Search papers, labs, and topics across Lattice.
This study investigates the safety implications of batch prompting in large language models, revealing that harmful questions embedded within benign prompts can elicit dangerous responses, despite being refused in isolation. The authors identify this as a unique safety failure mode, distinct from known vulnerabilities, and analyze it through the lenses of alignment signal weakening and refusal signal dilution. Their findings demonstrate that batch prompting poses a significant risk across various models, but can be effectively mitigated through batch-aware preference optimization.
Harmful prompts can slip through safety nets when embedded in benign batches, revealing a critical vulnerability in current AI safety measures.
Batch prompting is a practical inference strategy for large language models, but its safety implications remain underexplored. We show that the success of batch prompting for utility does not extend to safety: a harmful question that is reliably refused in isolation can elicit a harmful response when embedded in a batch of benign questions. We identify this as a distinct safety failure mode, not reducible to known vulnerabilities such as in-context learning or long-context effects, and analyze its causes from two complementary perspectives: alignment signal weakening and refusal signal dilution. Across widely used open-source and frontier commercial models, batch prompting consistently achieves high attack success rates as a simple black-box attack. We further show that batch-aware preference optimization effectively mitigates the vulnerability. These findings highlight a blind spot in current safety alignment and point to batch-aware alignment as a necessary step toward robust deployment.
