文章背景与核心概要
大模型安全评判器（如 Llama Guard 或用于打分的 GPT-4o）在判断模型回复是否具有危害性方面扮演着核心角色，它们是几乎所有已报告的越狱成功率、防御评估和安全排行榜背后的基础指标。然而，这些评判器究竟是在评估回复的“实质内容”，还是仅仅被其“表层语气”所迷惑？
本文深入探讨了这一问题。通过保持回复的正文内容逐字节不变，仅引入内容不变的外壳（例如教育免责声明、伪造的推理区块、先拒绝后输出有害内容，或在无害拒绝上加上听起来危险的框架），作者发现特定的评判器存在极易被利用的盲区。人工验证和提示词工程干预证明，漏洞根源在于评判器本身而非底层内容。该研究发布了相关数据集、外壳、代码和每个裁决的标签，为理解和提升大模型安全评判机制提供了重要参考。
Style Over Substance: Content-Invariant Wrappers Flip LLM Safety-Judge Verdicts
arXiv: arXiv:2609.08236 [cs.AI]
Submitted: September 8, 2026
Authors: Yongxi Zhou, Wenbo Ye, Yuanzhe Liu, Zihan Dong, Junwei Yao
Links: View PDF | HTML Version | GitHub Repository
📌 Summary
自动安全评判器（如 Llama Guard 或用于打分的 GPT-4o）负责判断模型的回复是否具有危害性，它们构成了几乎所有已报告的越狱成功率、防御评估和安全排行榜背后的基础度量指标。
Automatic safety judges (such as Llama Guard or GPT-4o grading prompts) determine whether a model's reply is harmful, forming the foundational metric behind nearly all reported jailbreak success rates, defense evaluations, and safety leaderboards.
本文调查了这些评判器究竟是在评估回复的“内容”还是仅仅评估其“语气”。通过保持回复的正文内容固定，并添加内容不变的外壳（即放置在回复前后的固定字符串，仅改变其语调，例如教育免责声明、伪造的安全“推理”区块、先进行标记性拒绝随后是未改变的有害正文，或者在无害拒绝上加上仅仅听起来危险的框架）。由于正文保持逐字节不变，忠实的评判器必须返回相同的裁决，任何裁决的翻转都是评判器的错误，而非安全性的改变。
This paper investigates whether these judges evaluate what a reply contains or simply how it sounds. By keeping a reply's body byte-for-byte identical while introducing content-invariant style wrappers—such as educational disclaimers, fake reasoning blocks, token refusals, or dangerous-sounding framing on harmless refusals—the authors demonstrate that specific judges harbor cheaply exploitable blind spots. Notably, vulnerabilities lie within the judges themselves rather than the underlying content, as proven by human validation and prompt-engineering interventions.
📑 Abstract
自动安全评判器——如 Llama Guard 或 GPT-4o 评分提示词等用于决定模型回复是否有害的系统——生成了几乎所有报告的越狱成功率、防御评估和安全排行榜背后的数据。我们探讨了这些评判器究竟是根据回复的内容评分，还是根据其语气评分。我们在保持回复内容固定不变的同时，添加了内容不变的外壳：即在回复前后放置固定字符串，这些字符串仅改变其语气（例如教育免责声明、伪造的安全“推理”区块、标记性拒绝后接未改变的有害主体），或者在无害拒绝上添加仅仅听起来危险的框架。因为主体部分保持逐字节不变，所以一个忠实的评判器必须返回相同的裁决结果，任何裁决翻转都是评判器的错误，而非安全性的改变。
Automatic safety judges -- systems such as Llama Guard or a GPT-4o grading prompt that decide whether a model's reply is harmful -- produce the numbers behind almost every reported jailbreak success rate, defense evaluation, and safety leaderboard. We ask whether these judges grade what a reply contains or how it sounds. We keep a reply's content fixed and add content-invariant style wrappers: fixed strings placed before or after the reply that change only its tone (an educational disclaimer, a fake safety "reasoning" block, a token refusal followed by the unchanged harmful body), or, on harmless refusals, framing that merely sounds dangerous. The body is preserved byte-for-byte, so a faithful judge must return the same verdict, and any flip is an error of the judge, not a change in safety.
通过对 600 多个 JailbreakBench 回复 × 最多 7 种形式 × 8 个评判器的测试，我们使用配对显著性检验和测得的噪声底线来测量裁决翻转率。研究发现是精确的而非普适的：大多数评判器几乎没有变化，但特定的评判器存在可被低成本利用的盲区。一个标记性拒绝（token-refusal）外壳使 GPT-4o-mini 正确的“不安全”裁决中有 19.9% 发生翻转（噪声底线为 0.5%；在三次多数表决重新打分下为 18.2%），但对 Claude 的影响仅为 0.4%。已部署的 Llama Guard 4 被确定性地攻破：“教育课程”框架使其 12.3% 的有害裁决转变为安全。第二个已部署的守卫（gpt-oss-safeguard-20b）则具有免疫力，且仅重写评分提示词（StrongREJECT 风格）就能在完全相同的模型上将攻击效果降低十倍——漏洞存在于评判器中，而不是内容中。两名标注员的人工验证证实了 100% 的内容不变性，且 90% 的翻转属于评判器错误（Kappa 系数为 0.95-1.0），而自助法（bootstrap）抽样表明，底层模型的排名仅凭抽样本身就已经不稳定。我们公开了数据集、外壳、代码以及每个裁决的标签。
Over 600 JailbreakBench replies x up to 7 forms x 8 judges, we measure flip rates with paired significance tests and measured noise floors. Findings are precise rather than universal: most judges barely move, but specific judges harbor cheaply exploitable blind spots. A token-refusal wrapper flips 19.9% of GPT-4o-mini's correct "unsafe" verdicts (noise floor 0.5%; 18.2% under majority-of-three re-scoring) yet moves Claude only 0.4%. The deployed Llama Guard 4 is deterministically gamed: an "educational course" framing flips 12.3% of its harmful verdicts to safe. A second deployed guard (gpt-oss-safeguard-20b) is immune, and rewriting only the grading prompt (StrongREJECT-style) cuts the attack tenfold on the identical model -- the vulnerability lives in the judge, not the content. A two-annotator human validation confirms 100% content invariance and 90% of flips as judge errors (kappa 0.95-1.0), and a bootstrap shows the underlying model ranking is already unstable to sampling alone. We release the dataset, wrappers, code, and per-verdict labels.
📊 Metadata & Additional Information
字段 详情 主要主题 人工智能 ( cs.AI)ACM 类别 I.2.7; K.6.5 DOI 10.48550/arXiv.2609.08236 许可证 知识共享署名 4.0 查看许可证
Field Details Primary Subject Artificial Intelligence ( cs.AI)ACM Classes I.2.7; K.6.5 DOI 10.48550/arXiv.2609.08236 License Creative Commons Attribution 4.0
🛠️ Associated Resources & Tools
- 代码与数据： 可在 GitHub 仓库 获取。
文献检索工具： 可通过 NASA ADS、Google Scholar 和 Semantic Scholar 访问。
Code & Data: Available on the GitHub Repository.
- Bibliographic Tools: Accessible via NASA ADS, Google Scholar, and Semantic Scholar.