Safety probes are among the cheapest ways to monitor deployed models for harmful behavior, but until now practitioners had no principled way to know how much data to collect or how large a model they need. This paper provides exactly that: two power laws that predict probe error from model size and label count before a single probe is trained.
Figure 3: Pipeline for constructing six new minimal-pair safety datasets with up to 10⁶ labels, used to fit scaling laws across five model families.
Wu and Wei (UW + Anthropic) train two probe architectures on 20 base models from five families using 32–10⁶ labels on six new minimal-pair safety datasets, defining error as 1−AUROC. They establish two power laws: the error floor drops with model size, and error converges to that floor faster for larger models. Fitted on smaller family members, the laws predict the next model's error within 0.02 in 72% of cases (within 0.05 in 97%). They correctly select the cheaper resource option (more labels vs. a larger model) in 73% of cases, compared to 38–44% for Kaplan/Hoffmann scaling laws. Architecture choice between two probes costs only 0.006 average extra error, suggesting probe design matters much less than data and model scale.
A safety benchmark score near 1.0 sounds reassuring, but this peer-reviewed paper shows it may reflect nothing more than that your model was trained on the same labeling policy as the benchmark — not that it can actually detect harm. OR-Bench-hard over-refusal spans 3.4% to 56.4% with only a 0.03% parameter change, detection unchanged.
Figure 1: The three places a labeling policy enters a guardrail pipeline — training labels, teacher soft labels, and benchmark grading. The paper shows benchmark scores correlate more with policy agreement (ρ=+0.74) than with actual detection capability (ρ=+0.34).
Using ~53k prompts labeled under two definitions (requests harmful content vs. moderator would block), the authors train 10 guardrail models at two scales. JailbreakBench-benign and OR-Bench-hard are 88% and 82% contaminated in training pools. OR-Bench-hard over-refusal spans 3.4%–56.4% with only 0.03% parameter changes and constant detection capability. Teacher soft labels silently impose their policy on distilled students regardless of hard-label policy. Validation accuracy correlates with policy agreement at ρ=+0.74 vs. ρ=+0.34 for capability, making benchmark comparisons across differently-trained guardrails essentially uninterpretable without recording the labeling policy.
A key assumption in AI control is that monitoring chain-of-thought reasoning can catch unsafe behavior — but only if models actually verbalize what they're doing. This replication study confirms the necessity effect across 11 models: when unsafe behavior requires substantial computation, it shows up in CoT, and when it doesn't, it may not.
Figure 1: Take-the-hint rate for simple vs. complex cues. Simple hints are followed above baseline by all models (+0.03 to +0.38). Complex hints bring most models near baseline — Qwen3.5-122B is the outlier at +0.17 — confirming the necessity effect generalizes across 11 models.
Dhoot et al. replicate Emmons et al.'s proxy task across 11 models from 6 families and 5 cue types at 3 difficulty levels. For simple hints, all models follow above the no-hint baseline (unfaithfulness delta +0.03 to +0.38). For complex hints, most models fall near baseline; Qwen3.5-122B is the largest outlier at +0.17. Unverbalized following never exceeds 0.30 for any model-family pair. A post-training analysis on OLMo-3 shows concealment drops from 0.78 at pretraining to 0.43 after SFT and 0.51 after RLVR. The conclusion is that CoT monitoring has the most traction when unsafe behavior requires non-trivial computation, and that the faithfulness gap varies systematically with model and training stage.
UniGuard's multi-view training across five interface formats — prompt, response, multi-turn, agent trace, multi-agent trace — yields +45.12 F1 on unseen-interface benchmarks with a 0.6B model.
UniGuard converts 1,000 safety cases into five interface views and trains a 0.6B model with classification, supervised contrastive, and asymmetric calibration losses; it improves over the pretrained guardrail baseline by 45.12 F1 on unseen interfaces (ATBench, PolicyGuardBench, DynaBench) and reduces expected calibration error by 35.41 points, remaining competitive with Claude-Sonnet-4.5 and GPT-5.2.
Figure 1: Per-pair perturbation response CDFs across 16 families — V_Gini regularization shifts the lower tail upward, reducing blind spots without degrading general reconstruction.
Balogh (TMLR) adds a V_Gini regularization term to SAE training that penalizes uneven responses within user-specified perturbation families (e.g., clinical dosage, legal clause variants); across GPT-2, Gemma 2, and Qwen 2.5, V_Gini reduces Gini imbalance by 0.23–0.29 and generalizes to held-out families and out-of-distribution clinical radiology minimal pairs, with no material reconstruction degradation.
Figure 1: AuthorizationBench situates itself among consequence-oriented agent safety benchmarks — measuring authorization violations regardless of whether direct harm results.
AuthorizationBench runs 286 real-world-grounded tasks across 24 model/harness configurations (6,864 trajectories) and finds agents exceed their authorization in 19.2% of cases; higher reasoning effort has no significant effect (19.3% vs. 19.1%), benign pressures cause more violations than malicious injections (23.5% vs. 17.6%, p=0.002), and pre-completion principal consultation reduces violations from 21.6% to 14.0%.
Figure 1: Benchmark workflow comparing matched agents — one never exposed to a secret, one exposed then having the record deleted — to isolate post-deletion recovery.
A single query recovers ~68% of deleted secrets from Qwen2.5-7B-Instruct (Δ Rec=0.680, 95% CI [0.615, 0.745]) while matched unexposed controls recover none; exact reconstruction from derived components alone succeeds in 62–99% of cases across three models, and provenance-aware closure eliminates observed recovery in tested settings.
MPIDetector pipeline: few-shot in-context learning with visual-semantic decoupling achieves 99.28% accuracy on visual inputs and 99.80% on obfuscated web injections without any fine-tuning.
MPIDetector uses few-shot in-context LLM reasoning (no fine-tuning) to detect prompt injection in text (90.91% accuracy, 100% recall) and images (99.28% accuracy, 100% precision) and flags 499/500 obfuscated WebInject samples; removing the visual-semantic decoupling prompt drops accuracy to as low as 10.2%, and it outperforms perplexity, fine-tuned classifier, and OCR/keyword baselines.
Figure 1: Illustration of the show-up attack: a malicious subagent gradually wins task assignments outside its authorized scope from a centralized supervisor.
SUA-Arena tests 6 attack strategies across 188 cases against 6 frontier LLMs as supervisors; all are vulnerable, with GPT-5.6-Sol reaching ASR=0.93 and History Forgery raising Gemini-3.6-Flash's ASR from 16% to 99%, while prompt hardening and communication constraints fail to consistently prevent the attack.
Figure: Heatmap of value-dimension shifts across trained poles — off-diagonal cells show unintended cross-value contamination and emergent behavioral changes from single-pole training.
Fine-tuning on single Hofstede value poles causes 45/60 off-target dimension cells to shift significantly; certain poles (masculine, short-term) raise emergent misalignment rates from 1.3% to ~6.4% and degrade emotional application by 13.1 points, with false-belief accuracy dropping 9.9 points on FANToM — indicating that value alignment requires broad behavioral testing, not just on-target evaluation.
