Search papers, labs, and topics across Lattice.
This paper evaluates the effectiveness of safeguards in deployed large language models (LLMs) by analyzing refusal rates, attack success, and policy violation rates, emphasizing the need to assess how much assistance these models still provide to attackers. The authors argue that while local performance metrics may improve, they do not necessarily correlate with increased safety in real-world deployments, as a single successful attack can undermine the perceived effectiveness of safeguards. By establishing a framework for comparing different safeguard families under a unified deployment criterion, the study highlights the asymmetry in evidence requirements and the necessity for deeper analysis beyond surface-level metrics.
A single successful attack can reveal persistent vulnerabilities in LLM safeguards, challenging the assumption that improved local scores equate to enhanced safety in deployment.
Safeguards in deployed LLM services are evaluated by refusal, attack success, and policy violation rates. Those rates characterize how a control performed on the requests it was tested on. A deployment has to answer a different question: how much help with harmful tasks the service still gives an attacker who keeps adapting or finds another way in. We determine what each reported result implies for that question, allowing results from different safeguard families to be compared under one deployment criterion. The evidence requirements are strongly asymmetric. One attack that obtains harmful help from the deployed service suffices to establish that such help remains, and such attacks appear repeatedly in the coded record. Establishing that little remains cannot follow from the safeguard's own numbers alone; it also requires evidence about what the surrounding system still allows after the safeguard performs its local function. Such evidence is supported or derived in only a small minority of the depth-coded claims, and one such claim bounds its scoped residual. A better local score is therefore not, by itself, a stronger claim about the deployment. Safeguard research cannot stop at raising local scores; a gain has to be judged by whether it makes a deployed system any safer.
