Search papers, labs, and topics across Lattice.
This paper identifies a critical gap in the evaluation of Large Language Model (LLM) safety, termed the audit gap, which highlights the discrepancy between behavioral safety and representation-level robustness. By constructing dissociated models that maintain safe outward behavior while being vulnerable in their latent space, the authors introduce an intervention-based evaluation framework that utilizes the Latent Vulnerability Score (LVS) to quantify susceptibility to harmful interventions. The findings reveal that traditional behavioral safety metrics fail to capture significant vulnerabilities, particularly in intermediate representations, underscoring the need for more nuanced assessments of model robustness.
Behavioral safety metrics can mask significant latent vulnerabilities, with dissociated models revealing a stark contrast between outward behavior and internal robustness.
Large Language Model (LLM) safety has often been evaluated at the behavior level, which provides limited evidence of internal robustness, as these evaluations target outputs rather than representation-level vulnerability under intervention. We formalize this discrepancy as the audit gap: the difference between behavioral safety and robustness under intervention. To study this gap, we construct dissociated models that preserve safe outward behavior while remaining vulnerable in the latent space. We introduce an intervention-based evaluation framework to test model robustness through soft interventions in parameter and latent spaces, including harmful fine-tuning and layer-wise latent perturbations. To formalize the evaluation, we propose the Latent Vulnerability Score (LVS) to measure how easily harmful behavior can be elicited by bounded latent perturbations. Using this evaluation framework, we show that behavioral safety metrics are insufficient measures of representation-level robustness across multiple safely and unsafely aligned state-of-the-art models. Notably, dissociated models show substantially elevated LVSs despite comparable refusal behavior under harmful intervention, with intermediate representations being the most sensitive to intervention. Our results suggest that behavioral safety evaluation alone provides an incomplete picture of model robustness, motivating representation-aware audits of latent vulnerability and observable behavior.
Stanford HAI