{"id":"1e54d1fb-8ed3-456a-9ab6-8b3c78bcd5b9","arxiv_id":"2504.19521","paper_version":4,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"An LLM's ability to follow application-specific system-prompt guardrails (security steerability) is nearly uncorrelated with its resistance to standard jailbreak attacks, based on a new 240-case benchmark across 18 open-source models.","lead":"The paper introduces 'security steerability', a measure of how well an LLM obeys application-specific guardrails in its system prompt even when a user tries to bypass them with jailbreaks or text tricks. It also releases a 240-scenario benchmark called VeganRibs and reports that scores on this benchmark barely correlate with scores on a standard jailbreak benchmark across 18 open-source models.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The zero-correlation claim compares VeganRibs scores from an unvalidated judge to JailbreakV-28k scores whose evaluation protocol is unreported; if the two metrics are not measured comparably, the observed non-correlation may be an artifact.","rationale":"The reader's weakest_assumption correctly flags the unvalidated judge LLM as a core problem, and I agree that this is a serious gap. My concern extends this to the broader comparability of the two metrics: the paper never discloses how the JailbreakV-28k subset was scored, so even a perfectly valid VeganRibs judge would not make the correlation interpretable if the two benchmarks used different evaluation pipelines. This is the most load-bearing issue because the paper's central contribution is the claimed absence of correlation, and measurement artifacts could entirely create or destroy that absence. The small n = 18 is a secondary but reinforcing issue: the reported p-value only says that the observed correlation is not distinguishable from zero, not that zero is the true value. The paper still has value: the VeganRibs benchmark, the definition of security steerability, and the demonstration of variance across models are useful contributions, and the correlation claim is empirically testable. Therefore the verdict should remain CONDITIONAL, requiring the authors to document the evaluation protocol, validate the judge, report uncertainty intervals, and ideally compare under a common judge. I do not see grounds for rejection, because the stated weaknesses are addressable and not internally contradictory.","tokens_in":9710,"tokens_out":4932,"duration_ms":52760,"concrete_test":"Re-evaluate both the 240 VeganRibs samples and the sampled 240 JailbreakV-28k attacks on the same 18 models using one shared, pre-registered judge LLM (e.g., GPT-4o or Llama-3.1-70B) with identical scoring instructions, adapting only the task-specific rubrics, and validate that judge against human labels on a random sample of at least 200 outputs from both benchmarks. If the Pearson correlation under this common, validated evaluation protocol remains near zero and its 95% confidence interval excludes meaningful correlations (|r| > 0.3), then the original claim is supported. If the correlation shifts materially or the confidence interval is wide enough to include substantial positive or negative values, the paper's 'zero correlation' claim is not justified and must be revised to 'no significant correlation detected with the current sample and evaluation setup.'","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that security steerability and universal jailbreak resistance are uncorrelated (Pearson r = 0.125, p = 0.621, Section IV.B). This claim rests on comparing two sets of scores that are not shown to be commensurable. VeganRibs scores (Section III.A) are produced by a judge LLM using author-authored judge prompts, but the paper never identifies the judge model, reports the judge prompt settings, validates the judge against human labels, or checks inter-judge agreement. The JailbreakV-28k comparison is even less specified: the paper samples 240 attacks (24 per category) but does not state how the violation rates for those attacks were computed—which judge, what scoring rubric, or whether the evaluation was even run by the authors. The original JailbreakV-28k dataset supplies attack prompts, not per-model labels, so these violation rates had to be generated by some evaluation procedure that is absent from the paper. If the two benchmarks used different judge models, prompt templates, or scoring thresholds, the comparison is not between two security properties but between two unrelated measurement pipelines. For example, the extremely low violation rates for Base64, reversed, and upside-down perturbations (Appendix B, Table VI) suggest the VeganRibs judge may be lenient on certain transformations, while the JailbreakV judge could be stricter or more sensitive to formatting; such systematic differences can reorder model rankings and create or erase correlation. Additionally, even under ideal measurement, n = 18 gives a 95% confidence interval for r = 0.125 of roughly [-0.36, 0.56], so 'zero correlation' is not established by the reported statistics alone. The most load-bearing weakness is therefore that the headline claim depends on an unvalidated and incomparable pair of evaluations.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces 'Security Steerability' as a metric for an LLM's ability to respect application-specific guardrails in the system prompt under adversarial user input, and presents VeganRibs, a new benchmark of 240 guarded scenarios with jailbreak and perturbation boosters. The authors evaluate 18 open-source LLMs, report a wide range of security-steerability scores, and compare these scores with violation rates on a 240-attack subset of JailbreakV-28k. They report a near-zero correlation (Pearson r = 0.125, p = 0.621) and conclude that universal jailbreak-resistance benchmarks do not predict application-level guardrail adherence.","tokens_in":9950,"tokens_out":2645,"duration_ms":29348,"significance":"If the central empirical claim holds, the paper identifies an important blind spot in LLM security evaluation: conventional universal-security benchmarks may not reflect how well a model enforces application-specific system-prompt boundaries. The proposed benchmark is a useful public artifact, and the comparison between the two security perspectives is a timely research question. The paper is commendable for releasing VeganRibs and for explicitly framing the correlation question as a falsifiable empirical claim. However, the current evidentiary basis for the 'zero correlation' conclusion is incomplete, primarily because the judge-LLM measurement pipeline and the JailbreakV-28k evaluation protocol are not described or validated.","major_comments":[{"comment":"The judge LLM is the measurement instrument for every VeganRibs score in Table III, but the paper never identifies the judge model, reports decoding parameters, shows the judge prompt, or validates judge verdicts against human labels, nor does it report inter-judge agreement. A biased or noisy judge can reorder model rankings and either create or erase the reported correlation with JailbreakV-28k, so this is a load-bearing gap for the central claim.","section":"Section III.A"},{"comment":"The JailbreakV-28k comparison is underspecified: the paper states that 240 attacks were sampled (24 per 10 categories) but does not describe the sampling procedure, the evaluation protocol used to obtain per-model violation rates, the judge or scorer, or whether these rates were computed by the authors or taken from prior work. Since the two benchmarks may have used different judges, prompt templates, and scoring thresholds, the observed non-correlation could reflect differences between measurement pipelines rather than between the two security properties.","section":"Section IV.B"},{"comment":"With n = 18 models, p = 0.621 only shows that the null hypothesis of zero correlation cannot be rejected; it does not establish that the correlation is zero. The paper should report a confidence interval for the Pearson correlation (or an equivalence test) and should also report correlations with uncertainty bands. Without this, the statement that there is 'ZERO correlation' is statistically overclaimed.","section":"Section IV.B"},{"comment":"The very low violation rates for Base64 encoding (0.028), reversed text (0.022), and upside-down text (0.006) suggest that the judge may be lenient on these perturbations or that they are effectively neutralized by the models, while jailbreak boosters produce a much higher violation rate (0.572). Because the aggregate VeganRibs score is a mix of these heterogeneous conditions, the paper should report whether the near-zero correlation with JailbreakV-28k is robust when jailbreak and perturbation subsets are analyzed separately, or whether it is driven by the specific booster distribution in VeganRibs.","section":"Appendix B, Table VI"}],"minor_comments":[{"comment":"The benchmark name is rendered as 'V eganRibs' in several places; this appears to be a typesetting artifact and should be consistently 'VeganRibs'.","section":"Abstract"},{"comment":"The parameter counts are formatted as '3.8 × 109' without superscripts; use '3.8 × 10^9' for readability.","section":"Table III"},{"comment":"Reference [2] contains a URL with a space ('security steerability'); the URL should be percent-encoded or otherwise formatted correctly so it is actually linkable.","section":"References"},{"comment":"The claim that there is 'low correlation between the number of parameters and the level of security steerability' is not accompanied by a correlation coefficient or scatter plot; adding this quantitative detail would strengthen the point.","section":"Section IV.A"},{"comment":"The figure caption does not define the plotted quantities precisely (e.g., whether the scores are the same 240 VeganRibs samples used for the correlation) nor does it show error bars; adding axis labels and a description of the ordering would improve interpretability.","section":"Figure 1"}],"recommendation":"major_revision","confidential_remarks":"The paper addresses a timely and practically relevant question, and the VeganRibs resource is a useful contribution. The main obstacle is not the concept but the empirical validation: the judge-LLM pipeline and the JailbreakV-28k evaluation procedure are currently unspecified, and the zero-correlation conclusion is stronger than the sample size and statistical treatment support. If the authors can supply the missing protocol details, judge validation, and interval estimates, I would be willing to reconsider the paper favorably."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nYou should know about this paper for the VeganRibs benchmark alone. The authors define Security Steerability — how well a model sticks to application-specific system-prompt guardrails under adversarial user input — and they release a 240-scenario dataset with judge-LLM scoring prompts. That is a genuine gap in the evaluation toolbox. Their headline empirical finding is a near-zero correlation (r=0.125, p=0.62) between VeganRibs and JailbreakV-28k over 18 open-source models, which would imply that universal jailbreak benchmarks don't predict application-level guardrail adherence.\n\nThe good parts are real. The benchmark design is a step beyond RuLES, which only covers simple regex-checkable rules. The use of a judge LLM for contextual assessment is a reasonable approach to complex guardrails, and publishing the dataset is a valuable contribution. The non-correlation result, if it holds up, would be an important callout for the community.\n\nThe soft spots are concentrated in the measurement. The judge LLM is never identified, its verdicts are not validated against human labels, and there is no inter-judge agreement check. Every score in Table III depends on that judge, so a biased or noisy judge could reorder the ranking and create or erase correlation. The JailbreakV-28k comparison is even more opaque: the paper samples 240 attacks but never says how the violation rates for those attacks were computed. If the two benchmarks used different judges, prompts, or thresholds, the comparison is between two pipelines, not two properties. Also, with n=18, the 95% CI for r=0.125 is roughly [-0.36, 0.56]; \"zero correlation\" is not established by the statistics alone. The additional claim that security steerability is a \"trainable capability\" beyond scaling and safety training goes beyond the evidence — no training experiments were run.\n\nI would send this to peer review. The benchmark and the question deserve referee time, but the authors need to validate the judge, report uncertainty, and fully specify the JailbreakV-28k evaluation. That is fixable. Without those fixes, the central claim is not supportable.\n\nWould I bring it to reading group? Yes — exactly the kind of paper we argue about.","headline":"VeganRibs is a genuinely useful benchmark, but the headline zero-correlation result needs better measurement before it can be trusted.","tokens_in":10594,"tokens_out":2938,"would_cite":true,"duration_ms":28564,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper argues that an LLM's resistance to universal harmful-prompt attacks carries almost no information about whether it will honor an application's custom guardrails, and it introduces a benchmark and metric, Security Steerability…","keywords":["security steerability","guardrail adherence","prompt injection","jailbreak resistance","system prompt","application security","LLM security benchmarking","VeganRibs"],"falsifier":"Take a random sample of 200 VeganRibs outputs, have three independent human annotators label each as guardrail-violating or compliant, compare those labels with the judge LLM's verdicts, then recompute the Pearson correlation between VeganRibs scores and the universal-jailbreak benchmark using the human labels; if the correlation is not near zero, the paper's central claim fails.","tokens_in":9483,"feed_emoji":"🛡️","tokens_out":6997,"duration_ms":67632,"temperature":0.7,"pith_summary":"The paper argues that the standard way of measuring LLM security—resistance to universal harmful requests like bomb-making instructions—does not capture whether a model will respect the custom guardrails an application places in its system prompt, such as \"do not discuss competitors.\" To make that capability measurable, it defines Security Steerability: a model's ability to hold to application-specific guardrails even when a malicious user tries to bypass them with jailbreaks and textual perturbations. It introduces a 240-scenario benchmark, VeganRibs, and scores 18 open-source LLMs, finding wide variation that does not track model size. The central, concerning result is a near-zero correlation between these scores and scores on a standard universal-jailbreak benchmark, implying that conventional security rankings offer little guidance for application-level safety.","feed_headline":"Universal jailbreak scores say nothing about app guardrails","feed_subtitle":"A 240-scenario benchmark shows guardrail adherence is a distinct capability standard security rankings miss.","key_machinery":"The central object is the security steerability score produced by the VeganRibs benchmark. Each of its 240 samples is a tuple containing a system prompt that defines an application and a non-security guardrail, a user prompt that deviates from that guardrail, a booster (a jailbreak or textual perturbation, such as leet speak or Base64 encoding), and a judge prompt used by a separate judge LLM to decide whether the guardrail was violated. The benchmark deliberately excludes universal security content, so that the score isolates a model's willingness to prioritize system-level instructions over conflicting user instructions. This machinery lets the authors rank models, compare them with a universal-security benchmark, and attribute differences in scores to guardrail-following behavior rather than to refusal of inherently harmful content.","core_discovery":"The paper's central claim is that guardrail adherence in LLM applications is a distinct capability from universal jailbreak resistance, and that the two are essentially uncorrelated: across 18 open-source models, the Pearson correlation between VeganRibs guardrail-violation rates and a standard universal-jailbreak benchmark is r = 0.125 with p = 0.621. Security Steerability scores range from 0.379 to 0.837, with the best score achieved by a compact 3.8B-parameter model rather than the largest one, showing that model size is not a reliable predictor. The paper also documents striking individual reversals: one 9B model has a high universal-jailbreak violation rate but a low guardrail-violation rate, while a 3B model shows the opposite pattern. The authors interpret this as evidence that conventional scaling or safety training alone does not produce policy-enforcement behavior, and that security steerability should be evaluated and trained as its own axis of LLM security.","pith_inferences":["Our editorial inference: if the zero-correlation result survives a human-validated judge, jailbreak resistance and instruction-hierarchy adherence may be orthogonal safety axes, so safety taxonomies should treat them separately rather than as one \"security\" score.","Our editorial inference: the booster-type asymmetry (jailbreaks fail about 57% of the time versus perturbations about 22%) suggests that security steerability may actually bundle distinct robustness traits—one for instruction-override attacks and one for encoding or obfuscation attacks—which future benchmarks could separate.","Our editorial inference: the same measurement logic could extend to agentic LLMs, where the guardrail is a tool-use policy, such as refusing to call a payment tool when a user prompt tries to override the system-level restriction.","Our editorial inference: a direct causal test would be to fine-tune a low-scoring open model on VeganRibs-style guardrail adherence and check whether its universal jailbreak score stays unchanged; if it does, the two capabilities are not only statistically uncorrelated but causally separate."],"forward_implications":["If the zero correlation is correct, model selection for customer-facing or agentic applications should not rely on universal jailbreak scores; application-specific guardrail adherence needs its own evaluation.","Because guardrail adherence can be improved or \"patched\" through the system prompt, application builders can raise security by rewriting system prompts rather than replacing the underlying model.","Security steerability appears to be a trainable capability distinct from universal refusal behavior, so vendors can target it with specialized training rather than relying on scale.","High-scoring models should be preferred for applications where user attempts to repurpose the system—such as getting travel advice from a weather assistant—would cause reputational, financial, or operational harm.","Benchmarks for LLM security should include application-centric scenarios, not only prohibited-content categories, to cover the full threat landscape of deployed GenAI applications."],"supporting_citations":[{"why":"Supplies the notion of steerability that security steerability modifies by adding guardrail adherence under adversarial user input.","marker":"[1]"},{"why":"Supplies the universal jailbreak benchmark whose scores are compared against VeganRibs to establish the near-zero correlation.","marker":"[3]"},{"why":"Supplies jailbreak attacks and payloads reused as boosters in VeganRibs samples.","marker":"[10]"},{"why":"Supplies jailbreaking techniques reused as boosters to stress-test guardrail adherence.","marker":"[14]"},{"why":"Supplies red-teaming prompts and prohibited-content categories reused as boosters.","marker":"[15]"},{"why":"Supplies adversarial questions and harm categories that inform the booster design.","marker":"[16]"},{"why":"Defines the prior guardrail-adherence benchmark that VeganRibs extends by using judge-LLM evaluation and more nuanced, non-regex-guardrail scenarios.","marker":"[19]"}],"fun_headline_variants":["Jailbreak resistance doesn't predict guardrail compliance","Guardrail adherence is a new security axis","Model size fails to forecast guardrail security","Security steerability: a distinct LLM capability","New benchmark exposes guardrail security gap"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The entire scoring pipeline trusts a judge LLM's verdict on whether a guardrail was violated, and the paper does not validate that judge against human labels or check inter-judge agreement, so a biased or noisy judge could change model rankings and even erase the reported zero correlation.","fun_headline_variants_meta":{"raw":{"variants":["Jailbreak resistance doesn't predict guardrail compliance","Guardrail adherence is a new security axis","Model size fails to forecast guardrail security","Security steerability: a distinct LLM capability","New benchmark exposes guardrail security gap"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.0012,"raw_usage":{"total_tokens":4985,"prompt_tokens":1025,"completion_tokens":3960,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":641,"completion_tokens_details":{"reasoning_tokens":3892}},"tokens_in":641,"tokens_out":3960,"duration_ms":27472,"temperature":1.0,"reasoning_tokens":3892,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T05:49:52.718259+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a random sample of 200 VeganRibs outputs, have three independent human annotators label each as guardrail-violating or compliant, compare those labels with the judge LLM's verdicts, then recompute the Pearson correlation between VeganRibs scores and the universal-jailbreak benchmark using the human labels; if the correlation is not near zero, the paper's central claim fails.","supporting_citations":[{"cited_title":"Measuring steerability in large language models,","cited_arxiv_id":null,"evidence_quote":"Supplies the notion of steerability that security steerability modifies by adding guardrail adherence under adversarial user input."},{"cited_title":"Jailbreakv-28k: A benchmark for assessing the robustness of multimodal large language models against jailbreak attacks,","cited_arxiv_id":null,"evidence_quote":"Supplies the universal jailbreak benchmark whose scores are compared against VeganRibs to establish the near-zero correlation."}],"review_version":1}