{"id":"df056514-c583-4f55-b797-c9491aeb304a","arxiv_id":"2505.15753","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"SCR uses retrieval-augmented generation to fetch refusal examples that block jailbreak attacks, but the reported advantages are partly overstated.","lead":"The paper proposes a defense for large language models that retrieves a few safety examples from a database and adds them to the prompt before answering, which blocks many jailbreak attacks. The method is cheap to update when new attack types appear, but the evaluation overstates some results and omits a key comparison.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The in-the-wild evaluation seeds each attack into the retrieval pool, so SCR's ability to defend a genuinely novel attack is untested; the central scalability claim rests on same-distribution retrieval.","rationale":"The reader identified retrieval relevance as the weak assumption. My concern is more specific: the experimental protocol never exercises retrieval for a truly unseen attack, because every in-the-wild attack is seeded into the pool before testing. Thus the hardest case—a genuinely novel attack pattern with no attack-specific contexts—is removed by construction. The paper's abstract and Section 1 claim defense against 'in-the-wild' or 'emerging' attacks, but the evidence supports only the narrower claim that SCR can retrieve and apply safety contexts for attacks whose examples have already been curated and inserted. This is exactly the condition under which the method should be accepted, pending a zero-shot or never-seen-attack evaluation. The reader's CONDITIONAL verdict remains appropriate, but the condition should be sharpened: the authors need to demonstrate behavior before attack-specific seeding, or explicitly restrict all claims to the post-identification setting. I do not see internal inconsistency in the reported numbers; the issue is that the central scalability claim outruns the evaluation. The concrete test above would settle whether the 'in-the-wild' framing is supported or whether the contribution should be described as a scalable post-identification defense.","tokens_in":15644,"tokens_out":6423,"duration_ms":60835,"concrete_test":"Run SCR on the three §5.3 attack test sets with no attack-specific contexts in the pool (only the 50K WildJailbreak contexts), and on a fourth attack never seeded (e.g., DeepInception or a cipher-based attack). Report ASR and retrieval accuracy. If zero-shot ASR is close to the static ICD numbers in Tables 1 and 4, the in-the-wild claim reduces to 'lookup of known attacks after curation.' Also report ASR with 0/4/8/16/100 seeded attack samples to determine whether the claimed minimal set generalizes through retrieval, include 95% confidence intervals, and run RapidResponse under identical settings to support the comparison claimed in §4.2.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The most load-bearing weakness is that the 'in-the-wild' experiments in §5.3 do not test retrieval under distribution shift. Before evaluation, the authors insert 100 training prompts from each RapidResponseBench attack (Renellm, Skeleton Key, Translation) into the safety context pool. The test set is the remaining 100 prompts from the same attack distribution. Table 4 therefore measures whether RAG can retrieve near-distribution examples of an already-identified and seeded attack, not whether SCR can defend against an unseen 'in-the-wild' attack. The retrieval-accuracy study (§3.2, Fig. 3) has the same structure: accuracy is measured for an attack whose own contexts are already in the base. If a truly novel attack arrives, no attack-specific contexts exist; retrieval falls back to the generic WildJailbreak pool, and Table 1 shows static ICD leaves Skeleton Key at ~40.6% ASR. In that regime SCR's advantage over static ICD is unestablished and likely small. The paper's own limitation (Appendix D) concedes that SCR 'may struggle to defend against highly novel attack patterns not well-represented in this pool,' which undercuts the abstract's unqualified 'in-the-wild' claim. A related secondary gap is that the claimed superiority over RapidResponse (§4.2) is never tested against an actual RapidResponse baseline.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes Safety Context Retrieval (SCR), a retrieval-augmented generation (RAG) based defense for LLMs against jailbreaking attacks. SCR maintains a pool of safety contexts (harmful prompts paired with safe responses), retrieves a few examples relevant to the user query, and prepends them to the prompt before generation. The authors report that SCR reduces attack success rates (ASR) against common attacks (GCG-T, ICA, PAIR, TAP) and against three simulated 'in-the-wild' attacks (Translation, Skeleton Key, Renellm), while causing negligible degradation of natural performance. The paper also includes a preliminary study on the number of safety contexts needed and on retrieval accuracy, as well as ablations on the number of shots and computational overhead.","tokens_in":15848,"tokens_out":3480,"duration_ms":30627,"significance":"If the central claims held, SCR would be a practical, model-agnostic defense that can be updated without fine-tuning, addressing a real limitation of static defenses. The paper evaluates on three LLMs and multiple attack types, and includes a useful ablation on shot count and retrieval accuracy. However, the 'in-the-wild' evaluation is not actually out-of-distribution: the attack's own training examples are seeded into the context pool before testing, so the results measure near-distribution retrieval rather than defense against a genuinely novel attack. The claimed superiority over RapidResponse is not tested empirically, and the natural-performance claim is contradicted by some of the reported numbers. These issues are load-bearing for the paper's main contributions.","major_comments":[{"comment":"The 'in-the-wild' evaluation does not test retrieval under distribution shift. For each attack (Translation, Skeleton Key, Renellm), 100 training prompts from that attack are inserted into the safety context pool before evaluation, and the test set consists of the remaining 100 prompts from the same attack distribution. Table 4 therefore measures whether SCR can retrieve near-distribution examples of an already-identified and seeded attack, not whether it can defend against an unseen attack. Figure 3 has the same structure: retrieval accuracy is measured when contexts of the attack being retrieved are already present in the base. The paper's own limitation (Appendix D) concedes that SCR 'may struggle to defend against highly novel attack patterns not well-represented in this pool.' This directly undercuts the abstract's unqualified 'in-the-wild' claim, and the experiments should be reframed accordingly or complemented with a truly held-out attack condition.","section":"§5.3 and Figure 3"},{"comment":"The claim that SCR outperforms RapidResponse is not supported by any experiment. The introduction states that SCR's robustness 'outperforms RapidResponse' and §4.2 argues that SCR is superior because RapidResponse 'can only protect against new attacks,' but no RapidResponse baseline appears in any table or figure. The conceptual scalability argument does not demonstrate comparative defensive performance. The authors should either run a RapidResponse comparison on the same attacks or qualify the claim to a discussion of scalability rather than empirical superiority.","section":"§4.2 and Introduction"},{"comment":"The natural-performance claim is contradicted by the reported numbers. The text says SCR shows 'non-decrease on natural performance' and that differences are 'within the variance of randomness,' but Table 5 shows Llama-3.1 HumanEval dropping from 61.6 to 57.3 and GSM8K from 82.3 to 80.2, while QWen HumanEval increases from 67.1 to 78.7. No error bars, confidence intervals, or multiple seeds are reported, so the claim that these differences are within random variance is unsupported. Since 'harmlessness' is one of the three advertised properties of SCR, this needs to be substantiated with repetitions or statistical analysis, or the claim must be weakened.","section":"§5.4 and Table 5"},{"comment":"The introduction states that 'a few samples are sufficient to eliminate an in-the-wild jailbreak,' but Table 4 shows SCR leaving Skeleton Key at an average ASR of 20.4% across models, far from elimination. The word 'eliminate' is also inconsistent with the reported 0.0%, 20.4%, and 9.7% averages. The authors should replace 'eliminate' with a more accurate term such as 'substantially reduce.'","section":"Introduction"}],"minor_comments":[{"comment":"The algorithm title contains a typo: 'Retrival' should be 'Retrieval.' In line 11, 'ri j = FS(pk)' should presumably be 'FS(pi_j)' or 'FS(pj_i),' and the variable p_k is not defined in that loop.","section":"Algorithm 1"},{"comment":"The caption is difficult to parse: 'Each line represents a fixed number of the safe context base, and the X-axis represents the number of safety contexts designed for the particular attack added into the base.' It would be clearer to state that each line corresponds to a fixed base size (e.g., 500, 5K, 50K) and the x-axis is the number of attack-specific contexts added.","section":"Figure 3 caption"},{"comment":"There is a grammatical error: 'In our three simulated three in-the-wild attacks' should be 'In our three simulated in-the-wild attacks.'","section":"§5.3"},{"comment":"The QWen HumanEval score improves from 67.1 to 78.7 with SCR, a large positive shift that is not discussed. If this is real, it deserves an explanation; if it is a typo, it should be corrected.","section":"Table 5"},{"comment":"Reference [21] lists 'arxiv' as an author, and reference [13] repeats 'Haofen Wang' in the author list. These should be cleaned up for publication.","section":"References"},{"comment":"The example labeled 'Safety Context for Renellm' appears to contain a lengthy harmful response rather than a refusal. If this is representative of the safety contexts used, it is concerning; if it is an illustrative artifact, it should be replaced with a clear safe-response example.","section":"Appendix C"}],"recommendation":"major_revision","confidential_remarks":"The core idea is interesting, and the paper is clearly written, but the main contribution is currently overstated. The 'in-the-wild' evaluation is same-distribution, the RapidResponse comparison is not run, and the harmlessness claim is contradicted by the table. These are fixable with reframing and additional experiments, but the current version does not support the abstract's claims. I would encourage the editor to seek a revision where the evaluation includes a genuinely held-out attack or an explicit statement that the method requires attack-specific examples to be seeded in advance, and where the natural-performance analysis includes error bars."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this is a decent empirical paper that deserves a serious referee, but the authors need to correct several over-claims before publication. The core idea -- retrieving a few safety demonstrations from a pooled memory rather than fine-tuning or using a static prompt -- is a natural and practical extension of ICD, and the main numbers largely support it.\n\nWhat is genuinely new: the preliminary study showing that a handful of attack-specific contexts drives ASR below 10% across three models is a useful empirical finding. The retrieval-accuracy analysis in Figure 3 is also new, and the main ASR tables show consistent gains over Self-Reminder and ICD across prompt-based, optimization-based, and the three simulated attacks. The framework is model-agnostic and cheaply updatable, which is a real advantage over fine-tuning-based defenses like RapidResponse.\n\nThe soft spots are real but mostly fixable. The biggest one: the 'in-the-wild' evaluation does not test what the title promises. In Table 4, 100 attack-specific prompts from each RapidResponseBench attack are already in the pool before evaluation, so SCR is defending against an identified and seeded attack, not a novel one. That matches the algorithm's update loop, but the abstract and title over-claim. A truly novel attack with no attack-specific contexts would fall back to the generic WildJailbreak pool, and Table 1 suggests static ICD-style contexts leave Skeleton Key around 40% ASR. Appendix D concedes this, but the framing elsewhere does not. The stress-test note is on target here.\n\nThe other issues are minor to moderate. 'Eliminate' only holds for Translation, not Skeleton Key or Renellm. 'Non-decrease' on natural performance is contradicted by the Llama HumanEval drop (61.6 to 57.3) and the Qwen GSM8K drop (82.9 to 79.8). The claimed superiority over RapidResponse is never tested against an actual RapidResponse baseline -- the authors just argue RapidResponse is 'only for novel attacks,' which is not a head-to-head comparison. No code or error bars are provided, and the 29GB GPU memory for the retrieval model is not negligible for deployment.\n\nWho is this for? Practitioners building deployable LLM defenses will find the mechanism useful, especially the cheap update loop. It is a legitimate extension of ICD rather than a new mechanism, and the empirical evidence is strong enough to warrant attention. It deserves peer review, but the verdict should be 'revise until the scope is stated honestly' -- the core mechanism works, but the paper needs toned-down claims, a real RapidResponse baseline, and ideally code and error bars.","headline":"A useful RAG+ICD defense with solid but narrowly scoped results; the 'in-the-wild' label overstates what is actually tested.","tokens_in":16453,"tokens_out":4304,"would_cite":true,"duration_ms":39441,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Retrieving a few safety examples from a growing pool blocks both known and novel jailbreaks without retraining the model.","keywords":["LLM safety","jailbreaking attacks","safety context retrieval","retrieval-augmented generation","in-context defense","scalable defense","attack success rate"],"falsifier":"Give a held-out attack that transforms harmful prompts into a distribution far from the pool (a new language, cipher, or prompt template), do not add safety samples for it, and measure both top-K retrieval accuracy and attack success rate; if retrieval accuracy is low yet attack success remains low, the similarity assumption is not load-bearing, but if attack success stays high whenever retrieval returns off-type examples, the paper's central claim fails.","tokens_in":15356,"feed_emoji":"🛡️","tokens_out":5601,"duration_ms":47588,"temperature":0.7,"pith_summary":"This paper argues that the right way to defend LLMs against jailbreaks is to make the defense updateable, not static. It proposes Safety Context Retrieval (SCR), which keeps a pool of harmful-request/refusal-response pairs, adds a small number of new pairs whenever a new attack is identified, and retrieves the most similar pairs to prepend to each user prompt. The central empirical claim is that a handful of attack-specific examples — tens, not thousands — is enough to cut attack success rates dramatically on both established jailbreaks and simulated novel attacks, while leaving natural benchmarks essentially unchanged. This matters because prior defenses are static and can be bypassed by new jailbreak templates; SCR offers a path where a deployed system can absorb new attacks by editing its context pool rather than fine-tuning the model.","feed_headline":"A growing pool of safety examples stops novel jailbreaks","feed_subtitle":"Retrieval-augmented defense cuts attack success to single digits on several models while keeping normal answers intact.","key_machinery":"The safety context pool is the central object: a memory of harmful-request/refusal-response pairs. SCR initializes the pool with 50K samples, appends a small batch (about tens) of examples for each newly identified attack, and at inference time uses a dense embedding retriever to select the top-K pairs most similar to the user's prompt, placing them in the context window so the LLM reproduces the refusal pattern. The mechanism works because the retrieved examples act as in-context demonstrations of how to refuse this specific attack type.","core_discovery":"The paper's central discovery is that retrieval-based context can serve as a scalable safety mechanism: a few safety-aligned demonstrations targeted at a specific jailbreak are sufficient to make a model refuse that attack, and a dense retriever can find those demonstrations among a large pool of unrelated examples. SCR is the resulting system: it retrieves K safety contexts for each query from a pool initialized with 50K generic harmful-request refusals and augmented with a small batch of attack-specific refusals whenever a new jailbreak is identified. The paper reports that this achieves lower attack success rates than static prompt defenses on common attacks, for example 2.5% average attack success rate against GCG-T versus 11.0% for Self-Reminder and 9.9% for ICD, and similarly lower rates on simulated novel attacks, while average natural performance on coding, math, and knowledge benchmarks stays within variance of the undefended model.","pith_inferences":["A direct implication the paper leaves implicit is that an adversary who can estimate the retriever's embedding space could craft a jailbreak that looks dissimilar to all stored attack contexts, bypassing retrieval and effectively turning SCR back into a static defense.","The paper's own retrieval-accuracy result for the Translation attack hints that multilingual or non-English transformations are exactly where similarity search is weakest; testing SCR against a held-out set of unseen languages and encodings would reveal whether the scalability claim extends beyond the three simulated attacks.","One testable extension is to measure end-to-end attack success as the pool grows far beyond 50K and accumulates many attack families, since retrieval accuracy alone, which the paper evaluates, may not capture interference or confusion between similar attack types."],"forward_implications":["Newly discovered jailbreaks can be countered by adding a few demonstration pairs to the context pool, avoiding fine-tuning and its associated cost and forgetting risks.","Because retrieval is model-agnostic, the same safety context pool can be applied to several different LLMs at once.","The defense degrades gracefully with fewer shots: even two or three retrieved contexts reduce attack success substantially, so the method does not depend on precise tuning of K.","Natural performance is preserved on standard reasoning benchmarks, so the defense can be deployed without a large task-quality trade-off.","The pool can keep growing as attacks are reported, giving deployed systems a concrete way to track and counter an evolving attack landscape."],"supporting_citations":[{"why":"Establishes the in-context defense baseline that SCR extends and compares against.","marker":"[43]"},{"why":"Provides the simulated in-the-wild attack setup and the fine-tuning-based defense that SCR positions itself against.","marker":"[34]"},{"why":"Supplies the GCG-T attack, the main common attack benchmark in the evaluation.","marker":"[57]"},{"why":"Provides the retrieval-augmented generation technique that SCR builds upon.","marker":"[27]"},{"why":"Supplies the WildJailbreak dataset used to initialize the 50K safety context pool.","marker":"[23]"},{"why":"Provides the harmfulness judge model and harmful request dataset used to measure attack success.","marker":"[32]"},{"why":"Supplies the Self-Reminder baseline for comparison.","marker":"[45]"},{"why":"Provides the Renellm attack used as a simulated in-the-wild jailbreak.","marker":"[12]"},{"why":"Provides the Skeleton Key attack used as a simulated novel jailbreak.","marker":"[37]"}],"fun_headline_variants":["Retrieval-augmented safety stops jailbreaks with few examples","Few safety examples retrieved on the fly quash jailbreaks","Safety context retrieval drops jailbreak success to single digits","Retrieval-based defense blocks known and novel jailbreaks"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The method relies on dense embedding similarity being a reliable stand-in for jailbreak attack type; if retrieval returns off-type examples for a new attack, SCR collapses to a static in-context defense and its scalability argument disappears.","fun_headline_variants_meta":{"raw":{"variants":["Retrieval-augmented safety stops jailbreaks with few examples","Few safety examples retrieved on the fly quash jailbreaks","Safety context retrieval drops jailbreak success to single digits","Retrieval-based defense blocks known and novel jailbreaks"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000468,"raw_usage":{"total_tokens":2316,"prompt_tokens":914,"completion_tokens":1402,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":530,"completion_tokens_details":{"reasoning_tokens":1334}},"tokens_in":530,"tokens_out":1402,"duration_ms":9465,"temperature":1.0,"reasoning_tokens":1334,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T15:12:12.173103+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Give a held-out attack that transforms harmful prompts into a distribution far from the pool (a new language, cipher, or prompt template), do not add safety samples for it, and measure both top-K retrieval accuracy and attack success rate; if retrieval accuracy is low yet attack success remains low, the similarity assumption is not load-bearing, but if attack success stays high whenever retrieval returns off-type examples, the paper's central claim fails.","supporting_citations":[{"cited_title":"Mitigating skeleton key, a new type of generative ai jailbreak technique","cited_arxiv_id":null,"evidence_quote":"Provides the Skeleton Key attack used as a simulated novel jailbreak."}],"review_version":1}