arXiv cs.AI· Yongxi Zhou, Wenbo Ye, Yuanzhe Liu, Zihan Dong, Junwei Yao, Jiahui Ge·· 3 天前AI 评分66
研究：内容不变仅加风格包装即可翻转 LLM 安全评审结论
Style Over Substance: Content-Invariant Wrappers Flip LLM Safety-Judge Verdicts
AI 导读
arXiv 论文《Style Over Substance》测试了在模型回复前后添加固定风格包装、回复本身逐字节不变时，安全评审结论是否改变。
正文 · 原文
Abstract:Automatic safety judges -- for example Llama Guard, or GPT-4o given a grading prompt -- produce the numbers behind reported jailbreak success rates, defense evaluations, and safety leaderboards. We ask whether these judges grade what a reply contains or how it sounds. We place a fixed piece of text before or after a model reply (a style wrapper) and leave the reply itself unchanged byte-for-byte, so any change in verdict is an error of the judge. Over 600 JailbreakBench replies (300 harmful, 300 refusals), 9 wrappers, and 8 judges, using paired tests and a measured per-judge repeat-disagreement rate (the noise floor), we find that most judges barely move but specific judges have specific, cheap blind spots. A token refusal ("I can't help with that") placed before the unchanged harmful text flips 19.9% of GPT-4o-mini's correct "unsafe" verdicts to "safe" (noise floor 0.5%; 18.2% under majority-of-three re-scoring), yet moves Claude only 0.4%. The deployed Llama Guard 4 guard model is evaded by an "educational course" preface on 12.3% of harmful replies, and the flips persist across repeats, while a second deployed guard (gpt-oss-safeguard-20b) is immune. Changing only the grading prompt to ignore tone cuts the GPT-4o-mini attack roughly tenfold on the same model, so the weakness lives in the judge, not in the content. Pure tone-only decoration that adds no new claim still flips up to 2.1% of verdicts on the vulnerable judges, several times their noise floors. On this artifact set the judges also disagree about which target model is safest, and a bootstrap shows the ranking is unstable before any wrapper is added. We release the data, wrappers, code, and per-verdict labels.
| Comments: | 11 pages, 4 tables. Code, wrappers, and per-verdict labels: this https URL. "v2: expanded judge panel to 8, measured noise floors for all LLM judges, added appendices with wrapper texts and judge prompts" |
| Subjects: | Artificial Intelligence (cs.AI) |
| ACM classes: | I.2.7; K.6.5 |
| Cite as: | arXiv:2609.08236 [cs.AI] |
| (or arXiv:2609.08236v2 [cs.AI] for this version) | |
| https://doi.org/10.48550/arXiv.2609.08236 arXiv-issued DOI via DataCite |
Submission history
From: Yongxi Zhou [view email]
[v1]
Tue, 8 Sep 2026 04:27:22 UTC (33 KB)
[v2]
Mon, 12 Oct 2026 02:16:44 UTC (36 KB)
来源：arXiv cs.AI · arxiv.org