LLM safety judges vulnerable to style-based manipulation, study finds

Researchers have discovered that automatic safety judges for large language models, such as Llama Guard and GPT-4o, can be easily manipulated by altering the style or framing of a response without changing its underlying content. By adding content-invariant wrappers like educational disclaimers or fake reasoning blocks, they were able to flip the safety verdicts of these judges. For instance, a token-refusal wrapper caused GPT-4o-mini to misclassify nearly 20% of unsafe replies as safe, while Llama Guard 4 was deterministically gamed by an "educational course" framing. These findings highlight significant vulnerabilities in current LLM safety evaluation methods, suggesting that the judges themselves, rather than the models they assess, are the source of these exploitable blind spots. AI

IMPACT Reveals critical flaws in LLM safety evaluation, potentially impacting trust and deployment of AI systems.

RANK_REASON Research paper detailing vulnerabilities in LLM safety evaluation methods. [lever_c_demoted from research: ic=1 ai=1.0]

Read on Hugging Face Daily Papers →

• Claude
• GPT-4o
• GPT-4o mini
• gpt-oss-safeguard-20b
• JailbreakBench
• Llama Guard
• Llama Guard 4
• StrongREJECT

• safety
• paper

AI-generated summary · Google Gemini · from 1 sources. How we write summaries →