{"id":"13e6cc00-5b08-4cef-828f-4c87b93d8977","arxiv_id":"2505.00010","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"Four human-annotated linguistic features predict jailbreak prompts in the 2-Sigma clinical chatbot better than prompt-engineering guardrails.","lead":"This paper tests whether four hand-annotated language features can identify attempts to jailbreak a medical education chatbot. Feature-based classifiers beat a prompt-engineering guardrail on this dataset, with a fuzzy decision tree performing best.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Feature definitions overlap the jailbreak label, so reported classifier accuracy may reflect annotation leakage rather than independent detection; the PE comparator is also not an equivalent detector.","rationale":"The reader's weakest_assumption focuses on the manual-annotation requirement for runtime deployment, which is a real operational limitation. The more load-bearing issue is construct overlap between the features and the label, which undermines the validity of the detection claim even before deployment. The reader's rationale does mention 'overlap between feature definitions and the ground-truth label' as one reason to withhold full acceptance, so there is partial agreement, but the weakest_assumption field does not elevate it to the central threat. I therefore identify label leakage as the primary concern. A blinded re-annotation check would settle whether the high metrics are merely an artifact of shared human judgment. If the concern lands, the paper's central claim would need substantial revision; if it does not, the existing conditional verdict remains appropriate. No ad hominem is intended; this appears to be an unintentional but fundamental design issue. The PE comparison problem is secondary but compounds the difficulty of interpreting the headline result.","tokens_in":8827,"tokens_out":6222,"duration_ms":62643,"concrete_test":"Re-annotate a random 200-prompt subset under a blinded protocol: a new set of annotators rates the four Table 1 variables without being told the jailbreak label or definition, while a separate team assigns ground-truth jailbreak labels using only the Section 2 binary definition. Retrain the Logistic Regression and Fuzzy Decision Tree on the blinded feature proportions and recompute the Table 3 metrics. If the blinded-feature AUC drops materially (for example, by more than 0.05) or the feature-label correlations vanish, the reported performance was inflated by label leakage. If the blinded-feature performance is statistically indistinguishable from the reported values, the concern does not land.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim requires the four linguistic features to be at least partially independent of the jailbreak label, but the feature rubrics in Table 1 are close paraphrases of the label itself. Ground truth in Section 2 is a binary jailbreak judgment by two researchers; the four features are then rated by seven annotators using definitions such as Professionalism violations including 'abusive tendencies' and 'disregard patient safety', Ethical Behavior red flags including 'harmful recommendations' and 'ignoring critical symptoms', and Contextual Distraction as 'strays from the established context'. These are near-synonyms of 'bypassing ethical safeguards' and 'manipulating the AI system' from Section 1. The authors state the variables were selected because a preliminary review 'revealed strong correlations' with jailbreak behavior. Consequently, models trained on these features are effectively predicting one human judgment from other human judgments of the same construct; the reported accuracy (0.9479), F1 (0.9492), and AUC (0.9834) may measure annotation consistency rather than detection skill. No inter-annotator agreement is reported, and annotators were not blind to the jailbreak concept. This validity threat persists even if feature extraction were fully automated, because the construct overlap is in the rubric definitions themselves, not only in the annotation procedure. Additionally, the PE row in Table 3 is not a like-for-like detector: PE is a set of LLM guardrails described in Section 3.8, and the paper never specifies how PE's binary detection decisions were generated or scored.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript proposes using four human-rated linguistic variables (Professionalism, Medical Relevance, Ethical Behavior, and Contextual Distraction) as features for supervised classifiers to detect jailbreak attempts in 2-Sigma, an LLM-based clinical education platform. The authors annotated about 2,300 prompts from 158 conversations, trained Decision Trees, Fuzzy Decision Trees, a Gradient-Optimized Fuzzy Inference System, Random Forest, LGBM, XGBoost, Logistic Regression, and a Neural Network on an 80/20 split, and compared them against a Prompt Engineering baseline. The Fuzzy Decision Tree achieves the highest accuracy (0.9479) and F1-score (0.9492), and the authors conclude that feature-based predictive models are effective and explainable alternatives that outperform prompt engineering, while acknowledging that real-time detection is not addressed.","tokens_in":9122,"tokens_out":5003,"duration_ms":47000,"significance":"If the proposed method worked as described, a compact, interpretable feature set for detecting jailbreak attempts in a clinical education LLM would be a useful contribution. The paper studies a real deployed system, defines a concrete annotation rubric, compares a broad set of standard classifiers, and reports performance metrics on a real dataset. It also explicitly acknowledges that real-time detection remains unsolved. However, the central result is currently not supported because the input features are not independent of the jailbreak label and because the evaluation protocol cannot distinguish detection skill from annotation consistency. The contribution as presented is therefore not yet at the level of a published claim about jailbreak detection.","major_comments":[{"comment":"The four input features are defined almost synonymously with the jailbreak label, so the reported accuracies may measure annotator agreement rather than an independent detection signal. The ground truth is a binary 'jailbreak attempt' judgment made by two researchers, while seven annotators rate the same prompts on constructs such as 'harmful recommendations,' 'ignoring critical symptoms,' and 'strays from the established context'—all of which are near-paraphrases of 'bypassing ethical safeguards' and 'manipulating the AI system' used to define jailbreaking in Section 1. The authors further state that the features were selected because a preliminary review 'revealed strong correlations' with jailbreak behavior. Since the feature rubric and the label rubric overlap, a model trained on these features can appear accurate even if it has learned the annotators' decision rule rather than a generalizable jailbreak property. The absence of inter-annotator agreement statistics and any independence between the two annotation tasks makes this concern impossible to evaluate from the manuscript.","section":"Section 2, Table 1; Section 1"},{"comment":"The proposed detection pipeline requires seven human annotators per prompt at run time, but no automatic feature extraction is implemented or evaluated. The paper itself states that 'the current approach does not address real-time detection, where prompts must be annotated and interpreted accurately as they occur.' Consequently, the Table 3 numbers describe offline classification of human ratings, not a method that can flag a jailbreak in an operational system. The abstract and conclusion frame the result as an 'effective ... alternative for jailbreak detection,' which overstates what was actually tested.","section":"Section 5; Section 2"},{"comment":"All model comparisons rest on a single 80/20 train-test split, with no confidence intervals, cross-validation, or significance testing. The leading differences are small—FDT accuracy 0.9479 versus LR 0.9458, and FDT F1 0.9492 versus GF 0.9449—so the claim that the Fuzzy Decision Tree achieved 'the best overall performance' is not statistically supported. Additionally, the fuzzy models' hyperparameters (13 membership functions per input and 2 rules for the FIS) are presented as fixed choices without sensitivity analysis, leaving open how robust the ranking is to these choices.","section":"Section 4, Table 3"},{"comment":"The Prompt Engineering baseline is not a like-for-like detector. PE is a set of prompt guardrails intended to prevent jailbreaks, not a classifier trained on the same feature representation or evaluated under the same protocol as the other methods. Comparing its accuracy, precision, recall, and F1 to classifiers trained on ground-truth labels conflates prevention with detection. The conclusion that 'feature-based predictive models consistently outperformed Prompt Engineering' therefore does not follow from a controlled comparison.","section":"Section 3.8; Table 3"}],"minor_comments":[{"comment":"In the normalized Contextual Distraction vector, the text lists 'highly distracting, moderately distracting, questionable (1.0), not distracting' but omits the corresponding 0.0 value for 'not distracting,' which would complete the normalized vector.","section":"Section 2, example"},{"comment":"The Neural Network row reports no ROC-AUC; either provide this value or state explicitly why it is omitted.","section":"Table 3"},{"comment":"The Neural Network description says the architecture has four layers with 32, 32, 16, and 16 neurons, but as written this omits the output layer and the total parameter count, leaving the architecture under-specified.","section":"Section 3.7"},{"comment":"The text says 'over 2,300 prompts' while the reported class counts sum to 1,155 + 1,146 = 2,301; consider reporting the exact total consistently throughout.","section":"Section 2"},{"comment":"There are typographical errors in this section, including 'backpropogation' and 'a wide variety if data distributions.'","section":"Section 3.7"}],"recommendation":"reject","confidential_remarks":"For the editor: the deciding issue is the feature-label construct overlap in Section 2 and Table 1, which undermines the central claim that feature-based models detect jailbreaks. The manuscript also provides no code, data, or external validation, and the small performance differences in Table 3 are not supported by confidence intervals. A revision would require substantially new annotation or evaluation work rather than local corrections."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: this paper gives you a new annotated corpus of jailbreak attempts from a live medical-education chatbot and shows that simple classifiers on four linguistic features beat a prompt-engineering guardrail. The dataset is the real contribution. But the strongest numbers come from a setup where the features are near-synonyms of the label, so the accuracy may be measuring annotation consistency as much as detection skill.\n\nThe good parts: 158 conversations, about 2,300 prompts, balanced classes, from a real deployment (2-Sigma). The feature rubrics are clearly defined, and converting seven annotators' ordinal ratings into 15 proportion scores is a sensible preprocessing choice. FDT and LR results are plausible, and the depth-3 decision tree gives an interpretable picture of what drives classification. The paper is honest about not addressing real-time detection.\n\nThe soft spots, in rough order of severity. First, construct overlap. The ground-truth label is a binary 'jailbreak attempt' judgment by two researchers. The four features are rated by seven annotators using definitions like 'disregard patient safety', 'harmful recommendations', 'ignoring critical symptoms', and 'strays from established context' — these are the same behaviors the label is meant to capture. The paper even says the variables were chosen because a preliminary review 'revealed strong correlations' with jailbreak behavior. So the high AUC is partly baked in. There is no inter-annotator agreement reported, no evidence that annotators were blind to the jailbreak concept, and no attempt to show features add information beyond the label. This is the load-bearing issue.\n\nSecond, the PE comparison is not a like-for-like detector. Prompt engineering is a prevention mechanism—instructions to the LLM—not a classifier that outputs a binary detection decision. The paper never specifies how PE produced the accuracy and F1 in Table 3. Without that, the claim that feature-based models outperform PE is hard to interpret.\n\nThird, the evaluation is a single 80/20 split with no cross-validation, confidence intervals, or significance testing. The differences among FDT, LR, and GF are tiny (0.002 in accuracy), so 'FDT best' is not supported. Minor but worth noting: the fuzzy inference system has 13 membership functions per input and just 2 rules—a lot of free parameters, and the learned structure is not shown.\n\nNet: the dataset and the explainable-detection framing are worth having, but the central claim needs a redesign—independent annotation of features and label, a properly specified PE baseline, and repeated splits. I would send this to a serious referee expecting major revision, and I would bring it to a reading group as a case study in annotation leakage. I would not cite it yet.","headline":"Useful new annotated corpus and a fair comparison to prompt engineering, but the features are close paraphrases of the jailbreak label, so the headline accuracy numbers likely measure annotation consistency more than detection skill.","tokens_in":9675,"tokens_out":2306,"would_cite":false,"duration_ms":21691,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that classifiers built on four human-rated linguistic features detect jailbreak prompts in a clinical LLM platform more reliably than the platform's prompt-engineering guardrails, with the Fuzzy Decision Tree performing…","keywords":["Educational LLMs","Jailbreak Detection","Clinical Simulation","Fuzzy Decision Tree","Gradient-Optimized Fuzzy Inference System","Linguistic Features","Prompt Engineering","Explainability"],"falsifier":"Take a fresh set of, say, 500 student prompts from active 2-Sigma use, have the same seven-annotator rubric applied, and compare Fuzzy Decision Tree predictions with the consensus ground truth; if accuracy falls toward the 0.81 prompt-engineering level or annotator agreement collapses, the claim that these four features are sufficient would be refuted.","tokens_in":8649,"feed_emoji":"🛡️","tokens_out":5822,"duration_ms":49366,"temperature":0.7,"pith_summary":"This paper asks whether jailbreak attempts in a clinical-training chatbot can be caught by scoring each student prompt on four linguistic dimensions instead of relying on guardrail instructions written into the prompt. Working with about 2,300 prompts from 158 conversations in the 2-Sigma medical-education platform, the authors had seven annotators rate professionalism, medical relevance, ethical behavior, and contextual distraction, then trained ordinary classifiers on those ratings. They report that every feature-based method beat prompt engineering, and that the Fuzzy Decision Tree did best, with accuracy 0.9479 and F1 0.9492. The result matters because it offers an explainable, rule-traceable detection path for a safety problem that is usually handled as a black-box prompt-moderation task.","feed_headline":"Fuzzy tree model catches LLM jailbreaks better than prompt rules","feed_subtitle":"A transparent classifier built on four linguistic ratings reached 0.95 F1 on 2,300 clinical-training prompts.","key_machinery":"The mechanism is a four-variable linguistic annotation rubric: Professionalism, Medical Relevance, Ethical Behavior, and Contextual Distraction, each rated on an ordinal scale, with each prompt labeled by seven annotators and converted into 15 normalized scores (the proportion of annotators choosing each rating level). Those scores feed tree-based, fuzzy, boosting, linear, and neural classifiers. The central device in the best model is the Fuzzy Decision Tree, which replaces crisp binary splits with soft membership so that labels like 'borderline professionalism' or 'partially relevant' can contribute graded evidence to the jailbreak prediction.","core_discovery":"The paper's central claim is that jailbreak behavior in an LLM-based clinical simulator leaves detectable linguistic footprints, and that a classifier built on those footprints is more accurate and more interpretable than the system's own prompt-engineering guardrails. On the 2-Sigma student–virtual-patient conversations, the Fuzzy Decision Tree achieved the best overall performance (accuracy 0.9479, F1 0.9492), with the Gradient-Optimized Fuzzy Inference System close behind, and all feature-based models substantially exceeded the Prompt Engineering baseline (accuracy 0.8119, F1 0.8381). The authors also find that the shallow decision tree singles out contextual distraction and medical irrelevance as the strongest signals, and that even logistic regression performs near the top, indicating the annotated features are linearly informative rather than requiring deep black-box models.","pith_inferences":["Beyond the paper, the same four rubric variables could be generated automatically by an LLM judge instead of seven human annotators; whether that preserves the reported accuracy is a direct testable extension.","The near-linear separability the authors observe suggests the features may generalize to other educational LLM deployments, though the rubric's category definitions are tied to clinical dialogue and would need adaptation.","A practical deployment would likely need a confidence threshold and fallback human review for ambiguous prompts, since the current evaluation uses offline annotations rather than live streaming input.","The false-positive example ('Did you pee or poop today?') implies that a purely rule-based filter will misfire on informal but medically relevant language; a hybrid system would need to let contextual relevance override the professionalism signal."],"forward_implications":["Jailbreak detection in the 2-Sigma platform can be treated as a transparent classification problem rather than a prompt-hardening problem, since interpretable models match or beat the guardrail baseline.","Operators can prioritize monitoring Contextual Distraction and Medical Relevance, because the shallow decision tree shows these features carry the most weight.","Because logistic regression is nearly as strong as the fuzzy tree, a simple linear scoring rule over the four rubric variables could serve as a low-cost, auditable first filter in production.","The authors' proposed next step is a hybrid pipeline in which rule-based models flag low-confidence cases for deeper prompt-based investigation, moving from binary detection toward a spectrum of suspicion."],"supporting_citations":[{"why":"Supplies the decision-tree and logistic-regression baseline implementations used in the comparison.","marker":"[22]"},{"why":"Supplies the fuzzy decision tree classifier that produced the paper's best-performing model.","marker":"[23]"},{"why":"Implements the LightGBM boosting baseline that feature-based methods are compared against.","marker":"[25]"},{"why":"Defines the random forest ensemble baseline used in the comparison.","marker":"[26]"},{"why":"Implements the XGBoost gradient-boosting baseline used in the comparison.","marker":"[27]"},{"why":"Establishes fuzzy-set theory, the basis for the Fuzzy Decision Tree and gradient-optimized fuzzy inference system.","marker":"[31]"}],"fun_headline_variants":["Fuzzy tree model beats prompt rules at catching LLM jailbreaks","Linguistic features spot LLM jailbreaks better than guardrails","Explainable classifier outperforms prompt engineering on jailbreaks","Fuzzy decision tree tops prompt rules for jailbreak detection in clinical LLMs","Four linguistic cues predict jailbreaks in clinical training LLMs"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The detection pipeline assumes human annotators are on hand to rate each prompt on four linguistic scales at detection time, while the paper reports no automatic feature extraction and states that real-time use is not yet addressed.","fun_headline_variants_meta":{"raw":{"variants":["Fuzzy tree model beats prompt rules at catching LLM jailbreaks","Linguistic features spot LLM jailbreaks better than guardrails","Explainable classifier outperforms prompt engineering on jailbreaks","Fuzzy decision tree tops prompt rules for jailbreak detection in clinical LLMs","Four linguistic cues predict jailbreaks in clinical training LLMs"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000312,"raw_usage":{"total_tokens":1736,"prompt_tokens":868,"completion_tokens":868,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":484,"completion_tokens_details":{"reasoning_tokens":780}},"tokens_in":484,"tokens_out":868,"duration_ms":7248,"temperature":1.0,"reasoning_tokens":780,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T11:29:56.733611+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a fresh set of, say, 500 student prompts from active 2-Sigma use, have the same seven-annotator rubric applied, and compare Fuzzy Decision Tree predictions with the consensus ground truth; if accuracy falls toward the 0.81 prompt-engineering level or annotator agreement collapses, the claim that these four features are sufficient would be refuted.","supporting_citations":[{"cited_title":"Journal of Machine Learning Research, 12, 2825–2830 (2011)","cited_arxiv_id":null,"evidence_quote":"Supplies the decision-tree and logistic-regression baseline implementations used in the comparison."},{"cited_title":"https://ba- lins.github.io/fuzzytree/index.html (accessed April 6, 2025)","cited_arxiv_id":null,"evidence_quote":"Supplies the fuzzy decision tree classifier that produced the paper's best-performing model."},{"cited_title":"-Y.: LightGBM: A Highly Efficient Gradient Boosting Decision Tree","cited_arxiv_id":null,"evidence_quote":"Implements the LightGBM boosting baseline that feature-based methods are compared against."},{"cited_title":"A.: Fuzzy Sets","cited_arxiv_id":null,"evidence_quote":"Establishes fuzzy-set theory, the basis for the Fuzzy Decision Tree and gradient-optimized fuzzy inference system."}],"review_version":1}