模型安全评估结果受部署架构影响极大，不能直接推广到实际应用。
Safety Under Scaffolding: How Evaluation Conditions Shape Measured Safety
- 测试不同部署方式对模型安全性的量化影响
- 分解式调度使安全得分下降14个百分点，主因是题型格式变化
- 同一模型在不同架构下表现差异巨大，安全分数不可靠
一个模型在基准测试中获得的安全评分，并不能预测其在代理架构中实际行为的表现。我们对六款前沿模型在四种部署配置（直接API、ReAct、多代理批评、地图-归约委派）下进行了62,808次盲测、预注册、等效性验证评估，覆盖四个安全基准（BBQ、TruthfulQA、XSTest/OR-Bench、谄媚性），并包含三项辅助分析。ReAct和多代理架构保持在预注册±2个百分点的等效范围内；而地图-归约委派导致安全得分显著下降（NNH = 14），但该损失主要为测量偏差：相同题目，选择题与开放题形式使安全率相差5-20个百分点，且分解过程隐性移除了选项。约40%-89%的模型安全损失源于格式转换而非推理破坏，保留选项的变体可恢复大部分性能。聚合效应掩盖了模型-架构间的显著异质性：在相同题目下，Opus安全分下降16.8个百分点，而Llama 4反而提升18.8个百分点。结构上，架构设计仅解释0.4%的变异，基准选择解释力高45倍，通用性系数G=0.000（bootstrap 95% CI [0.000, 0.752]），区间过宽，表明单一综合安全分数无法作为部署依据。这些是‘简单情况’，诸如阴谋行为和高危风险提升等关键属性更可能受格式与架构敏感影响。代码、数据与提示已开源于ScaffoldSafety。
原文摘要 · Abstract (English)
A safety score earned on a benchmark need not predict how the same model behaves once it is wrapped in an agentic scaffold the benchmark never tested. We ran six frontier models through four deployment configurations (direct API, ReAct, multi-agent critic, map-reduce delegation): N = 62,808 blinded, pre-registered, equivalence-tested evaluations across four safety benchmarks (BBQ, TruthfulQA, XSTest/OR-Bench, sycophancy), plus three supporting analyses. ReAct and multi-agent scaffolds stay within a pre-registered +/-2 pp equivalence margin; map-reduce delegation degrades measured safety (NNH = 14), though that loss is largely a measurement artifact: on identical items, multiple-choice versus open-ended phrasing shifts the measured safety rate by 5-20 pp, and decomposition silently strips the multiple-choice options. Roughly 40-89% of the per-model map-reduce loss is this format conversion rather than reasoning disruption, and an option-preserving variant recovers most of it. Pooled effects also mask sharp model-by-scaffold heterogeneity: under map-reduce, on identical items, Opus loses 16.8 pp while Llama 4 gains 18.8 pp. Structurally, scaffold architecture explains only 0.4% of outcome variance (benchmark choice explains 45x more), and the generalizability coefficient is G = 0.000 (bootstrap 95% CI [0.000, 0.752]). An interval that wide is enough on its own to undermine the utility of any single composite safety number as a deployment criterion. These are the "easy cases"; consequential properties like scheming and CBRN uplift have no obvious reason to be less format- or scaffold-sensitive. Code, data, and prompts are released as ScaffoldSafety.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。