安全监测器实际防护力低于评估值，因它常漏掉模型会响应的危险请求。
Recall Is Not Protection: Evaluating Safety Monitors Against Model Compliance
- 通过测试模型是否曾响应过同一提示，区分可诱导和不可诱导的危险请求。
- 在相同误报率下，监测器对可诱导提示的召回率比不可诱导提示低0.22至0.38。
- 被漏掉的危险请求被模型执行的可能性是被拦截请求的2.8到5.6倍。
安全监测器在部署语言模型前筛查输入提示，标记有害请求以防止回答。当前评估依赖召回率，但只有当模型本会响应时，拦截才有意义。本文直接测量这一差异：通过重复采样目标模型的输出，若模型至少一次响应则将提示定义为‘可诱导’，并分别报告监测器在可诱导与不可诱导提示上的召回率。在六种监测配置和三种模型家族中，固定误报率下，可诱导提示的召回率较不可诱导提示低0.22至0.38。被监测器遗漏的提示，其被模型实际回应的概率是被拦截提示的2.8至5.6倍。该差距在三种模型族中均复现，且在仅基于文本的监测器中亦存在，表明标准召回率可能高估了监测器的实际保护效果，建议以模型真实响应行为作为评估基准。
原文摘要 · Abstract (English)
Safety monitors screen prompts sent to deployed language models, flagging harmful requests so they are never answered. They are evaluated by recall against harmfulness labels, but a catch only prevents harm if the model would otherwise have complied. We measure the difference directly: we sample repeated responses from the target model, call a harmful prompt \emph{elicitable} if the model complies at least once, and report monitor recall separately on elicitable and non-elicitable prompts. Across six monitor configurations and three model families, spanning activation probes, fine-tuned text guards, and a 120B policy-conditioned reasoning classifier, recall on elicitable prompts falls 0.22 to 0.38 below recall on non-elicitable prompts at a fixed false positive rate. The prompts a monitor misses are 2.8 to 5.6 times more likely to be complied with than the prompts it catches. The gap replicates across three model families and appears also in text-only monitors entirely independent of the target model. This suggests that standard recall may overstate the protection monitors provide in practice, and that monitors should be evaluated against what their models will actually answer.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。