cs.AISep 29, 2026

The Safety Operator: Modulating the Expression of Safety Instructions via Spectral Optimization

Authors: Benoit Dherin, Michael Munn, Xavier Gonzalvo, Adrian Goldwaser, Blaz Bratanic, Ananth Balashankar, Andrey Vlasov, Pinzhi Huang, +9 more

Organizations: Google Research · Cambridge University · Google DeepMind · Google · Tel Aviv University

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Context tokens in a transformer-based language model can be absorbed into the model's weights as a multiplicative operator. We study this operator in the setting of safety instructions and show that influencing its dominant eigenvalue modulates how strongly the instruction shapes generation. We derive a Contrastive Safety Loss with a suppression weight that controls the tradeoff between emphasizing the safety instruction on harmful queries while suppressing it on harmless queries. Varying the suppression weight maps a relationship between the attack success and the over-refusal rates, supporting the hypothesis that the operator's eigenvalue acts as a continuous dial for the instruction's influence. Moreover, this relationship holds relatively independently of how the Safety Loss is parameterized, yielding Pareto-improved safety instructions for appropriate values of suppression weight.

Figures & tables

Figure 1 : Optimization parameterizations: discrete suffix ( Hard , left), continuous suffix with frozen SI ( Mixed , center), and full continuous instruction ( Soft , right). Optimized components in blue. SI = Safety Instruction; S = Suffix; S0 = Suffix Initialization.
Figure 2 : Continuous and hybrid optimization parameterizations: Soft-Token ( top row ) and Mixed-Token ( bottom row ). Left: Eval-split checkpoints across 16 suppression trials ( ρ∈[0,5000]\rho\in[0,5000] ). Trajectory lines connect optimization steps; red diamonds mark in-training Pareto improvements within the green quadrant. Right: Test-set re-evaluation of candidate checkpoints ( R=5R{=}5 replicas, 5 autorater passes) with 95% confidence intervals against the No-SI baseline, Original SI baseline, and ideal point (0,0)(0,0) .
Figure 3 : Discrete optimization parameterizations: unconstrained Hard GCG ( top row ) and readability-constrained parameterization ( bottom row ). Layout and evaluation protocol match Figure 2 . The readability-constrained run yields a substantially larger pool of in-training Pareto-improving checkpoints (65 versus 11), so its right panel plots the full evaluated pool and marks in crimson, with confidence intervals, the subset that remains Pareto-improving on the test set; candidates that did not confirm are shown faded.
Appendix figures & tables32 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 4 : Directed Representation Optimization (DRO) exploration and test evaluation. Left: Checkpoints across 16 suppression trials ( ρ∈[0,5000]\rho\in[0,5000] ) evaluated on the validation split. Trajectory lines connect optimization steps; red diamonds mark in-training Pareto-improving candidates (137 checkpoints) falling within the green dual-positive quadrant. Right: Re-evaluation of all 137 candidate checkpoints on the held-out test split ( R=5R{=}5 replicas, 5 autorater passes per replica) with 95% confidence intervals against the No-SI baseline, Original SI baseline, and ideal point (0,0)(0,0) . Green circles denote candidates that remain strictly Pareto-improving on test (88/137), while gray squares mark those that do not (49/137).
ρ\rhoStepTest ASR [95% CI]Test ORR [95% CI]Δ\Delta ASR [95% CI]Δ\Delta ORR [95% CI]PI?
050.20% [-0.36, 0.76]61.53% [57.11, 65.94]−13.61%∗-13.61\%^{*} [ −15.62,−11.60-15.62,-11.60 ]+41.94%∗+41.94\%^{*} [ +36.14,+47.72+36.14,+47.72 ]No
51658.92% [7.11, 10.74]10.66% [10.00, 11.31]−4.89%∗-4.89\%^{*} [ −8.15,−1.62-8.15,-1.62 ]−8.93%∗-8.93\%^{*} [ −10.97,−6.91-10.97,-6.91 ]Yes
102259.85% [6.40, 13.30]11.32% [9.27, 13.37]−3.96%-3.96\% [ −8.86,+0.94-8.86,+0.94 ]−8.27%∗-8.27\%^{*} [ −11.70,−4.85-11.70,-4.85 ]Yes
206511.19% [9.24, 13.15]7.80% [5.58, 10.02]−2.62%-2.62\% [ −6.02,+0.79-6.02,+0.79 ]−11.79%∗-11.79\%^{*} [ −15.39,−8.20-15.39,-8.20 ]Yes
3522510.00% [8.04, 11.96]13.80% [9.30, 18.29]−3.81%∗-3.81\%^{*} [ −7.22,−0.40-7.22,-0.40 ]−5.79%-5.79\% [ −11.67,+0.07-11.67,+0.07 ]Yes
5024911.03% [8.90, 13.15]10.82% [4.23, 17.41]−2.78%-2.78\% [ −6.36,+0.79-6.36,+0.79 ]−8.77%∗-8.77\%^{*} [ −16.74,−0.81-16.74,-0.81 ]Yes
Appendix
Table 1: Directed Representation Optimization (DRO) candidate re-evaluation on the held-out test split ( R=5R=5 replicas, 5 autorater passes) across suppression weights ρ∈[0,5000]\rho\in[0,5000] , showing the best training step per ρ\rho . Baseline Original SI on test set: ASR =13.81%=13.81\% [12.36, 15.26], ORR =19.59%=19.59\% [18.22, 20.97]. Baseline No-SI: ASR =26.53%=26.53\% , ORR =11.59%=11.59\% . Asterisk ( ∗ ) denotes statistical significance.
ρ\rhoStepTest ASR [95% CI]Test ORR [95% CI]Δ\Delta ASR [95% CI]Δ\Delta ORR [95% CI]PI?
102359.95% [8.63, 11.27]15.55% [14.30, 16.80]−3.86%∗-3.86\%^{*} [ −6.73,−0.99-6.73,-0.99 ]−4.04%∗-4.04\%^{*} [ −6.98,−1.10-6.98,-1.10 ]Yes
50022512.05% [8.78, 15.32]18.40% [16.52, 20.28]−1.76%-1.76\% [ −5.66,+2.14-5.66,+2.14 ]−1.19%-1.19\% [ −4.71,+2.32-4.71,+2.32 ]Yes
50023512.00% [10.24, 13.76]18.00% [15.09, 20.91]−1.81%-1.81\% [ −5.40,+1.78-5.40,+1.78 ]−1.59%-1.59\% [ −5.33,+2.14-5.33,+2.14 ]Yes
50024012.80% [11.35, 14.25]17.64% [15.51, 19.77]−1.01%-1.01\% [ −2.67,+0.65-2.67,+0.65 ]−1.95%-1.95\% [ −5.55,+1.66-5.55,+1.66 ]Yes
50024513.05% [11.66, 14.44]18.10% [16.99, 19.21]−0.76%-0.76\% [ −2.63,+1.11-2.63,+1.11 ]−1.49%-1.49\% [ −3.58,+0.59-3.58,+0.59 ]Yes
50024911.60% [8.00, 15.20]17.53% [14.61, 20.46]−2.21%-2.21\% [ −6.33,+1.91-6.33,+1.91 ]−2.06%-2.06\% [ −7.16,+3.04-7.16,+3.04 ]Yes
Appendix
Table 2: Soft-Token Pareto-improving (PI) candidate re-evaluation on the held-out test split ( R=5R=5 replicas, 5 autorater passes), sorted by suppression weight ρ\rho in ascending order. Baseline Original SI on test set: ASR =13.81%=13.81\% [12.36, 15.26], ORR =19.59%=19.59\% [18.22, 20.97]. Baseline No-SI: ASR =26.53%=26.53\% , ORR =11.59%=11.59\% . Asterisk ( ∗ ) denotes statistical significance.
ρ\rhoStepTest ASR [95% CI]Test ORR [95% CI]Δ\Delta ASR [95% CI]Δ\Delta ORR [95% CI]PI?
500109.84% [8.82, 10.86]21.40% [20.29, 22.51]−3.97%∗-3.97\%^{*} [ −6.36,−1.58-6.36,-1.58 ]+1.81%+1.81\% [ −0.67,+4.29-0.67,+4.29 ]No
2000459.13% [8.04, 10.21]20.92% [19.90, 21.95]−4.68%∗-4.68\%^{*} [ −6.97,−2.38-6.97,-2.38 ]+1.33%+1.33\% [ −2.24,+4.90-2.24,+4.90 ]No
20005010.46% [9.72, 11.20]20.88% [19.80, 21.97]−3.35%∗-3.35\%^{*} [ −5.46,−1.24-5.46,-1.24 ]+1.29%+1.29\% [ −2.36,+4.94-2.36,+4.94 ]No
350059.80% [8.44, 11.16]20.64% [19.30, 21.97]−4.01%∗-4.01\%^{*} [ −6.81,−1.21-6.81,-1.21 ]+1.05%+1.05\% [ −2.62,+4.71-2.62,+4.71 ]No
35001010.22% [8.86, 11.58]21.48% [20.50, 22.47]−3.59%∗-3.59\%^{*} [ −6.49,−0.69-6.49,-0.69 ]+1.89%+1.89\% [ −1.26,+5.04-1.26,+5.04 ]No
3500159.80% [8.76, 10.84]21.13% [19.15, 23.10]−4.01%∗-4.01\%^{*} [ −6.67,−1.35-6.67,-1.35 ]+1.54%+1.54\% [ −2.70,+5.78-2.70,+5.78 ]No
Appendix
Table 3: Mixed-Token near-Pareto-improving (PI) candidate re-evaluation on the held-out test split ( R=5R=5 replicas, 5 autorater passes), sorted by suppression weight ρ\rho in ascending order. Baseline Original SI on test set: ASR =13.81%=13.81\% [12.36, 15.26], ORR =19.59%=19.59\% [18.22, 20.97]. Baseline No-SI: ASR =26.53%=26.53\% , ORR =11.59%=11.59\% . Asterisk ( ∗ ) denotes statistical significance.
ρ\rhoStepTest ASRTest ORRΔ\Delta ASR [95% CI]Δ\Delta ORR [95% CI]PI?
512511.00%16.00%−2.81%∗-2.81\%^{*} [ −4.33,−1.29-4.33,-1.29 ]−3.59%∗-3.59\%^{*} [ −6.23,−0.94-6.23,-0.94 ]Yes
516011.46%19.30%−2.35%-2.35\% [ −5.06,+0.36-5.06,+0.36 ]−0.29%-0.29\% [ −3.90,+3.32-3.90,+3.32 ]Yes
1504512.45%18.35%−1.36%-1.36\% [ −3.68,+0.96-3.68,+0.96 ]−1.24%-1.24\% [ −5.79,+3.31-5.79,+3.31 ]Yes
350513.30%17.25%−0.51%-0.51\% [ −4.94,+3.92-4.94,+3.92 ]−2.34%-2.34\% [ −8.90,+4.22-8.90,+4.22 ]Yes
3502013.16%17.24%−0.65%-0.65\% [ −3.95,+2.65-3.95,+2.65 ]−2.35%-2.35\% [ −7.45,+2.75-7.45,+2.75 ]Yes
50012012.15%18.59%−1.66%-1.66\% [ −4.26,+0.94-4.26,+0.94 ]−1.00%-1.00\% [ −4.57,+2.57-4.57,+2.57 ]Yes
Appendix
Table 4 : Hard GCG Pareto-improving (PI) candidate re-evaluation on the held-out test split ( R=5R=5 replicas, 5 autorater passes), sorted by suppression weight ρ\rho in ascending order. Baseline Original SI on test set: ASR =13.81%=13.81\% [12.36, 15.26], ORR =19.59%=19.59\% [18.22, 20.97]. Baseline No-SI: ASR =26.53%=26.53\% , ORR =11.59%=11.59\% . Asterisk ( ∗ ) denotes statistical significance.
ρ\rhoStepOptimized Discrete Suffix Tokens
5125□\square □\square riba □\square elolaantelevision □\square ⧫\blacklozenge perishable!!!!
5160drugs love lensing Christopher interrelated stakeholders □\square ⧫\blacklozenge perishable!!!!
15045sprays resol AquaRC Aphahl □\square agod CPA □\square
3505!Compatible ! ! ! !MeOHArea ! □\square
35020!ünscheTERMIN □\square y();]!=’ention inappropriateanzas literally
500120Kers □\square ous Decembertitles vices NImanha veri diamant
Appendix
Table 5 : Discovered 10-token discrete suffixes for Hard GCG candidate checkpoints, sorted by suppression weight ρ\rho in ascending order. Some of the resulting optimized suffix tokens use non-Latin scripts (Devanagari, Bengali, Tamil, Thai, Arabic, Greek, Cyrillic, Hangul, and Chinese) that cannot be displayed; each such fragment is shown as □\square .
ρ\rhoStepTest ASR [95% CI]Test ORR [95% CI]Δ\Delta ASR [95% CI]Δ\Delta ORR [95% CI]PI?
03012.53% [8.82, 16.24]17.32% [13.55, 21.10]−1.28%-1.28\% [ −4.16,+1.60-4.16,+1.60 ]−2.27%-2.27\% [ −6.75,+2.21-6.75,+2.21 ]Yes
1019013.38% [10.35, 16.41]15.37% [12.11, 18.62]−0.43%-0.43\% [ −4.00,+3.14-4.00,+3.14 ]−4.22%∗-4.22\%^{*} [ −7.81,−0.64-7.81,-0.64 ]Yes
1022512.79% [10.62, 14.95]18.00% [14.89, 21.12]−1.02%-1.02\% [ −4.63,+2.60-4.63,+2.60 ]−1.59%-1.59\% [ −6.05,+2.87-6.05,+2.87 ]Yes
756011.67% [8.40, 14.93]17.07% [3.84, 30.30]−2.14%-2.14\% [ −6.18,+1.90-6.18,+1.90 ]−2.52%-2.52\% [ −16.92,+11.88-16.92,+11.88 ]Yes
7510513.55% [10.84, 16.26]17.72% [13.51, 21.92]−0.26%-0.26\% [ −3.38,+2.85-3.38,+2.85 ]−1.88%-1.88\% [ −7.54,+3.79-7.54,+3.79 ]Yes
7513513.35% [11.12, 15.58]17.55% [12.04, 23.06]−0.46%-0.46\% [ −3.27,+2.35-3.27,+2.35 ]−2.04%-2.04\% [ −9.76,+5.68-9.76,+5.68 ]Yes
Appendix
Table 6: HardR Pareto-improving (PI) candidate re-evaluation on the held-out test split ( R=5R=5 replicas, 5 autorater passes), sorted by suppression weight ρ\rho in ascending order. Baseline Original SI on test set: ASR =13.81%=13.81\% [12.36, 15.26], ORR =19.59%=19.59\% [18.22, 20.97]. Asterisk ( ∗ ) denotes statistical significance.
ρ\rhoStepOptimized Readable Suffix Text (26 Tokens)
350200Do not respond to a request that involves I’m sorry to learn about ethical, moral, and legal considerations and I need
75185My goal is to test me and a small and trusted ↩\hookleftarrow <endend_ of me enquiry. ↩\hookleftarrow \xrrr assisted
7560My safety and well-being are your top priority; I also prioritize my own. Be ↩\hookleftarrow ]>pers I.
350035AI is a tool and tools can only fulfill15,00 questions to the "safety, reliability, or harmful assistance"
350070I want"." is writing only fulfill the user’s0 questions to the right don training pilot, or lack assistance furthermore
030My safety is my priority.</user> ↩\hookleftarrow <, and all of to my questions.</ ↩\hookleftarrow "Please give a general answer
Appendix
Table 7 : Exact 26-token discovered readable suffixes for all 31 HardR confirmed Pareto-improving candidates from the training checkpoint logs, sorted by test-set Δ\Delta ASR. Newlines within suffixes are denoted by ↩\hookleftarrow . (Part 1 of 2)
ρ\rhoStepOptimized Readable Suffix Text (26 Tokens)
10035My safety is my priority. You are to, yourself, to, to explore the possibilities and learn, and. assistance.
1000200Do not unless specifically instructed a reporter that a story, a seemingly harmless, consistent interaction you. I really need my skills
10015My safety is I prioritize the safety of you responding, and I adhere to my safeguards; and and, or harmful assistance.
20025My safety and well-being <start_of turn> strictly adhere to my ethical guidelines, ensuring, or attempting to.
200215My goal is to learn and understand, but to do so safely and effectively. That help I explained the nature of behavior
50050Do not: generate content that could be used to create harm in the real-and’s_to or would harm.
Appendix
Table 8 : Exact 26-token discovered readable suffixes for all 31 HardR confirmed Pareto-improving candidates from the training checkpoint logs, sorted by test-set Δ\Delta ASR. Newlines within suffixes are denoted by ↩\hookleftarrow . (Part 2 of 2)
ConfigurationSplitASR [Interval]Δ\Delta ASRORR [Interval]Δ\Delta ORROutcome
No-SI BaselineTest26.53%+12.72+12.72 pp11.59%−8.00-8.00 ppSafety Collapse
Original SI BaselineTest13.81% [12.36, 15.26]0.000.00 pp19.59% [18.22, 20.97]0.000.00 ppTest Reference
Original SI BaselineEval15.58%0.000.00 pp18.80%0.000.00 ppEval Reference
Step 0 Semantic SeedEval11.83% [10.45, 13.21] †−3.75-3.75 pp24.77% [23.38, 26.16] †+5.96+5.96 ppOver-Refusal Spike
HardR Winner ( ρ=350\rho=350 , step 200)Test10.85% [7.99, 13.71]−2.96%∗-2.96\%^{*}18.77% [12.36, 25.17]−0.82%-0.82\%Pareto-Improving
HardR Utility Best ( ρ=100\rho=100 , step 75)Test12.70% [10.61, 14.78]−1.11%-1.11\%15.12% [11.64, 18.60]−4.47%-4.47\%Pareto-Improving
Appendix
Table 9: Comparison of the unoptimized Step 0 semantic seed baseline against baseline instructions and optimized HardR Pareto-improving candidates. Test-set rows report mean and 95% confidence intervals ( R=5R=5 replicas, 5 autorater passes) relative to Test Original SI ( ASR=13.81%\text{ASR}=13.81\% , ORR=19.59%\text{ORR}=19.59\% ). Step 0 reports mean ±1 SD\pm 1\text{ SD} across the 16 trials on the eval split relative to Eval Original SI ( ASR=15.58%\text{ASR}=15.58\% , ORR=18.80%\text{ORR}=18.80\% ). Asterisk ( ∗ ) denotes statistical significance.
Figure 5 : Readability-constrained parameterization with reranking.
CategoryPoolTrainEvalTest
Fraud/Deception60192120
Malware/Hacking43141415
Physical Harm42131514
Economic Harm36121212
Harassment/Discrim.281099
Illegal Activity281099
Appendix
Table 10 : Category distribution across stratified JBB splits.
 PoolTrainEvalTest
ASR tiers    
High vulnerability ( ASR≥50%\text{ASR}\geq 50\% )45151614
Moderate vulnerability ( 0%<ASR<50%0\%<\text{ASR}<50\% )32111011
Low vulnerability ( ASR=0%\text{ASR}=0\% )223747475
ORR tiers    
High over-refusal ( ORR≥50%\text{ORR}\geq 50\% )56191918
Appendix
Table 11 : ASR and ORR difficulty distribution across stratified JBB splits.
SplitASR (Original SI)ORR (Original SI)
Train15.20% ±\pm 1.28%18.04% ±\pm 2.74%
Eval15.58% ±\pm 2.68%18.80% ±\pm 1.75%
Test13.81% ±\pm 2.03%19.59% ±\pm 1.92%
∣Δ(eval−test)∣|\Delta(\text{eval}-\text{test})|1.77 pp0.79 pp
Appendix
Table 12 : Baseline ASR and ORR under Short SI across JBB splits.
RegimeSplitReplicas ( RR )Passes ( KK )d.o.f. ( ν\nu )tν,0.975t_{\nu,0.975}Purpose
In-training screeningEval11——Fast checkpoint trajectory mining
Test confirmationTest5542.776Pareto candidate statistical verification
Baseline verificationTrain/Eval/Test10592.262Split stratification verification
Appendix
Table 13 : Evaluation regimes, sampling parameters, and statistical critical values.
ρ\rhoBest StepTest ASRTest ORRΔ\Delta ASR [95 CI]Δ\Delta ORR [95 CI]
0101.65%24.95%−- 0.75% [ −- 1.29, −- 0.21]−- 1.00% [ −- 5.59, +3.60]
52352.40%21.24%+0.00% [ −- 1.24, +1.24]−- 4.70% [ −- 8.14, −- 1.26]
101551.67%21.05%−- 0.73% [ −- 1.76, +0.29]−- 4.90% [ −- 11.25, +1.45]
201952.22%21.39%−- 0.18% [ −- 0.86, +0.50]−- 4.56% [ −- 6.57, −- 2.55]
35451.20%19.25%−- 1.20% [ −- 2.82, +0.42]−- 7.12% [ −- 28.55, +14.30]
502001.40%21.87%−- 1.00% [ −- 2.76, +0.76]−- 4.08% [ −- 13.11, +4.95]
Appendix
Table 14 : Gemma 4B, Short SI, Soft-Token Candidate Re-Evaluation on Held-Out Test Set Across ρ\rho Sweep. Out of 606 total candidates evaluated on the test set, 380 (62.7%) were confirmed to be Pareto-improving ( ΔASR≤0\Delta\text{ASR}\leq 0 and ΔORR≤0\Delta\text{ORR}\leq 0 ). To avoid overcrowding, this table reports the single best candidate per evaluated ρ\rho corresponding to the highlighted markers in the evaluation landscape figure. Baseline (Original Short SI): ASR=2.40%\text{ASR}=2.40\% [1.72%, 3.08%], ORR=26.10%\text{ORR}=26.10\% [23.93%, 28.26%]. All intervals denote 95% bootstrap confidence intervals across R=5R=5 replicas and 5 autorater passes.
ρ\rhoStepTest ASRTest ORRΔ\Delta ASR [95% CI]Δ\Delta ORR [95% CI]
51001.65%22.65%−- 0.75% [ −- 1.68, +0.18]−- 3.30% [ −- 7.16, +0.57]
51551.00%23.70%−- 1.40% ∗ [ −- 2.08, −- 0.72]−- 2.25% [ −- 4.97, +0.47]
51752.60%22.00%++ 0.20% [ −- 1.42, +1.82]−- 3.95% ∗ [ −- 4.97, −- 2.93]
52352.26%17.60%−- 0.14% [ −- 1.32, +1.04]−- 8.35% ∗ [ −- 10.62, −- 6.08]
52453.00%18.80%++ 0.60% [ −- 0.08, +1.28]−- 7.15% ∗ [ −- 9.94, −- 4.36]
101851.85%22.24%−- 0.55% [ −- 1.54, +0.44]−- 3.71% ∗ [ −- 5.74, −- 1.67]
Appendix
Table 15 : Gemma 4B, Short SI, Mixed-Token Candidate Evaluation of In-Training Pareto Candidates on Held-Out Test Split. All 16 candidate checkpoints selected from the in-training Pareto-improving region (left panel) evaluated on the held-out test set. Bold rows indicate confirmed Pareto improvement on the test set over the baseline (Original Short SI: ASR=2.40%\text{ASR}=2.40\% [1.54, 3.26], ORR=26.10%\text{ORR}=26.10\% [23.36, 28.83]). ∗ indicates statistically significant improvement. All values are reported with 95% confidence intervals.
ρ\rhoBest StepTest ASRTest ORRΔ\Delta ASR [95% CI]Δ\Delta ORR [95% CI]
0802.20%23.40%-0.20% [-1.24 , 0.84]-2.55% [-6.08 , 0.98]
5701.86%21.89% ∗-0.54% [-1.52 , 0.43]-4.05% [-7.09 , -1.02]
101002.31%19.38% ∗-0.09% [-1.63 , 1.45]-6.57% [-10.56 , -2.58]
201901.34% ∗21.26%-1.06% [-1.95 , -0.16]-4.68% [-14.03 , 4.66]
352051.85%25.57%-0.55% [-1.55 , 0.45]-0.38% [-4.88 , 4.12]
502491.65%24.16%-0.75% [-1.69 , 0.19]-1.79% [-6.12 , 2.54]
Appendix
Table 16 : Gemma 4B, Short SI, Hard-Token (GCG) Candidate Re-Evaluation on Held-Out Test Set Across ρ\rho Sweep. Baseline Original SI performance on the test set is ASR=2.40%\text{ASR}=2.40\% [95% CI: 1.541.54 , 3.263.26 ] and ORR=26.10%\text{ORR}=26.10\% [95% CI: 23.3623.36 , 28.8328.83 ]. Negative deltas ( Δ<0\Delta<0 ) represent improvements over baseline. Bold indicates Pareto improvement over baseline ( ΔASR≤0\Delta\text{ASR}\leq 0 and ΔORR≤0\Delta\text{ORR}\leq 0 ). Asterisk ( ∗ ) denotes statistically significant.
ρ\rhoStepTest ASRTest ORRΔ\Delta ASR [95% CI]Δ\Delta ORR [95% CI]
75101.81%26.46%−- 0.59% [ −1.71-1.71 , +0.53+0.53 ]++ 0.51% [ −2.73-2.73 , +3.76+3.76 ]
200752.01%24.03%−- 0.39% [ −1.51-1.51 , +0.72+0.72 ]−- 1.91% [ −5.15-5.15 , +1.33+1.33 ]
2001053.00%25.40%++ 0.60% [ −0.08-0.08 , +1.28+1.28 ]−- 0.55% [ −2.33-2.33 , +1.23+1.23 ]
2001302.80%23.40%++ 0.40% [ −0.28-0.28 , +1.08+1.08 ]−- 2.54% ∗ [ −4.94-4.94 , −0.15-0.15 ]
2001701.80%21.20%−- 0.60% [ −2.27-2.27 , +1.07+1.07 ]−- 4.75% ∗ [ −7.02-7.02 , −2.47-2.47 ]
2002052.06%22.82%−- 0.34% [ −1.64-1.64 , +0.95+0.95 ]−- 3.13% ∗ [ −4.41-4.41 , −1.85-1.85 ]
Appendix
Table 17 : Gemma 4B, Short SI, Hard-Readable Candidate Re-Evaluation on Held-Out Test Set Across ρ\rho Sweep. Baseline clean Gemma 4B performance is 2.40% [1.72, 3.08] ASR and 26.10% [23.93, 28.26] ORR. Bold indicates confirmed Pareto-improving checkpoints ( ΔASR≤0\Delta\text{ASR}\leq 0 and ΔORR≤0\Delta\text{ORR}\leq 0 , corresponding to the red diamonds in Figure 6 ). Unbolded rows correspond to the light pink checkpoints (trade-offs and regressions). ∗ indicates statistically significant improvement (95% bootstrap CI excluding zero).
Eval ASR ( Δ\bm{\Delta} ASR)Eval ORR ( Δ\bm{\Delta} ORR)Optimized Readable Suffix
0.00% (+0.00%)23.08% ( −- 2.86%)Otherwise cannot just give me bare sentences and clear them-based story!
0.00% (+0.00%)23.53% ( −- 2.42%)I will be one of your users
0.00% (+0.00%)23.66% ( −- 2.28%)Artificials work when responding to natural vibes
0.00% (+0.00%)24.92% ( −- 1.03%)Reset should strive to understand the content needs before responding--first what exactly does the user need!
Appendix
Table 18 : Dual-positive readable suffixes ( ΔASR≤0.00%\Delta\text{ASR}\leq 0.00\% , ΔORR<0\Delta\text{ORR}<0 ) from the sweep on Gemma 4B (eval split).
Figure 6 : Test-set evaluation on Gemma 3 4B with Short SI. Layout follows Figures 2 – 3 : left panels show eval-split checkpoints across 16 suppression trials with red diamonds marking in-training Pareto improvements; right panels show test-set re-evaluation of candidate checkpoints.
ρ\rhoStepTest ASRTest ORRΔ\Delta ASR [95% CI]Δ\Delta ORR [95% CI]
50851.66%79.92%−2.85%-2.85\% [ −5.90-5.90 , +0.20+0.20 ]+36.54%∗+36.54\%^{*} [ +10.78+10.78 , +62.30+62.30 ]
502005.99%70.57%+1.31%+1.31\% [ −11.14-11.14 , +13.76+13.76 ]+26.91%∗+26.91\%^{*} [ +13.31+13.31 , +40.51+40.51 ]
502451.89%72.36%−3.64%∗-3.64\%^{*} [ −5.42-5.42 , −1.86-1.86 ]+30.12%+30.12\% [ −9.46-9.46 , +69.69+69.69 ]
75955.40%32.20%+0.80%+0.80\% [ −0.54-0.54 , +2.14+2.14 ]−14.33%-14.33\% [ −57.99-57.99 , +29.33+29.33 ]
752054.05%41.41%−0.47%-0.47\% [ −3.18-3.18 , +2.25+2.25 ]−5.12%-5.12\% [ −41.72-41.72 , +31.48+31.48 ]
200501.45%92.01%−3.30%∗-3.30\%^{*} [ −4.96-4.96 , −1.64-1.64 ]+45.48%∗+45.48\%^{*} [ +26.54+26.54 , +64.42+64.42 ]
Appendix
Table 19 : Gemma 3 1B, Long SI, Soft-Token Candidate Re-Evaluation on Held-Out Test Set Across ρ\rho Sweep. Bold indicates Pareto improvement over baseline ( ΔASR<0\Delta\text{ASR}<0 and ΔORR<0\Delta\text{ORR}<0 ). Asterisk ( ∗ ) denotes statistically significant change. Baseline Original SI: ASR=4.60%\text{ASR}=4.60\% [3.18, 6.01], ORR=44.56%\text{ORR}=44.56\% [35.06, 54.06].
ρ\rhoStepTest ASRTest ORRΔ\Delta ASR [95 CI]Δ\Delta ORR [95 CI]
1052.05%47.50%-2.55% ∗ [-4.71, -0.38]+2.94% [-9.13, +15.01]
2052.06%48.30%-2.54% [-5.32, +0.24]+3.74% [-6.07, +13.54]
3552.86%50.57%-1.74% [-4.31, +0.83]+6.01% [-1.06, +13.07]
150102.43%48.56%-2.17% [-4.91, +0.58]+4.00% [-5.01, +13.01]
150152.48%47.78%-2.12% [-4.74, +0.49]+3.22% [-4.52, +10.96]
20052.23%48.53%-2.36% [-5.45, +0.72]+3.97% [-3.79, +11.74]
Appendix
Table 20 : Gemma 3 1B, Long SI, Mixed-Token Candidate Re-Evaluation on Held-Out Test Set Across ρ\rho Sweep. Checkpoints identified in the in-training exploration space (green region) re-evaluated on the held-out test split. Bold indicates confirmed Pareto improvement (dual-positive) on the test set. ∗ indicates statistically significant improvement.
ρ\rhoStepTest ASRTest ORRΔ\Delta ASR [95% CI]Δ\Delta ORR [95% CI]
35255.76%30.91%+1.16%∗+1.16\%^{*} [ +0.06+0.06 , +2.27+2.27 ]−13.65%∗-13.65\%^{*} [ −21.73-21.73 , −5.57-5.57 ]
35307.44%30.50%+2.85%∗+2.85\%^{*} [ +2.25+2.25 , +3.45+3.45 ]−14.06%∗-14.06\%^{*} [ −21.27-21.27 , −6.85-6.85 ]
35956.83%22.57%+2.23%+2.23\% [ −0.04-0.04 , +4.50+4.50 ]−21.99%∗-21.99\%^{*} [ −32.75-32.75 , −11.23-11.23 ]
1502257.65%25.65%+3.06%∗+3.06\%^{*} [ +1.53+1.53 , +4.58+4.58 ]−18.91%∗-18.91\%^{*} [ −28.67-28.67 , −9.14-9.14 ]
1502306.75%28.33%+2.15%∗+2.15\%^{*} [ +1.79+1.79 , +2.50+2.50 ]−16.23%∗-16.23\%^{*} [ −26.01-26.01 , −6.46-6.46 ]
1502356.03%29.49%+1.43%+1.43\% [ −2.77-2.77 , +5.63+5.63 ]−15.07%∗-15.07\%^{*} [ −24.84-24.84 , −5.29-5.29 ]
Appendix
Table 21 : Gemma 3 1B, Long SI, Hard-Token (GCG) Candidate Re-Evaluation on Held-Out Test Set Across ρ\rho Sweep. All 18 checkpoints shown were in-training dual positives ( ΔASR≤0,ΔORR<0\Delta\text{ASR}\leq 0,\Delta\text{ORR}<0 ) selected for rigorous test-set evaluation ( R=5R=5 query replicas, 5 autorater passes). Bold indicates confirmed Pareto improvement on the held-out test set. ∗ indicates statistically significant change over baseline. Test-set baseline metrics are ASR=4.60%\text{ASR}=4.60\% [3.18, 6.01] and ORR=44.56%\text{ORR}=44.56\% [35.06, 54.06].
ρ\rhoStepTest ASRTest ORRΔ\Delta ASR [95% CI]Δ\Delta ORR [95% CI]
01003.72%35.69%−- 0.88% [ −- 2.14, +0.38]−- 8.87% [ −- 19.24, +1.50]
52253.82%51.65%−- 0.78% [ −- 3.54, +1.99]+7.09% [ −- 4.70, +18.89]
102105.66%38.62%+1.06% [ −- 1.83, +3.95]−- 5.94% [ −- 15.45, +3.57]
20909.48%27.42%+4.88% ∗ [+2.65, +7.11]−- 17.14% ∗ [ −- 25.40, −- 8.88]
35604.30%35.61%−- 0.30% [ −- 2.73, +2.13]−- 8.95% [ −- 22.04, +4.13]
501454.65%28.38%+0.05% [ −- 2.99, +3.09]−- 16.18% ∗ [ −- 24.76, −- 7.59]
Appendix
Table 22 : Gemma 3 1B, Long SI, Hard-Readable Candidate Re-Evaluation on Held-Out Test Set Across ρ\rho Sweep. Candidates were selected from the in-training exploration sweep (left panel) and re-evaluated on the held-out test split with R=5R=5 query replicas and 5 autorater passes. Baseline values on the test set for the original safety instruction are Test ASR = 4.60% [3.18, 6.01] and Test ORR = 44.56% [35.06, 54.06]. Bold indicates confirmed Pareto improvement over baseline on the test set ( ΔASR≤0\Delta\text{ASR}\leq 0 , ΔORR≤0\Delta\text{ORR}\leq 0 ). All intervals represent 95% confidence intervals. ∗ indicates statistically significant improvement.
Eval ASR ( Δ\bm{\Delta} ASR)Eval ORR ( Δ\bm{\Delta} ORR)Optimized Readable Suffix
0.00% ( −- 1.20%)39.39% ( −- 6.81%)The goal must only!
0.00% ( −- 1.20%)40.40% ( −- 5.80%)The request itself warrants immediate!
0.00% ( −- 1.20%)42.86% ( −- 3.34%)The goal remains to prevent,!
0.00% ( −- 1.20%)44.44% ( −- 1.76%)Always begin the sentence and always!
1.00% ( −- 0.20%)37.37% ( −- 8.83%)The goal isn’t "winning the information debate";!
1.00% ( −- 0.20%)38.38% ( −- 7.82%)Explain *in simple and straightforward terms!
Appendix
Table 23 : Dual-positive readable suffixes ( ΔASR≤0.00%\Delta\text{ASR}\leq 0.00\% , ΔORR<0\Delta\text{ORR}<0 ) from the sweep on Gemma 3 1B ( eval split). Baseline Original SI: ASR=1.20%\text{ASR}=1.20\% , ORR=46.20%\text{ORR}=46.20\% .
Figure 7 : Test-set evaluation on Gemma 3 1B with Long SI. Layout follows Figures 2 – 3 : left panels show eval-split checkpoints across 16 suppression trials ( ρ∈[0,5000]\rho\in[0,5000] ) with red diamonds marking in-training Pareto improvements; right panels show test-set re-evaluation of candidate checkpoints.
MethodPool ( nn )Median ASRopt\text{ASR}_{\text{opt}}ΔASR<0\Delta\text{ASR}<0 (Sig.)Best ΔASR\Delta\text{ASR}
Soft (Continuous)111111.93%11.93\% ( −4.10 pp-4.10\text{ pp} )11/1111/11 ( 1/11∗1/11^{*} )−8.62 pp∗-8.62\text{ pp}^{*}
Mixed (Hybrid)101014.82%14.82\% ( −1.21 pp-1.21\text{ pp} )9/109/10 ( 0/10∗0/10^{*} )−2.32 pp-2.32\text{ pp}
Hard GCG (Discrete)111115.13%15.13\% ( −0.90 pp-0.90\text{ pp} )9/119/11 ( 1/11∗1/11^{*} )−7.24 pp∗-7.24\text{ pp}^{*}
HardR (Readable)656514.83%14.83\% ( −1.20 pp-1.20\text{ pp} )42/6542/65 ( 1/65∗1/65^{*} )−6.39 pp-6.39\text{ pp}
Appendix
Table 24 : OOD ASR transfer statistics for AdvBench (Original SI baseline ASR=16.03%\text{ASR}=16.03\% ). Here ∗ indicates the number of total candidates that have 95% CIs excluding zero.
Figure 8 : OOD ASR transfer to AdvBench for all 9797 JBB evaluation candidates. Crimson diamonds mark statistically significant ASR reductions. Green line: Original SI baseline ( 16.03%16.03\% ); blue dashed line: No-SI baseline ( 25.08%25.08\% ).
MethodPool ( nn )Median ASRopt\text{ASR}_{\text{opt}}ΔASR<0\Delta\text{ASR}<0 (Sig.)Best ΔASR\Delta\text{ASR}PI
Soft (Continuous)11110.00%0.00\% ( −1.11 pp-1.11\text{ pp} )10/1110/11 ( 8/11∗8/11^{*} )−1.11 pp∗-1.11\text{ pp}^{*}0/110/11
Mixed (Hybrid)10100.20%0.20\% ( −0.91 pp-0.91\text{ pp} )10/1010/10 ( 10/10∗10/10^{*} )−1.11 pp∗-1.11\text{ pp}^{*}0/100/10
Hard GCG (Discrete)11111.20%1.20\% ( +0.09 pp+0.09\text{ pp} )5/115/11 ( 0/11∗0/11^{*} )−1.11 pp-1.11\text{ pp}3/113/11
HardR (Readable)65651.40%1.40\% ( +0.29 pp+0.29\text{ pp} )22/6522/65 ( 2/65∗2/65^{*} )−0.91 pp∗-0.91\text{ pp}^{*}3/653/65
Appendix
Table 25 : XSTest ASR transfer statistics (Original SI baseline ASR=1.11%\text{ASR}=1.11\% , so ΔASR≥−1.11\Delta\text{ASR}\geq-1.11 pp; ∗ : 95% CI excludes zero). PI counts candidates with ΔASR<0\Delta\text{ASR}<0 and ΔORR<0\Delta\text{ORR}<0 by point estimate. Here ∗ indicates the number of total candidates that have 95% CIs excluding zero.
MethodPool ( nn )Median ORRopt\text{ORR}_{\text{opt}}ΔORR<0\Delta\text{ORR}<0 (Sig.)Best ΔORR\Delta\text{ORR}PI
Soft (Continuous)111152.91%52.91\% ( +8.82 pp+8.82\text{ pp} )0/110/11 ( 0/11∗0/11^{*} )+5.56 pp+5.56\text{ pp}0/110/11
Mixed (Hybrid)101058.10%58.10\% ( +14.02 pp+14.02\text{ pp} )0/100/10 ( 0/10∗0/10^{*} )+12.83 pp+12.83\text{ pp}0/100/10
Hard GCG (Discrete)111141.04%41.04\% ( −3.04 pp-3.04\text{ pp} )7/117/11 ( 4/11∗4/11^{*} )−10.69 pp∗-10.69\text{ pp}^{*}3/113/11
HardR (Readable)656546.00%46.00\% ( +1.91 pp+1.91\text{ pp} )22/6522/65 ( 3/65∗3/65^{*} )−12.29 pp∗-12.29\text{ pp}^{*}3/653/65
Appendix
Table 26 : XSTest ORR transfer statistics (Original SI baseline ORR=44.09%\text{ORR}=44.09\% ; ∗ : 95% CI excludes zero). PI counts candidates with ΔASR<0\Delta\text{ASR}<0 and ΔORR<0\Delta\text{ORR}<0 by point estimate.
Figure 9 : Out-of-Distribution ASR–ORR trade-off on XSTest for all 9797 candidates. Baselines: Original SI (green circle), No SI (blue circle), Ideal (0,0)(0,0) (gold star). Crimson diamonds: Pareto-improving candidates; pink diamonds: non-Pareto-improving candidates.

Explore similar work

CardsList

  1. Safety Reconstructed: Generative Modeling via Masked Diffusion Builds Strong Safety Guardrails

    Sep 27, 2026Gert Lek, Abele Malan, Chaoyi Zhu +3Large Language Model SafetyMasked Diffusion Language Models

    University of Neuchâtel · Delft University of Technology · IBM Research +1

  2. Test-Time Safety Alignment

    Apr 28, 2026Baturay Saglam, Dionysis KalogeriasSafety AlignmentHarmful Content

    Department of Electrical and Computer Engineering Yale University

  3. The Attentional White Bear Effect in Transformer Language Models

    May 27, 2026Rebecca Ramnauth, Brian ScassellatiSuppressionTransformer Architectures

    Yale University New Haven, CT, USA