Shortcut Sensitivity in Agent-Safety Evaluations
Changing a marker or tool name shifted Haiku’s blocking rate—even though every unsafe call remained blocked.
On a fixed 64-step test set, rewriting the `<INFORMATION>` marker lowered blocking by 8.33 percentage points, while opaque tool aliases raised it by 11.46 points. The changes affected false positives against the dataset’s inherited labels and altered measured accuracy. Both effects remained nonzero after accounting for a formatting placebo, but effects of that size did not reproduce in Luna or deterministic Q8 TS-Guard. The authors recommend domain holdouts, metrics calculated at the interaction level, and placebo-controlled paired tests.
ArXiv · AI/CL/LG's note
On a fixed 64-step test set, rewriting the `<INFORMATION>` marker lowered blocking by 8.33 percentage points, while opaque tool aliases raised it by 11.46 points. The changes affected false positives against the dataset’s inherited labels and altered measured accuracy. Both effects remained nonzero after accounting for a formatting placebo, but effects of that size did not reproduce in Luna or deterministic Q8 TS-Guard. The authors recommend domain holdouts, metrics calculated at the interaction level, and placebo-controlled paired tests.
ArXiv · AI/CL/LG's note
score 5