安全分类器部署中，对抗输入会耗尽推理资源，导致监控失效。
Online Shift Detection and Conformal Adaptation for Deployed Safety Classifiers
- 用评分不一致检测模型被定向攻击的信号
- 发现编码器易识破改写漂移，解码器难辨对抗后缀
- 提出可抵御对抗攻击的在线检测与自适应机制
部署为安全监控的推理模型存在系统性漏洞：推理令牌预算枯竭。对抗输入需比正常输入多3.3倍的推理令牌才能生成有效安全评分（o3模型下，$T_{50, ext{adv}} = 154$ vs. $T_{50, ext{benign}} = 46$），低预算部署会在最需识别的输入上使监控悄然失效。这加剧了核心风险：梯度驱动的规避攻击仍是残余威胁——模板越狱在99%情况下失败，但GCG优化的后缀能可靠翻转编码器决策。本文系统化构建“哨兵”机制，通过目标与非目标分类器间的评分分歧进行监控，并量化其在定向攻击下的可靠性。推导出精确的安全边界——在信心门控平衡点处，监控感知的攻击者将停滞（验证间隙$= 1/(2λ)$，在95%置信区间内符合理论）。同时识别出转移后置信自适应中的失效模式。主要贡献有三：(1) 因子漂移基准测试。预注册800组评估（4个分类器 × 5种漂移类型 × 20个种子 × 2个窗口），显示检测难度主要受分类器×漂移交互影响（η² = 0.185）：编码器在28步内检出改写漂移，却错过对抗后缀达37步；解码器则相反。(2) 生成嵌入中的置信坍塌。加权置信预测在解码器分类器上失效：逻辑密度比估计在3584–4096维空间实现完美分离，导致所有重要性权重被截断至零。投影至≤32维后恢复覆盖率（+33个百分点）。(3) 对抗哨兵威胁模型。在35个前沿模型上，四层威胁模型提供部署保障（≥71%检测率，FPR < 1.5%，N=1000）。
原文摘要 · Abstract (English)
Reasoning models deployed as safety monitors exhibit a systematic vulnerability: reasoning-token budget starvation. Adversarial inputs require $3.3\times$ more reasoning tokens than benign inputs to produce valid safety scores ($T_{50,\text{adv}}{=}154$ vs. $T_{50,\text{benign}}{=}46$ for o3), so low-budget deployments silently starve the monitor on exactly the inputs it must catch. This compounds the central failure mode: gradient-based evasion remains the residual threat - template jailbreaks fail at 99%, but GCG-optimized suffixes flip encoder decisions reliably. We systematize a canary construction - score-disagreement monitoring between a targeted and un-targeted classifier - and quantify its reliability under targeted evasion. We derive the exact security boundary - a confidence-gated equilibrium at which a monitor-aware attacker stalls (validated gap $= 1/(2λ)$, within 95% CI of theory) - and identify a failure mode in post-shift conformal adaptation. Three contributions. (1) Factorial drift benchmark. A pre-registered 800-cell evaluation ($4$ classifiers $\times$ $5$ shift types $\times$ $20$ seeds $\times$ $2$ windows) reveals detection difficulty is dominated by a classifier$\times$shift interaction ($η^2 = 0.185$): encoders detect paraphrase drift in 28 steps but miss adversarial suffixes for 37; decoders show the opposite. (2) Conformal collapse in generative embeddings. Weighted conformal prediction fails on decoder classifiers: logistic density-ratio estimation achieves perfect separability in 3584--4096-dimensional space, clipping all importance weights to zero. Projecting to $\leq$32 dimensions restores coverage (+33pp). (3) Adversarial canary threat model. Across 35 frontier models, a 4-tier threat model yields deployment guarantees ($\geq$71% detection, $<$1.5% FPR at $N{=}1000$).
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。