跳转至

状态条件验证：用于适配与监控安全分类器的正确性估计

文章背景与核心概要

随着大语言模型（LLM）的广泛应用，与其配套的安全分类器在实际部署中面临两大核心难题：一是“策略差异”，即分类器的决策往往反映了训练时的策略，而非部署者特定的期望策略；二是“分布偏移”，随着用户行为和部署环境的演变，分类器的性能会随时间推移而自然下降。

为了解决这些问题，本文提出了“状态条件验证”（Regime-Conditional Verification, RCV）框架。RCV 是一种轻量级的包装器，无需对现有的安全分类器进行重训练即可实现适配。它通过分析分类器的内部表征来估计预测结果与部署者策略冲突的概率，从而有选择地修正潜在错误。此外，RCV 提供的正确性估计还可作为一种无标签信号，用于检测分布偏移，从而构建了一个高效的维护循环：仅在必要时才进行全量微调，极大地降低了模型维护成本。

📌 摘要

部署在大语言模型（LLM）旁的安全分类器通常面临两个基本问题： 1. 策略差异（Policy Discrepancy）： 它们的决策反映的是训练时的策略，而非部署者特定的期望策略。 2. 分布偏移（Distribution Shift）： 随着部署流量和用户行为随时间演变，它们的性能会自然下降。

Safety classifiers deployed alongside large language models (LLMs) often struggle with two fundamental issues: 1. Policy Discrepancy: Their decisions reflect the training-time policy rather than the specific, desired policy of the deployer. 2. Distribution Shift: Their performance naturally degrades as deployment traffic and user behavior evolve over time.

为了应对这些挑战，作者引入了状态条件验证（Regime-Conditional Verification, RCV）——这是一种轻量级包装器，无需重训练即可适配现成的安全分类器。RCV 通过分析分类器的内部表征来估计预测结果与部署者策略相悖的概率，从而有选择地纠正可能的错误。

To address these challenges, the authors introduce Regime-Conditional Verification (RCV)—a lightweight wrapper that adapts off-the-shelf safety classifiers without requiring retraining. RCV analyzes a classifier's internal representations to estimate the probability that a prediction contradicts the deployer's policy, selectively correcting likely errors.

此外，这些正确性估计为检测分布偏移提供了无标签信号，从而创建了一个精简的维护循环：它更新正确性估计层，仅在绝对必要时才诉诸于完整的分类器微调。

Furthermore, these correctness estimates provide a label-free signal to detect distribution shifts, creating a streamlined maintenance loop: it updates the correctness estimation layer and only resorts to full classifier fine-tuning when strictly necessary.

关键结果

  • 改进的策略遵循能力： 在 3 个现成的安全分类器和 2 个基准数据集上进行测试，RCV 在所有组合中均成功提高了与部署者策略的一致性，在不修改基础分类器的情况下，捕获了高达 81% 的此前被漏掉的不安全内容。
  • 鲁棒的分布监控： 在包含 10 个训练集之外的危害类别攻击活动的部署评估中，RCV 在专用注入面板内成功检测到了 100% 的攻击活动。维护框架在本地修复了大多数偏移事件，仅将繁重的微调留给剩余情况。

Key Results

  • Improved Policy Adherence: Tested across 3 off-the-shelf safety classifiers and 2 benchmark datasets, RCV successfully improved alignment with the deployer's policy in every single combination, capturing up to 81% of previously missed unsafe content without modifying the base classifier.
  • Robust Distribution Monitoring: In a deployment evaluation featuring 10 harm-category attack campaigns held out from training, RCV successfully detected 100% of the campaigns within a dedicated injection panel. The maintenance framework repaired most drift episodes locally, reserving heavy fine-tuning only for residual cases.

📥 全文与资源

📥 Full-Text & Resources

📚 引用

如果您在研究中使用了本工作，请通过 arXiv 引用：

📚 Citation

If you use this work in your research, please cite it via arXiv:

@misc{sandoval2026regimeconditionalverificationcorrectnessestimation,
      title={Regime-Conditional Verification: Correctness Estimation for Adapting and Monitoring Safety Classifiers}, 
      author={Thiago Sandoval and Ufuk Topcu},
      year={2026},
      eprint={2608.14089},
      archivePrefix={arXiv},
      primaryClass={cs.AI},
      url={https://arxiv.org/abs/2608.14089}, 
}