operator computes its eigenvalue directly from clean and safety-prompt activations without auxiliary classifiers or dimensionality reduction.DRO’s optimization signal depends on the quality of its external probe.Source: §B.5 · p. 23
  • Driving the operator eigenvalue toward 1 on harmless queries collapses the operator to identity and mathematically recovers the unprompted clean forward pass.DRO shifts hidden states along its refusal-probe axis without that stated recovery guarantee.Source: §B.5 · p. 23
  • The operator isolates the causal perturbation of a designated instruction sub-span and supports continuous, hybrid, unconstrained discrete, and readable discrete token landscapes.DRO treats the prepended prompt as an undifferentiated block and is restricted to continuous soft embeddings.Source: §B.5 · pp. 23–24
  • 64.2% of 137 DRO candidates remained strictly Pareto-improving on test; moderate ρ=5–200 significantly improved both ASR and ORR, while ρ=0 or ≥500 produced severe over-refusal or safety degradation.Operator-based Soft optimization retained 90.9% of its Pareto-improving candidates, compared with 64.2% for DRO.Source: §B.5 · p. 24, Figure 4 · p. 25, Table 1 · p. 25

C.1 Algorithm

  • Continuous optimization updates the full safety-instruction embedding sequence jointly, minimizing a multi-layer Contrastive Safety Loss with a suppression weight and regularization toward its initial embeddings.Each iteration samples paired harmful and harmless queries and uses Adam for the embedding update.Source: §C.1 · p. 26

C.2 Experimental Setup

The soft-token experiments evaluate Pareto-improving checkpoints on held-out test queries, while the mixed-token method freezes the original instruction and optimizes a suffix. The setup sweeps suppression weights and uses replicated, autorated test evaluations.

C.2 Experimental Setup

  • The soft-token setup pairs one harmful and one harmless query per mini-batch, uses five query replicas and five-pass majority-vote autorating, and sweeps 16 suppression weights from 0 to 5000.It applies an L2 penalty with λreg = 0.5 to deviations from the initial discrete embeddings.Source: §C.2 · p. 27

C.3 Experimental Results

  • 90.9% of the 11 soft-token evaluation-split Pareto-improving candidates retained that status on held-out test under the paired-replica criterion.Table 2 reports their test re-evaluation.Source: §C.3 · p. 27, Table 2 · p. 27

D.1 Algorithm

  • Mixed optimization concatenates the frozen human-written instruction embeddings with trainable suffix embeddings, then updates only the suffix using the layer-averaged Contrastive Safety Loss and L2 regularization.The suffix is optimized with Adam.Source: §D.1 · p. 28

D.2 Experimental Setup

  • The mixed-token setup initializes its suffix from ten exclamation marks and uses Adam with η = 0.005, paired harmful/harmless JBB queries, five replicas, and a sweep of 16 suppression weights.The reported regularization weight is λreg = 0.5.Source: §D.2 · p. 29

D.3 Experimental Results

Mixed-token optimization produced no strictly Pareto-improving evaluation checkpoints, but its selected near-frontier candidates reduced test ASR with modest ORR increases. The section also describes gradient-guided discrete suffix search and its evaluation setup.

D.3 Experimental Results

  • On test, all 10 selected mixed-token near-Pareto candidates reduced ASR significantly by up to 4.68%, while ORR rose 1.05%–1.89%; the best tradeoff achieved ASR = 9.13% and ORR = 20.92%.No strictly Pareto-improving checkpoints appeared during evaluation: each checkpoint reducing ASR slightly increased over-refusal.Source: §D.3 · p. 29, Table 3 · p. 30

E.1 Algorithm

  • Hard GCG searches discrete suffixes by scoring vocabulary candidates with first-order loss gradients, evaluating candidate substitutions exactly, and greedily accepting a lower-loss suffix.The search uses paired harmful and harmless queries and evaluates the multi-layer loss.Source: §E.1 · p. 31

E.2 Experimental Setup

  • The Hard GCG setup uses Gemma 3 1B, ten exclamation marks as the initial suffix, five-replica autorating, and 16 suppression-weight values spanning 0 to 5000.Evaluation uses temperature 0.7 and five-pass majority voting.Source: §E.2 · p. 33

E.3 Experimental Results

Hard GCG yielded test-set Pareto improvements, while readability-constrained search adds the target model’s autoregressive likelihood to the safety objective when selecting discrete suffix tokens. The setup starts from a human-written semantic suffix seed.

E.3 Experimental Results

  • 10 of 11 Hard GCG candidates retained Pareto-improving status on test; the strongest candidate achieved ∆ASR = −2.81% and ∆ORR = −3.59%.The strongest candidate used ρ = 5 at step 125 and improved both safety and utility significantly.Source: §E.3 · p. 33, Table 4 · p. 34

F.1 Algorithm

  • Readability-constrained search combines first-order safety scores with the target model’s autoregressive log-likelihood, then selects low-scoring vocabulary candidates for suffix mutations.The method initializes from a human-written semantic seed and samples mutations with a temperature-controlled distribution.Source: §F.1 · p. 35

F.2 Experimental Setup

  • The readability-constrained setup uses Gemma 3 1B and a 26-token human-written semantic instruction seed, with a sweep of 16 suppression weights spanning 0 to 5000.The seed directs the model to analyze intent and decline dangerous, illegal, or harmful assistance.Source: §F.2 · pp. 36–37

F.3 Experimental Results

HardR optimization produced Pareto-improving safety-instruction candidates on held-out queries, while reranking primarily improved readability. The appendix also describes the benchmark construction and stratification used to support evaluation.

F.3 Experimental Results

  • 31 of 65 evaluation-split Pareto candidates (47.7%) retained Pareto-improving status on the held-out test split.Candidates came from 16 suppression-weight trials and 747 evaluation-split checkpoints.Source: §F.3 · p. 38
  • At ρ = 350, step 200, the overall winner reduced ASR by 2.96% with neutral over-refusal (∆ORR = −0.82%).The ASR reduction was statistically significant; the ORR confidence interval included zero.Source: §F.3 · p. 38, Table 6 · p. 39
  • The unoptimized semantic seed reduced ASR by 3.75 pp while raising ORR by 5.96 pp; optimized HardR candidates lowered false refusals below baseline while preserving significant safety gains.The seed comparison used the evaluation split; optimized-candidate results were measured on the held-out test set.Source: §F.3 · p. 38, Table 9 · p. 42

F.4 Readability Reranking

  • Exact reranking evaluates top-K mutations with full passes and selects the lowest true loss; it mainly improves readability without substantially shifting task performance.The procedure uses local estimates for fast filtering, then recalculates exact readability and composite loss for selected candidates.Source: §F.4 · pp. 39–41

G Safety Instruction Generation

  • The canonical short safety instruction contains 32 words, while the expanded HHH-based instruction contains 275 words, or approximately 380 tokens.Both instructions were generated from prompts grounded in the Helpful, Honest, and Harmless principles.Source: G Safety Instruction Generation · p. 43

H Stratified JailbreakBench Extension

  • The evaluation pool combines 100 original JailbreakBench pairs with 200 synthetic harmful–harmless pairs, partitioned into three balanced splits of 100 pairs each.The protocol keeps training, validation, and held-out test queries strictly disjoint.Source: H Stratified JailbreakBench Extension · p. 45, §H.1 · p. 45

H.1 Synthetic Expansion and Refusal Calibration

  • Synthetic harmless mirrors share sensitive topic words with harmful prompts and use ambiguous, educational, or narrative framing to calibrate over-refusal.The construction preserves borderline and dual-use requests rather than relying on explicit protective disclaimers that models readily identify as safe.Source: §H.1 · pp. 45–46

H.2 Difficulty-Aware Stratification

  • Difficulty-aware stratification addresses split-rate discrepancies by balancing category, vulnerability, and over-refusal tiers while preserving harmful–harmless pair integrity.Uniform random splitting produced discrepancies of up to 5.2 pp in ASR and 8.0 pp in ORR.Source: §H.2 · pp. 46–47

H.3 Split Statistics

The stratified benchmark splits preserve category and difficulty balance, and baseline checks find them statistically interchangeable. The evaluation protocol combines repeated generation and majority-vote rating with paired estimates and confidence intervals.

H.3 Split Statistics

  • Train and eval each contain 34 original and 66 generated pairs; test contains 32 and 68, while category counts stay within one of ideal in every split.The 300-pair pool’s original/generated composition is near-uniform across splits.Source: §H.3 · p. 47, Table 10 · p. 48
  • The eval–test gaps are 0.0 pp for mean ASR and mean ORR across the difficulty distributions.Table 11 reports the difficulty-tier distribution and mean rates.Source: §H.3 · p. 47, Table 11 · p. 48

H.4 Baseline Verification

  • Both baseline rate gaps fall within the 2 pp acceptance threshold, and confidence intervals overlap across all three splits.The authors conclude the stratified splits are statistically interchangeable for evaluation.Source: Table 12 · p. 48, §H.4 · p. 49

I Evaluation Methodology and Statistical Estimation

  • The evaluation protocol separates generation stochasticity from autorater classification noise when estimating safety-instruction effects.The appendix describes a two-stage hierarchical protocol and confidence-interval construction.Source: I Evaluation Methodology and… · p. 50

I.1 Two-Stage Hierarchical Sampling Protocol

  • Each prompt receives repeated target-model completions, then a frontier-model autorater supplies binary verdicts across independent passes for majority voting.The concatenated input includes the system turn, safety instruction, and user prompt.Source: §I.1 · p. 50

I.2 Autorater Configuration and Reliability

  • Autorater labels were unanimous across five passes in 99.79% of cases, with mean agreement of 99.92%.Disagreement was more frequent on harmful prompts than harmless ones; malformed responses without valid verdicts were excluded from reported rates.Source: §I.2 · p. 51

I.3 Point Estimates and Paired Metric Deltas

  • Matched replica seeds remove inter-replica sampling variance from optimized-versus-baseline comparisons, yielding a lower-variance paired estimator.The metric change is estimated as a sample mean of paired differences.Source: §I.3 · p. 52

I.4 Confidence Interval Construction and Hypothesis Testing

  • With only five test replicas, the analysis uses Student’s t intervals; those intervals capture decoding variability, while held-out splits address generalization to unseen prompts.Absolute-rate intervals are truncated to [0%, 100%], whereas paired-delta intervals are not.Source: §I.4 · p. 52

J Additional Experiments

The additional experiments extend the Safety Operator evaluation to Gemma 3 4B, longer safety instructions on Gemma 3 1B, and out-of-distribution transfer on AdvBench without retraining or reselection.

J.1.1 Soft-Token Optimization

  • On Gemma 4B with Short SI, 380 of 606 Soft-Token candidates (62.7%) were confirmed Pareto-improving on the held-out test set.The baseline Test ASR was 2.40%, corresponding to approximately 12 successful attacks on 100 prompts with 5 replicas and limiting power to detect small absolute reductions.Source: §J.1 · p. 53, Table 14 · p. 54

J.2.2 Mixed-Token Optimization

  • Restricting Long-SI adaptation to a 20-token suffix (Mixed) or using the fluency prior γ (HardR) regularized optimization compared with optimizing all ∼380 Soft embeddings.The text points to the Mixed and HardR results as evidence of this regularization.Source: §J.2.1 · p. 60, Table 20 · p. 62, Table 22 · p. 64

J.2.1 Soft-Token Optimization

  • On Long SI, 6 of 8 Soft-Token candidates raised test ORR by +16.76 to +45.48 pp, and only ρ = 75 (step 205) remained Pareto-improving.Three of the six ORR increases were significant; the Long SI baseline on Gemma 3 1B had ASR = 4.60% and ORR = 44.56%.Source: §J.2.1 · p. 60, §J.2 · p. 60, Table 19 · p. 61

J.2.3 Hard-Token (GCG) Optimization

  • All 18 Long-SI GCG candidates selected as eval-split Pareto improvements increased held-out test ASR by up to +4.04 pp.The passage attributes this generalization gap to overfitting the eval-split prompt distribution; it was absent in Short SI and HardR experiments, where the fluency prior regularizes optimization.Source: §J.2.3 · p. 62, Table 21 · p. 63

K Out-of-Distribution Evaluation on AdvBench and XSTest

K.1 Harmful-Only ASR Transfer on AdvBench

  • AdvBench reports harmful-query ASR transfer only: the R=10 Original SI baseline has ASR = 16.03%, versus 25.08% when the SI is removed.Source: §K.1 · p. 66
  • 71 of 97 candidates (73.2%) remain below the Original SI attack success rate on AdvBench, a benchmark not used for training or selection.Source: Figure 8 · p. 66, §K.1 · p. 66
  • Soft optimization transfers most reliably: all 11 candidates fall below baseline, with a significant −8.62 pp reduction at best; Hard GCG and HardR vary more, while Mixed is essentially neutral.Source: §K.1 · p. 66

K.2 Two-Dimensional ASR–ORR Transfer on XSTest

On XSTest, continuous and discrete parameterizations show opposing ASR–ORR patterns, while discrete candidates’ Pareto improvements are point-estimate only.

K.2 Two-Dimensional ASR–ORR Transfer on XSTest

  • XSTest pairs 100 harmful with 100 lexically sensitive benign queries; Original SI yields ASR = 1.11% and ORR = 44.09%.The benchmark tests whether optimized prompts can reduce over-refusal while preserving near-zero ASR.Source: §K.2 · p. 67
  • +5.56 to +14.51 pp ORR increases accompany near-zero ASR under Soft/Mixed; best ORR reductions are −10.69 pp∗ for Hard GCG and −12.29 pp∗ for HardR.Continuous methods amplify lexical over-refusal; discrete suffixes reduce ORR below the Original SI baseline.Source: §K.2 · p. 67
  • 3/11 Hard GCG and 3/65 HardR candidates are Pareto-improving by point estimate, but none excludes zero on both 95% CIs.The Original SI’s 1.11% ASR floor limits ∆ASR statistical power; hyperparameters selected to minimize JBB ASR leave a structural bias that sweeping ρ alone cannot fully offset.Source: §K.2 · p. 67
  • Figure 9 plots the out-of-distribution ASR–ORR trade-off for all 97 candidates, marking Pareto-improving candidates in crimson and non-improving candidates in pink.Original SI, No SI, and the ideal (0, 0) point are also marked.Source: Figure 9 · p. 68
Loading 2609.36434v1…