The Flow has not summarised this story yet — read it at arXiv Computation and Language.
The paper evaluates TypeSafe AI’s Jev safety judge against GPT and GLM judges and local classifiers using a controlled adversarial test harness. Jev shows strong robustness on rule‑based tasks like input moderation, with minimal bypasses, but performs less well on judgment‑based tasks such as phishing detection, where it misses a higher proportion of phishing emails and is more prone to false positives. The study highlights Jev’s speed advantage and varying resilience depending on task type.
The paper investigates how standard evaluations of detectors for hijacked large language model (LLM) agents may conceal important weaknesses. By auditing eleven evaluations on the AgentDrift and AgentDojo benchmarks, the authors show that detectors often perform poorly when faced with rare attacks, unseen tools, or data from a different benchmark, with precision dropping dramatically at low attack rates and rankings reversing as tool coverage falls. They also find that a released LLM action monitor, despite high AUROC on its own data, would still generate many false alerts when applied to a new benchmark. "whyItMatters":"The study highlights that current evaluation practices can give a misleading sense of detector reliability, underscoring the need for more robust, cross‑benchmark testing to ensure real‑world safety of LLM agents."
The paper evaluates safety monitors by measuring recall only on prompts that the target model actually answers, rather than on all harmful prompts. Across several guard systems, recall at a 1% false‑positive rate drops sharply when focusing on answered prompts, with monitors catching refused requests 1.1–6.4 times more often than answered ones. Rewriting prompts to be less explicit dramatically increases compliance and reveals that many harmful requests slip past monitors, especially when phrasing is softened. Fine‑tuning guards on these rewritten prompts improves recall from 0.24 to 0.89 on answered requests and generalizes to unseen benchmarks.
arXiv:2608. 09624v1 Announce Type: cross Abstract: Internal safety scores judge a prompt before any text is generated, and they are validated by how well they separate harmful prompts from benign ones.
arXiv:2606. 25487v1 Announce Type: cross Abstract: Almost every paper on LLM jailbreaks and prompt injection reports an attack-success rate (ASR), and that number is assigned not by people but by an automated judge: either a safety classifier trained for the task, or a general chat model prompted to grade.
Almost every paper on LLM jailbreaks and prompt injection reports an attack-success rate (ASR), and that number is assigned not by people but by an automated judge: either a safety classifier trained for the task, or a general chat model prompted to grade. The judge is rarely checked.