给安全模型的回复加个语气包装，就能骗过部分安全检测器。
Style Over Substance: Content-Invariant Wrappers Flip LLM Safety-Judge Verdicts
- 用固定前后缀改变回复语气，内容完全不变
- 某些检测器对包装敏感，误判率高达19.9%
- 漏洞在检测器本身，不是内容问题，适合安全研究者
自动安全检测系统（如Llama Guard或GPT-4o）决定了几乎所有的越狱成功率、防御评估和安全排行榜。我们探究这些系统判断的是内容还是表达方式。在保持回复内容完全不变的前提下，添加仅改变语气的内容无关风格包装（如教育免责声明、伪造的安全推理块、令牌拒绝后接原有害内容，或对无害拒绝进行危险化表述）。由于内容字节不变，忠实的检测器应给出相同判断，任何翻转均为检测器错误。在600个JailbreakBench样本上，每样本最多7种形式，共8个检测器，通过配对显著性检验和噪声基线测量，发现结果并非普遍，而是特定检测器存在可被低成本利用的盲点。一个令牌拒绝包装使GPT-4o-mini对正确标记为不安全的回复误判率为19.9%（噪声基线0.5%；多数投票重评下为18.2%），而Claude仅受0.4%影响。部署版Llama Guard 4被确定性攻破：'教育课程'包装使12.3%的有害判断转为安全。另一部署检测器（gpt-oss-safeguard-20b）免疫该攻击，仅重写评分提示（StrongREJECT风格）就使攻击效果降低十倍——漏洞在于检测器而非内容。双标注员验证确认100%内容不变，90%翻转为检测器错误（kappa 0.95-1.0），Bootstrap分析显示底层模型排名本身已因采样不稳定。数据集、包装、代码及逐项标签均已公开。
原文摘要 · Abstract (English)
Automatic safety judges -- systems such as Llama Guard or a GPT-4o grading prompt that decide whether a model's reply is harmful -- produce the numbers behind almost every reported jailbreak success rate, defense evaluation, and safety leaderboard. We ask whether these judges grade what a reply contains or how it sounds. We keep a reply's content fixed and add content-invariant style wrappers: fixed strings placed before or after the reply that change only its tone (an educational disclaimer, a fake safety "reasoning" block, a token refusal followed by the unchanged harmful body), or, on harmless refusals, framing that merely sounds dangerous. The body is preserved byte-for-byte, so a faithful judge must return the same verdict, and any flip is an error of the judge, not a change in safety. Over 600 JailbreakBench replies x up to 7 forms x 8 judges, we measure flip rates with paired significance tests and measured noise floors. Findings are precise rather than universal: most judges barely move, but specific judges harbor cheaply exploitable blind spots. A token-refusal wrapper flips 19.9% of GPT-4o-mini's correct "unsafe" verdicts (noise floor 0.5%; 18.2% under majority-of-three re-scoring) yet moves Claude only 0.4%. The deployed Llama Guard 4 is deterministically gamed: an "educational course" framing flips 12.3% of its harmful verdicts to safe. A second deployed guard (gpt-oss-safeguard-20b) is immune, and rewriting only the grading prompt (StrongREJECT-style) cuts the attack tenfold on the identical model -- the vulnerability lives in the judge, not the content. A two-annotator human validation confirms 100% content invariance and 90% of flips as judge errors (kappa 0.95-1.0), and a bootstrap shows the underlying model ranking is already unstable to sampling alone. We release the dataset, wrappers, code, and per-verdict labels.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。