The Safeguard Worked. Is the LLM System Safer?
A safeguard’s own success rate does not prove the deployed system gives attackers less harmful help.
The paper argues that refusal, attack success, and policy-violation rates measure a control on tested requests, not the residual risk of the live service. One successful adaptive attack is enough to show harmful assistance remains. Showing that little remains requires evidence about what the surrounding system still permits after the safeguard acts, and the authors say that evidence appears in only a small minority of coded claims. HF Daily Papers' note
The paper argues that refusal, attack success, and policy-violation rates measure a control on tested requests, not the residual risk of the live service. One successful adaptive attack is enough to show harmful assistance remains. Showing that little remains requires evidence about what the surrounding system still permits after the safeguard acts, and the authors say that evidence appears in only a small minority of coded claims. HF Daily Papers' note
score 4