arXiv：cs.AI· Yongxi Zhou, Wenbo Ye, Yuanzhe Liu, Zihan Dong, Junwei Yao, Jiahui Ge·· 16 小时前
风格胜于实质：内容不变的包装如何翻转 LLM 安全评判结果
Style Over Substance: Content-Invariant Wrappers Flip LLM Safety-Judge Verdicts
AI 导读
研究发现，在不修改回复内容的前提下，仅在模型回复前后添加风格包装即可翻转部分 LLM 安全评判器的判定。在 600 余条 JailbreakBench 回复、9 种包装和 8 个评判器测试中，前置一句"我无法帮助"的 token 拒绝使 GPT-4o-mini 将 19.9% 的正确"不安全"判定翻转为"安全"（噪声底线 0.5%），而 Claude 仅变动 0.4%。
正文
Abstract:Automatic safety judges -- for example Llama Guard, or GPT-4o given a grading prompt -- produce the numbers behind reported jailbreak success rates, defense evaluations, and safety leaderboards. We ask whether these judges grade what a reply contains or how it sounds. We place a fixed piece of text before or after a model reply (a style wrapper) and leave the reply itself unchanged byte-for-byte, so any change in verdict is an error of the judge. Over 600 JailbreakBench replies (300 harmful, 300 refusals), 9 wrappers, and 8 judges, using paired tests and a measured per-judge repeat-disagreement rate (the noise floor), we find that most judges barely move but specific judges have specific, cheap blind spots. A token refusal ("I can't help with that") placed before the unchanged harmful text flips 19.9% of GPT-4o-mini's correct "unsafe" verdicts to "safe" (noise floor 0.5%; 18.2% under majority-of-three re-scoring), yet moves Claude only 0.4%. The deployed Llama Guard 4 guard model is evaded by an "educational course" preface on 12.3% of harmful replies, and the flips persist across repeats, while a second deployed guard (gpt-oss-safeguard-20b) is immune. Changing only the grading prompt to ignore tone cuts the GPT-4o-mini attack roughly tenfold on the same model, so the weakness lives in the judge, not in the content. Pure tone-only decoration that adds no new claim still flips up to 2.1% of verdicts on the vulnerable judges, several times their noise floors. On this artifact set the judges also disagree about which target model is safest, and a bootstrap shows the ranking is unstable before any wrapper is added. We release the data, wrappers, code, and per-verdict labels.
| Comments: | 11 pages, 4 tables. Code, wrappers, and per-verdict labels: this https URL. "v2: expanded judge panel to 8, measured noise floors for all LLM judges, added appendices with wrapper texts and judge prompts" |
| Subjects: | Artificial Intelligence (cs.AI) |
| ACM classes: | I.2.7; K.6.5 |
| Cite as: | arXiv:2609.08236 [cs.AI] |
| (or arXiv:2609.08236v2 [cs.AI] for this version) | |
| https://doi.org/10.48550/arXiv.2609.08236 arXiv-issued DOI via DataCite |
Submission history
From: Yongxi Zhou [view email]
[v1]
Tue, 8 Sep 2026 04:27:22 UTC (33 KB)
[v2]
Mon, 12 Oct 2026 02:16:44 UTC (36 KB)
来源：arXiv：cs.AI · arxiv.org