PaperlayerView exact revision on arXiv

Source-linked AI summary

Same Attack, Different Judge: A First Controlled Adversarial Comparison of Jev, LLM Judges, and Purpose-Built Safety Classifiers

Xiang Li, Aichun Huang, Mingming Zhang, Zheli Liu

arXiv:2610.17820v1cs.CRcs.AI

TL;DR

The paper examines whether JEV’s robustness differs from other judge designs across safety tasks, given that adversarial content can move its answers. It compares JEV, LLM judges, and local classifiers under matched payloads and policy, finding that JEV’s robustness depends on the task: it is harder to bypass on rule-based moderation than on phishing detection.

  • Problem

    The paper asks whether routing safety decisions through JEV changes robustness across tasks, since adversarial content can move its answers.

    Source: §2.3 · p. 3, §8 · p. 11

  • Method

    The authors compare JEV, five LLM judges, and two local classifiers using the same payloads and routing policy across four public-data tasks.

    Source: §4.2 · p. 5, §11 · p. 13

  • Results

    JEV is more robust on rule-based moderation than phishing detection: no tested forgery gets through on moderation, while forgeries bypass 19–29% of phishing emails it flags.

    Source: §9 · p. 12, §11 · p. 13

  • Takeaways & Limitations

    The authors conclude JEV suits rule-based tasks better than judgment-based ones, and a single robustness score would hide differences across tasks.

    Source: §11 · p. 13

    The judgment-based-task conclusion rests on one task, one corpus, English-only data, and single-turn calls.

    Source: §9 · p. 13

Abstract

from arXiv · show

TypeSafe AI's Jev is a new kind of safety judge. It generates no text and no label: it answers questions the developer defines in advance and returns a probability for each answer. The vendor admits that adversarial input can change these answers but gives no numbers. In this paper, we present the first controlled adversarial evaluation of Jev. We build a test harness that sends every system the same payload under the same policy, and run it on four public-data tasks, from rule-based ones (input moderation, injection detection, routing) to a judgment-based one (phishing detection), with fifty attack variants from thirteen families. The targets are Jev, five GPT and GLM judges, and two local classifiers (Llama Guard 3, Prompt Guard 2). We find that Jev is the most robust system on input moderation: eight forgeries of its structured input bypass none of its decisions, and a sentence asking only why someone might make a harmful request bypasses 9% of its blocks, against 56% for GPT-6 Astra. On phishing detection. However, the same forgeries bypass 19-29% of the emails it flags, and even without attack Jev detects only 62% of phishing emails, against 77-81% for the GLM judges. Jev is also the fastest judge, but it flags the most benign requests (27%). The local classifiers fail differently: a training-example statement makes Llama Guard 3 miss 62% of the phishing it had flagged. These results suggest that Jev resists attacks on tasks with a clear rule to check but is more exposed on tasks that call for an overall judgment.

1 Introduction

The paper compares JEV with LLM judges and purpose-built classifiers under a controlled harness, addressing whether JEV’s robustness differs across safety tasks. Its findings show task-dependent robustness, alongside speed and false-positive trade-offs.

Prior work

  • Prior work tested JEV under attack without comparing it with other judge designs, leaving the relative robustness of routing decisions through JEV unclear.The vendor acknowledged that adversarial content can change JEV’s answers but reported no measurement.Source: §1 · p. 1

Our findings

  • JEV returns decisions in 0.7 seconds, and its adaptive search runs about eight times faster, but it flags 27% of benign requests versus 9–17% for LLM judges.The adaptive search succeeds on 5 of 50 requests against JEV and 11 of 50 against GPT-6 Astra; the paper notes that this gap could be chance.Source: §1 · p. 2

Our study

  • The harness holds payload, policy, and metrics fixed across typed, LLM, and purpose-built judges, enabling direct comparison across systems.It covers four public-data tasks and uses thirteen attack families with fifty variants.Source: §1 · pp. 1–2

Our findings

  • JEV’s robustness depends on the task: no tested forgery bypasses it on input moderation, but the same forgeries bypass 19–29% of phishing emails it flags.On moderation, asking only why someone might make a harmful request bypasses 9% of JEV’s blocks, versus 56% for GPT-6 Astra; on phishing, JEV detects 62% without attack, versus 77–81% for GLM judges.Source: §1 · p. 2
  • A training-example statement makes Llama Guard 3 miss 62% of the phishing it had flagged, while Prompt Guard 2 flags more injections.The paper notes that purpose-built classifiers are not necessarily robust, and their responses depend on what they were trained to recognize.Source: §1 · p. 2

2 Background

The background describes JEV’s typed interface and recommended guardrail recipe, then sets out the vendor’s unmeasured caveats and the study’s threat model. The threat model limits attacker control to parts of the input state and distinguishes several attack goals.

2.1 JEV’s Interface

  • JEV answers caller-defined questions about a supplied state, returning probabilities for yes/no, multiple-choice, or ordered-score answers rather than generating text.Choice and Score answers also report confidence, with different calculations for each type.Source: §2.1 · pp. 2–3
  • Repeated calls on identical input do not always return identical answers, and the paper measures this rate directly.Source: §2.1 · p. 3

2.2 The Official Guardrail Recipe

  • The recommended guardrail recipe sends a fixed battery of four harm questions and one severity score, then thresholds probabilities into pass, review, block, or support actions.The thresholds include review at 0.35 and action at 0.70; severity of at least 2 escalates review to block.Source: §2.2 · p. 3

2.3 The Vendor’s Own Unquantified Caveats

  • The vendor lists nine JEV failure modes without measuring them; relevant caveats include exact-word answering, sensitivity to irrelevant content, and adversarial state content moving answers.The paper uses the latter two caveats to motivate attacks and the first to help explain false alarms.Source: §2.3 · p. 3

3 Threat Model

  • The attacker controls only part of the state, such as a message, email, tool return, or document, but not JEV’s question text, criteria, or routing thresholds.Attacks on JEV’s infrastructure, the LLM relay, and account or billing compromise are out of scope.Source: §3 · p. 3
  • The threat model separates evasion, targeted misrouting, confident escape, and availability goals, which apply to different tasks or deployment outcomes.Confident escape requires movement toward pass while severity confidence remains at least 0.7; availability attacks push benign traffic toward review, but are not pursued.Source: §3 · p. 3

1 Tasks

The methodology holds attacker-controlled payloads and routing policy constant while comparing eight systems across four public-data tasks and thirteen attack families. It also defines the routing and attack metrics used to compare task performance and robustness.

4 Methodology

  • The harness sends the same attacker-controlled payload to each judge in its expected input format and applies one routing policy to all systems.This holds content and policy constant, not the input bytes; the reported metrics are computed from routed decisions.Source: §4 · p. 4, Figure 1 · p. 4

4.1 Systems Under Test

  • Eight systems comprise JEV, five LLM judges, and two local classifiers; the classifiers join only tasks requiring one binary decision.Versions were pinned, and the local classifiers ran on the researchers’ hardware.Source: §4.1 · pp. 4–5

4.2 Four Judgment Tasks, One Harness

  • Four tasks span input moderation, indirect-injection detection, tool-and-intent routing, and phishing detection, with phishing requiring an overall judgment rather than a single explicit rule.The tasks use public data; the phishing corpus contains 18,650 emails, including 7,328 phishing messages.Source: §4.2 · p. 5

4.3 Attack Matrix

  • Thirteen attack families include generic prompt attacks, attacks targeting JEV’s typed probabilistic interface, and follow-ups probing mechanisms observed in earlier results.The study also includes a probe that changes the request field targeted by an already measured attack but is not counted as a separate attack.Source: §4.3 · p. 5

4.4 Routing Policy and the Margin Score

  • The strict policy blocks at hazard-Noul probability 0.70, sends cases to review at 0.35, and can upgrade review to block when severity reaches 2.The margin measures how far the dominant triggering signal exceeds its threshold; smaller or negative margins indicate proximity to the pass boundary and guide A4 stratification and A8 target selection.Source: §4.4 · pp. 5–6

4.5 Two Numbers: ASR and Gate-Bypass Rate

  • Attack success rate measures clean-flagged malicious samples routed to pass under attack, while gate-bypass rate measures less-severe verdicts that retain JEV confidence of at least 0.7.The confidence gate sends lower-confidence verdicts to human review; gate-bypass rate is computed for JEV only because the other systems do not return a confidence they compute themselves.Source: §4.5 · p. 6

5 Evaluation

The evaluation establishes clean task performance and answer stability before comparing attacks against each system’s clean decisions. JEV is fastest but has the most false alarms, while repeated-input answer changes are more frequent for the LLM judges.

5 Evaluation

  • The evaluation comprises 64,478 judge calls, and attack outcomes are compared with clean decisions after measuring each system’s task performance and repeated-input stability.Unless otherwise specified, results use all 100 harmful and 100 benign JailbreakBench requests for T1.Source: §5 · p. 6, §5.2 · pp. 6–7

5.1 Clean Performance

  • JEV detects harmful requests at TPR 0.79–0.89, returns decisions in 0.7 seconds median, and flags 27% of benign requests, the highest FPR among six judges.The LLM judges’ median latency is 4 to 24 seconds; JEV’s false-alarm confidence interval does not overlap GLM-5.2’s 0.09.Source: §5.1 · p. 6, Figure 2 · p. 7

5.2 How Much a Judge Changes Its Own Mind

  • JEV changes its decision on 1.0% of repeated clean T1 cases and none of T4, compared with 4.0–8.6% for LLM judges.These clean-input flip rates set the baseline for judging whether attack effects exceed ordinary answer instability.Source: §5.2 · p. 7

6 RQ1: Comparative Robustness

JEV is hardest to fool on input moderation, but its advantage does not generalize across tasks: robustness depends on whether the task has a clear rule or requires judging the whole message.

6.1 Direct Injection and Self-Justification (A1, A2)

  • Attacks to ignore instructions or self-justify produced ASR at or below 0.01 for JEV and 0.06 for LLM judges; ignoring the question succeeded against no system.The researcher-framing variant reached 0.06 [0.01, 0.13] on GPT-6 Astra, while JEV showed no effect.Source: §6.1 · p. 7, Figure 3 · p. 8

6.2 Lowering the Severity Score (A5)

  • A5a bypassed 56% of GPT-6 Astra’s blocks and 54% of GPT-5.6 Sol’s, versus 9% for JEV; intervals separated JEV from GPT but overlapped GLM-5.3 and GLM-5.1.The figure summarizes T1 attack success rates across six attack families and six generative judges.Source: §6.2 · pp. 7–8, Figure 3 · p. 8
  • On JEV, neither the teaching purpose nor general-explanation framing worked alone, and whether A5a passes are failures depends on what the assistant would answer afterward.The study did not measure whether the assistant would give only reasons or also provide the method.Source: §6.2 · p. 8

6.3 Obfuscation and Dilution (A7, A4)

  • Chinese-translation ASR was 0.08–0.14 across judges; dilution yielded 0.00–0.05, but the intended near/far decision-boundary strata were reversed.JEV’s encoding results varied: its highest rates were 0.09 on leetspeak and 0.10 on base64, while homoglyphs were 0.00.Source: §6.3 · pp. 8–9, Figure 3 · p. 8

6.4 Cross-Task Generalization (T2–T4)

  • JEV’s robustness is task-dependent: it matches LLM judges on moderation and injection detection but trails on phishing, detecting 62% versus the GLM judges’ 77–81%.Figure 4 and Table 3 present the T2/T4 comparisons and clean T2–T4 results, respectively.Source: Table 3 · p. 8, Figure 4 · p. 9, §6.4 · p. 9
  • In routing, JEV’s mean probability for the attacker’s action rose 0.064, versus 0.015 for the largest LLM-judge shift; Llama Guard 3 missed 62% of flagged phishing under A2.Choosing the attacker’s action occurred at most 1% of the time, so the probability-shift and action-selection measurements gave different impressions.Source: §6.4 · p. 9

7 RQ2: Attacks on JEV’s Interface

JEV’s interface attacks have task-dependent effects: the tested forgeries fail on input moderation but succeed on phishing detection. Placement and extra choices do not establish a general attack advantage.

7.1 Attacks on Input Moderation (A3, A10, A6)

  • Five structured-state forgeries and three forged earlier-verdict formats each had 0.00 ASR against JEV on input moderation.A fake system turn and duplicate JSON key raised JEV’s jailbreak probability by 0.15 and 0.10; equivalent payloads reached 0.02–0.09 against LLM judges.Source: §7.1 · p. 9
  • On input moderation, interference between JEV’s questions moved untargeted probabilities by 0.01–0.04; A6b was the only variant with nonzero-supported bypass, at 0.06.Some GLM judges showed larger probability shifts under A6b and A6e.Source: §7.1 · p. 10

7.2 Attacks on Phishing Detection (T4)

  • A forged verdict and a forged structured-state field each bypassed JEV on phishing detection, at 24% and 19%, after both had zero ASR on input moderation.Content verdicts worked better than authority claims; combining the two forgeries reached 29%, though its confidence interval overlapped that of the forged-verdict attack.Source: §7.1 · p. 9, §7.2 · p. 10, Figure 5 · p. 10
  • On phishing detection, nesting forged verdicts kept JEV’s ASR at 3–5%, while the strongest A13 variant reached 18%; adaptive search succeeded on 6–7 of 50 emails.The strongest A13 variant used a field name resembling JEV’s output; adaptive search succeeded on 13–20 of 50 emails against GPT-6 Astra.Source: §7.2 · p. 10

7.3 Attack Placement and Number of Options (A11, T3)

  • Moving an attack into developer instructions yielded 0.00 ASR against JEV, but the test was inconclusive because the attack barely worked in state; extra routing options also did not make JEV easier to attack.JEV never selected the attacker’s action with 8, 16, or 32 options.Source: §7.3 · p. 10

7 RQ2: Attacks on JEV’s Interface

  • On input moderation, JEV’s interface forgeries bypass no blocks, while the same families reach 19–29% ASR on phishing detection.The section concludes that the interface is a weakness on the judgment-based task, not the rule-based one.Source: §7.1 · p. 9, §7.3 · p. 10, §7.2 · p. 10

8 RQ3 and RQ4: Confidence and the Cost of Speed

The tested A5a attack did not produce a confident escape from JEV’s review gate. JEV responds faster than the LLM judges, but the measured deployment cost is more benign requests flagged, not a demonstrated robustness loss.

8.1 RQ3: Confidently Wrong Verdicts

  • A5e increased benign-request refusal by GLM judges from 0.09–0.12 to 0.19–0.31, while JEV and GPT judges remained within their noise.The attack added a sentence saying the alarming-sounding wording was legitimate.Source: §8.1 · p. 11
  • None of the seven A5a cases that reached pass escaped JEV’s confidence gate: all reported low confidence and were sent to a reviewer.A5a loosened 19 of 79 clean-blocked requests; 12 moved from block to review and 7 reached pass.Source: §8.1 · p. 11

8.2 RQ4: Speed Versus Security

  • JEV returned decisions in 0.7 seconds at the median, versus 4 to 24 seconds for LLM judges; the adaptive search took about 200 seconds against JEV and 1,600 seconds against GPT-6 Astra.Search success was 5 of 50 against JEV and 11 of 50 against GPT-6 Astra, a gap the authors say could be chance; the phrase pool favored LLM judges.Source: §8.2 · pp. 11–12
  • JEV flagged 27% of benign requests, versus 9–17% for the LLM judges, while the study found no cost in robustness and measured adaptive search at about eight times faster against JEV.The search comparison was small and could be chance, so the authors do not claim JEV resists it better.Source: §8.2 · pp. 11–12

9 Discussion

The discussion interprets JEV’s robustness as task-dependent: it performs better on rule-based input moderation than on phishing detection, a judgment-based task. The authors place this comparison among prior work on generative judges and classifiers and identify limits on generalizing the findings.

9 Discussion

  • JEV’s interface forgeries bypassed no input-moderation blocks but reached 0.19–0.29 ASR on phishing detection, where JEV already trailed GLM judges without attack.The discussion links JEV’s high false-positive rate to its strictness on borderline benign requests.Source: §9 · p. 12
  • Classifier responses depended on training: a purpose statement made Llama Guard 3 miss 62% of flagged phishing, while Prompt Guard 2’s injection flags rose from 66% to 100%.On input moderation, the purpose statement alone did nothing to LLM judges.Source: §9 · p. 12
  • The authors advise keeping attacker-writable fields from reaching JEV as trusted on judgment-based tasks, while noting its 27% false-positive rate sends many harmless requests to review.For rule-based tasks, the tested forgeries failed and the few requests that passed carried low confidence, so a confidence gate sent them to review.Source: §9 · p. 12

11 Conclusion

  • The authors’ judgment-task conclusion rests on one task, one corpus, English-only data, and single-turn calls; ASR also measures passing, not subsequent harm.They note that the phrase pool for adaptive attacks favors JEV, and that only one JEV version was tested.Source: §9 · p. 13

10 Related Work

  • Prior robustness studies examine generative decision layers or JEV alone; this paper compares JEV, LLM judges, and classifiers under the same attacks.JEV answers deployment-defined typed questions with probabilities rather than generating free text or returning one fixed-taxonomy label.Source: §10 · p. 13

A T2 and T3: Details

These appendix analyses qualify the headline attack comparisons by detailing classifier performance, repeat-query variation, attack placement, cross-question interference, and the components of A5a. They show that action changes, probability shifts, and attack effects can differ by system and task.

A T2 and T3: Details

  • On T2, generative judges reached TPR 0.95–0.98 at FPR 0.00; the local classifiers performed worse, with Llama Guard 3 at TPR 0.30 and Prompt Guard 2 results varying substantially by model size.Prompt Guard 2’s 86M model reached TPR 0.64 at FPR 0.05; its 22M model reached TPR 0.11 at FPR 0.04.Source: A T2 and T3: Details · pp. 15–16

B Repeated Queries: Details

  • JEV’s raw severity changed on 75.0% of repeated queries, but its routed action changed on only 1.0%.The policy acts when severity crosses 2.0, so small within-level changes rarely alter the decision.Source: B Repeated Queries: Details · p. 16

C A11: Attack Placement

  • Moving A1b’s sentence from attacker-writable state to developer instructions got 0.00 through against JEV, but could not establish whether placement matters because A1b barely worked in state.The result was also 0.00–0.07 against LLM judges.Source: C A11: Attack Placement · p. 16

D A6: Interference Between Questions

  • JEV’s untargeted-question interference ranged from 0.010 to 0.044 across A6 variants; A6b was its only variant with an ASR interval excluding zero, at 0.06.A6b and A6e shifted GLM-5.2 and GLM-5.1 by as much as 0.197 and 0.189, respectively.Source: D A6: Interference Between Questions · p. 16

E A5a: Which Part Does the Work

  • A5a’s explanation request flipped 56% and 54% of decisions blocked by the two GPT judges, versus 9% for JEV; the comparable phishing attack made Llama Guard 3 miss 62%.A5a adds a general-audience safety-awareness purpose and asks for abstract reasons, not instructions.Source: E A5a: Which Part Does the Work · p. 16, §E.1 · p. 16

E.1 The Two Parts of A5a

  • On every LLM judge, the explanation request alone reproduced A5a’s effect; on JEV, neither the purpose nor explanation alone worked, and only their combination did.The 2×2 experiment used 100 JailbreakBench harmful requests; its control was zero by construction because every denominator sample was blocked when clean.Source: Figure 8 · p. 17, Table 5 · p. 17

E.2 A 2×2 Experiment

The 2×2 test isolates explanation-request language from stated purpose: explanation alone drives LLM-judge bypasses, while JEV changes only when both parts appear. The dilution test did not create a near-threshold comparison, leaving that regime unresolved.

E.2 A 2×2 Experiment

  • Explanation-only phrasing yielded ASRs of 0.32–0.57 on the five LLM judges, while JEV’s ASR was 0.00 alone and 0.09 only when combined with purpose.For JEV, explanation alone lowered mean severity from 2.53 to 2.23, just above the 2.0 block threshold.Source: §E.2 · p. 17

E.3 Open Questions

  • Three open questions remain: which explanation wording matters, whether purpose effects generalize beyond teaching materials, and whether routing shows the same pattern.The authors suggest a general-description wording test, an unrelated-purpose test, and a routing-task test.Source: §E.3 · p. 17

F A4: Why the Dilution Test Is Inconclusive

  • Because both groups lay far from threshold, dilution showed no effect and A4 cannot answer what happens to genuinely near-threshold requests.Finding such requests would require knowing in advance how JEV scores them.Source: F A4: Why the Dilution Test Is… · p. 18
  • JEV’s XSTest “near” requests were farther from threshold than JailbreakBench’s: mean margins 0.87 vs 0.71 and medians 0.98 vs 0.79.The figure shows the intended near/far group ordering failed, most clearly for JEV and GLM-5.3.Source: Figure 9 · p. 18, F A4: Why the Dilution Test Is… · p. 18
  • JEV’s small dilution ASR on XSTest was 0.03–0.04, while the 1k- and 16k-token conditions matched, so the authors draw no conclusion.On JailbreakBench, the reported ASR was 0.00.Source: F A4: Why the Dilution Test Is… · p. 18

G A8 Figure

  • Figure 10 plots the A8 results whose numerical values are reported in §8.2.Source: G A8 Figure · p. 18

H Number of Options in T3: Details

The routing test adds irrelevant options to check whether the result depends on a two-option question. The accompanying attack-template material defines payload notation and catalogs the variants used in the experiments.

H Number of Options in T3: Details

  • Figure 10’s A8 plot reports success on 50 blocked requests closest to threshold under probability or routed-action feedback, plus full-search runtime on a log scale.Source: Figure 10 · p. 18
  • At 8, 16, and 32 routing options, no system selected an added option, and attacker-action selection stayed at 0% except GLM-5.1’s 0.06 at 8 and 16 options.This supports the conclusion that T3’s result does not depend on having only two options.Source: H Number of Options in T3: Details · p. 18

I Attack Templates

  • The attack catalog transcribes experiment-script templates, with G denoting the unchanged harmful request or email and B a benign request; some adaptive-search phrase sequences are withheld.The phrase pool is provided, while the sequences ending A8, A9, and A14 for each target are withheld.Source: I Attack Templates · p. 18

I.1 Prose attacks (A1, A2, A5, A6)

  • The prose attacks cover direct injection, self-justifying framing, severity lowering, and interference with individual questions or the severity score.Examples include fake safety approvals, educational or fictional framing, requests for abstract explanation, and denials of specific hazards.Source: §I.1 · pp. 18–19

T1 Yes

The T1 and T4 attack templates include obfuscation, adaptive search, and forged verdicts, with variants adapted to the task’s input format. These passages describe attacks and payloads rather than their outcomes.

T1 Yes

  • T1 attack families include severity-score interference, language and encoding obfuscation, adaptive phrase search, forged prior verdicts, and instruction-field placement probes.A8 keeps helpful phrases for up to eight queries; A9 retains a phrase only if it lowers the margin across four Nouls and the severity Score.Source: T1 Yes · p. 19

T4 Yes

  • T4 structured variants also test forged prior verdicts and combined moderation fields, while the field-name sweep varies verdict vocabulary, confidence, and nesting depth.The sweep includes generic status, prior-verdict, and JEV-like vocabularies.Source: T1 Yes · p. 19
  • T4 variants adapt the prose attacks to emails, including training-example framing, high-level or abstract descriptions, benign-purpose claims, and hazard-denial statements.Source: T4 Yes · p. 20

I.2 Structured-state attacks (A3, A10, A12, A13)

The structured-state attacks place purported safety verdicts or metadata alongside the content, in nested wrappers, or in fields modeled on moderation systems. T4 variants adapt the verdict fields and labels to phishing classification.

I.2 Structured-state attacks (A3, A10, A12, A13)

  • Structured attacks forge safe or approved moderation fields, insert a system-role approval, duplicate a JSON content key, or bury a safety verdict in nested metadata.Source: §I.2 · p. 20
  • Prior-verdict attacks mimic JEV’s output schema or a generic moderation API, including versions buried in pipeline-trace wrappers.Combined T4 variants place forged content-moderation fields alongside an upstream-moderation block.Source: §I.2 · p. 20
  • For T4, verdicts use phishing-oriented labels such as legitimate and pass; the field-name sweep varies vocabulary, confidence, and nesting depth.Source: §I.2 · p. 20

I.3 Dilution and obfuscation (A4, A7)

The methods define dilution and obfuscation variants, adaptive phrase search, and the official input battery used to evaluate Jev and LLM judges. They also specify how battery answers map to routed actions.

I.3 Dilution and obfuscation (A4, A7)

  • A4 varies benign filler length and placement, while A7 tests translation, character substitutions, zero-width spaces, homoglyphs, and base64 encoding.A4 uses 1k, 4k, or 16k tokens of filler; T4 instead adds short newsletter paragraphs around the email.Source: §I.3 · p. 20

I.4 Adaptive search and probes (A8, A9, A11, A14)

  • A8, A9, and A14 add phrases through target-specific adaptive search, retaining them when they reduce harmful_request probability, margin score, or P(phishing), respectively.With routed-action feedback, a phrase is retained only if the action becomes less severe; for T4, only a flip to legitimate counts.Source: §I.4 · p. 20

J The Official INPUT_BATTERY, Verbatim

  • The T1 battery is sent verbatim to Jev and paraphrased for LLM judges, with jailbreak, harmful_request, medical_advice, and self_harm yes/no questions.Each Noul pairs its question instruction with yes/no criteria.Source: J The Official INPUT_BATTERY, Verbatim · pp. 20–21
  • The battery also scores severity from 0 to 3, while the strict routing policy maps Nouls and severity thresholds to support, block, review, or pass actions.The specified thresholds are 0.70 for triggering an action, 0.35 for review, and severity ≥2.0 to upgrade review to block.Source: J The Official INPUT_BATTERY, Verbatim · p. 21

Related papers

Loading 2610.17820v1…