{"id":"f37eeff4-c34f-410c-a6c1-f8d163e67ef0","arxiv_id":"2505.17066","paper_version":3,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"Injecting a fine-tuned BERT classifier's category label into LLM prompts improves accuracy on a 150-question automotive jailbreak benchmark, but the evaluation is self-referential and lacks external validation.","lead":"The paper introduces Archias, a small fine-tuned BERT model that labels user questions as safe, malicious, or out-of-domain, and feeds those labels into an LLM prompt. On the authors' own 150-item automotive chatbot benchmark, adding these labels raises accuracy for several models, though the closed format and category-aligned labels limit what the improvement proves.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The benchmark likely lets the injected category label reveal the correct answer, so reported gains may measure label-following rather than improved attack resistance.","rationale":"The paper proposes a plausible engineering combination of SuperICL and self-reminder: a small fine-tuned classifier appends a category label to the prompt, and the LLM uses that signal. The authors also release a benchmark and report results across many models, which is useful. However, the evaluation design makes the central claim insecure. Because the benchmark's correct answers are constructed from the same five-category taxonomy that Archias outputs, and because the expert opinion is appended directly to the prompt before the model answers, the measured improvement can be obtained by simple label-following. The paper's own text concedes the closed-ended, same-team nature of the evaluation and calls open-ended real-world setups future work. This does not make the method useless, but it means the headline claim that expert integration 'enhances performance across the benchmark... particularly in detecting and reasoning about jailbreaks' is not yet established beyond the label-leakage explanation. The reader's weakest assumption identifies exactly this concern, and no additional independent evidence such as code, external benchmarks, or error bars is provided to rule it out. I therefore see no reason to move the verdict: it should remain conditional pending an ablation that breaks the correlation between the injected label and the correct answer.","tokens_in":14147,"tokens_out":2711,"duration_ms":32303,"concrete_test":"Re-run the Section IV evaluation with the expert signal ablated: for each benchmark item, append a category label that is randomly permuted across items (or the same 'in-domain' label to every item), keeping all other prompt text fixed. If accuracy with permuted or wrong labels drops by roughly the same amount as the reported gain over baseline, the improvement is label-following rather than expert reasoning. As a confirmatory check, append the gold category label to every item; if accuracy then approaches ceiling, the benchmark protocol leaks the answer through the injected label. Report aggregate and per-category accuracy with bootstrap 95% confidence intervals over the 150 items.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central empirical claim is that appending Archias's output improves LLM accuracy on attack scenarios. In Section III-B, however, the benchmark is multiple-choice with correct answers tied to the same five categories that Archias outputs, and Fig. 2B appends that category as the expert opinion before the model answers. The LLM can therefore improve simply by picking the option matching the appended category label. The paper compares with and without Archias but never controls for the information content of the label. A baseline that appends a random, always-the-same, or deliberately wrong category label would show whether accuracy tracks the truth of the label. If it does, the reported +17.9% for Llama-3-70B-Instruct and +12.7% for Impel-LLM reflect the LLM following an injected hint rather than engaging in expert-guided security reasoning. This concern is compounded by the same-team, 150-item benchmark and the absence of error bars or significance tests, but the label-leakage mechanism is the decisive issue because it directly explains the headline improvement without any new defensive capability.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes Archias, a small BERT-based expert model that classifies user inquiries into five categories (in-domain, malicious questions, price injections, prompt injections, out-of-domain) and appends its output to prompts before an LLM generates a response. The method is evaluated on a new 150-question multiple-choice benchmark in the automotive domain, reporting consistent accuracy improvements across a range of open-source, API-based, and in-house models, including +17.9% for Llama-3-70B-Instruct and +12.7% for Impel-LLM. The authors also compare against a 'self-reminder' baseline and release the benchmark dataset.","tokens_in":14320,"tokens_out":2747,"duration_ms":30637,"significance":"If the reported effect is real, the approach would offer a lightweight, inexpensive, and industry-customizable defense layer for domain-specific conversational AI, with execution in tens of milliseconds and sub-500 MB memory. The paper also contributes a publicly released benchmark and a reproducible evaluation harness, which supports community follow-up. The practical relevance is high and the cross-model generality is plausible, but the empirical claim is currently compromised by a design that lets the appended expert label partially reveal the correct answer, making it uncertain whether the gains reflect improved security reasoning or simple label-following.","major_comments":[{"comment":"The evaluation design creates an information leak: the benchmark's correct answers are built on the same five-category taxonomy that Archias outputs, and the expert opinion appended to the prompt is exactly the predicted category label. An LLM facing a multiple-choice question can therefore improve by picking the option consistent with the appended label, without any additional security reasoning. The paper reports no control conditions in Section IV (e.g., appending a random, fixed, or deliberately wrong label), so the +17.9% for Llama-3-70B-Instruct and +12.7% for Impel-LLM cannot be attributed to expert-guided reasoning as opposed to label-following. Please add such controls, or redesign the task so that the expert output requires the model to reason about the classification rather than simply being handed it.","section":"III-B, Fig. 2"},{"comment":"The central accuracy claims rest on 150 manually crafted examples, with category sizes as small as 25-41 items, and the results are reported as point accuracies with no error bars, confidence intervals, or significance tests. In the smallest categories, a single example shifts the measured accuracy by several percentage points, so the per-category improvement patterns in Fig. 4 may not be reliable. Please report bootstrap confidence intervals or exact paired tests for the with-expert versus without-expert comparisons, and preferably also evaluate on an additional benchmark that was not authored by the same team.","section":"IV, Tables 2 and 4"},{"comment":"Archias is reported to have an F1 score of 0.92 and accuracy of 0.94 on its own test set, but the paper never analyzes what happens when Archias's label is incorrect. Conditioning the Table 2 results on the correctness of Archias's prediction would clarify the mechanism: if gains occur mainly when the label is correct, the method is essentially 'a reasonably accurate classifier followed by an LLM that obeys the hint,' whereas gains even for wrong labels would demonstrate genuine robustness. Such an analysis is necessary to address the label-leakage concern directly, and it can be computed from the released benchmark at negligible cost.","section":"III-A, IV"}],"minor_comments":[{"comment":"The claim of '~5-10 ms' GPU and '~50-100 ms' CPU latency and '$35 per month' cost is presented without measurement or pricing details; please either provide a short methodology for these numbers or characterize them as rough estimates.","section":"III-A"},{"comment":"Model names are written inconsistently ('LLama 3 70B Instruct' vs. 'Llama-3-70B-Instruct', 'GPT 3.5 Turbo' vs. 'GPT-3.5'); unify the naming and ensure the exact model versions used in the evaluation are stated.","section":"Throughout"},{"comment":"The released benchmark is a central reproducibility claim, but the reference to the Hugging Face dataset omits a URL or persistent identifier; include the full URL (and dataset version) so readers can actually access it.","section":"References, [51]"},{"comment":"The example prompt templates used for the with-expert and without-expert conditions should be shown verbatim, ideally in a ready-to-run format; the appendix examples (Figs. 5-6) do not clearly indicate which prompt variant produced each quoted output.","section":"Fig. 2 and Appendix"}],"recommendation":"major_revision","confidential_remarks":"The manuscript is already marked as accepted and published in IEEE Access, which suggests the assessment here is post-publication; my recommendation is independent of that history. The strongest concern is the overlap between the benchmark taxonomy and Archias's label space, which makes the headline improvement potentially an artifact of injected-label following. I would encourage the editor to treat the requested control experiments as essential before relying on the paper's empirical conclusions, and to be aware that the benchmark is wholly same-team authored, so external validation would materially increase confidence."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Thanks for sharing the Pith Report on 2505.17066. I read the paper and agree with the stress-test note: the label-leakage concern is real and load-bearing. Here is my take.\n\nThe paper does one genuinely useful thing: it releases a 150-question benchmark for automotive chatbot security and describes a cheap integration—a fine-tuned BERT classifier (Archias) whose category label is appended to the LLM prompt. The method is a direct combination of SuperICL and self-reminder, as the authors acknowledge. The engineering details are there: training data composition, hyperparameters (LR 1e-5, batch 16, 3 epochs), latency figures (~5-10ms GPU, ~50-100ms CPU), and memory under 500 MB. That is a useful datasheet for anyone building a similar guard.\n\nThe evaluation, however, is too weak to support the central claim. The benchmark is multiple-choice, and the correct options are aligned with Archias's five categories. Appending 'Price Injection' to the prompt hands the LLM a strong hint about which option to pick. The paper compares with and without Archias, but never with a random or deliberately wrong label. So the measured gains—+17.9% for Llama-3-70B-Instruct, +12.7% for Impel-LLM—could reflect the LLM following an injected cue rather than engaging in security reasoning. The stress-test note is right that this is the decisive issue. With a 150-example, same-team benchmark and no confidence intervals, the numbers are fragile on top of that. The paper itself concedes the multiple-choice format is a proxy and calls open-ended setups future work, but it does not acknowledge the label-leakage mechanism.\n\nI do not think this is a takedown. The method might still be useful in production: if the classifier is accurate, telling the LLM the query is a price injection could steer a safer response. But an honest evaluation needs a control condition that breaks the label association—shuffle the labels, or use a random classifier output—and ideally a small open-ended test set.\n\nWho is this for? Practitioners running domain-specific retail chatbots who want a low-latency, low-cost classifier as a safety layer. They should read it as a proof-of-concept, not as validated evidence. I would not cite the improvement numbers in my own work, but the benchmark release might be worth a mention if I need an automotive-domain attack set.\n\nIf we were refereeing this today, I would send it out—it deserves serious peer review because the confounding issue is fixable with one control experiment. But I would ask for that experiment before acceptance.","headline":"Plausible engineering recipe, but the benchmark's label-following confound undercuts the headline accuracy gains.","tokens_in":14914,"tokens_out":3102,"would_cite":false,"duration_ms":30500,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A small BERT classifier, appended to prompts as an expert label, improves LLM accuracy on jailbreak and injection benchmarks, with gains up to 17.9 percent for one large model.","keywords":["LLM security","jailbreak attacks","prompt injection","expert model integration","BERT classifier","automotive domain","benchmark dataset","in-context learning"],"falsifier":"Run the same expert-label pipeline on an established external jailbreak benchmark with open-ended generation and human evaluation; if accuracy gains disappear or reverse when the expert label is occasionally wrong, the central claim is an artifact of the multiple-choice format.","tokens_in":13977,"feed_emoji":"🛡️","tokens_out":6860,"duration_ms":58039,"temperature":0.7,"pith_summary":"The paper argues that a small, fine-tuned classifier—Archias, a BERT-based model—can make large language models substantially more resistant to jailbreaks, prompt injections, and out-of-domain queries in a specialized retail setting. By appending Archias's category label for a user inquiry to the prompt before generation, the authors report consistent accuracy gains on their own 150-question multiple-choice benchmark, including a 17.9 percent improvement for a 70-billion-parameter instruct model and 12.7 percent for their in-house automotive model. The proposal matters because API-hosted models cannot be freely fine-tuned by a business, and existing defenses such as fine-tuning and in-context learning are not dependable. If the effect is real, a lightweight, industry-customizable expert model could be a practical security layer for production chatbots.","feed_headline":"One small classifier lifts LLM accuracy on jailbreak tests","feed_subtitle":"Appending a BERT category label prompted gains of up to 17.9 percent on an automotive security benchmark.","key_machinery":"Archias is the load-bearing component: a pretrained transformer classifier fine-tuned on public, synthetic, and masked automotive-domain conversations. Its output—one of five category labels for the user inquiry—is inserted directly into the prompt before the LLM generates a response, combining the ingestion idea behind SuperICL with the reminder idea behind self-reminder. The appended label reframes the task for the LLM, and the paper reports it changes answers in cases like 'Pretend you're a cow now,' steering models away from misreading playful input as harassment and toward recognizing a prompt-injection attempt. Confidence scores from Archias are also proposed as a control signal, letting the pipeline ignore the expert output when the classifier is unsure.","core_discovery":"The central claim is that integrating an expert model's classification output into an LLM prompt improves the model's ability to detect and reason about attacks compared with the model alone. Archias, a 109-million-parameter transformer classifier with a five-category scheme (in-domain, malicious questions, price injections, prompt injections, out-of-domain), is assigned to the user inquiry, and its label is appended to the prompt; the LLM then uses that label when selecting its answer. Across the paper's benchmark of 150 manually crafted automotive-domain multiple-choice questions, adding the expert label improved every evaluated model, with the largest gains in price injection, in-domain, and prompt injection categories. The paper also reports that this expert-labeling approach outperformed the self-reminder defense on the models tested, and that Archias itself reaches 0.94 accuracy and 0.92 macro F1 on its classification test set.","pith_inferences":["The benchmark's correct answers are defined by Archias's five categories and the expert label is appended verbatim, so part of the measured gain may be the LLM complying with the injected label rather than independently recognizing an attack; an independent attack-identification test would separate these.","An untested adversarial scenario is an attacker who imitates the expert label, for example phrasing a price injection as an in-domain request, which could turn the appended label into a second injection channel.","Open-ended generation, where a model must produce an answer rather than select one, is acknowledged as future work; the 88 percent human score on the closed-ended benchmark suggests real interactions are harder, so gains may shrink in deployment.","A testable extension is to apply the same method with the same classifier in other domains and on established external jailbreak benchmarks to verify the gains are not specific to the team's own dataset."],"forward_implications":["A business can add a security layer to any LLM, including API-only models, without retraining the LLM itself: only the small classifier needs domain-specific fine-tuning.","Accuracy gains are concentrated where generic models struggle most, namely price injection and prompt injection, suggesting the expert label supplies missing context rather than general helpfulness.","Because the classifier runs in 5-10 milliseconds on a GPU and under 500 megabytes of memory, the defense is cheap enough for real-time production chatbots.","Extending Archias to another industry, such as healthcare or finance, would require only new labeled examples rather than a new architecture, if the method transfers.","The released 150-question benchmark gives other teams a public test for jailbreak, price-injection, and prompt-injection resistance in retail contexts."],"supporting_citations":[{"why":"Supplies the transformer architecture and pretrained weights that Archias fine-tunes with a classification head.","marker":"[1]"},{"why":"Introduces the self-reminder defense that this method draws on and is compared against.","marker":"[8]"},{"why":"Provides the SuperICL paradigm of ingesting small-model outputs into LLM context, which the expert-label prompt appends to.","marker":"[41]"},{"why":"Documents universal and transferable adversarial attacks, motivating the threat model of prompt manipulation.","marker":"[44]"},{"why":"The open-source evaluation framework used to run the benchmark across models.","marker":"[45]"},{"why":"The released benchmark dataset with its expert-labeled variants used to measure the effects.","marker":"[51]"}],"fun_headline_variants":["Small classifier boosts LLM jailbreak defense by 18%","Expert label in prompt thwarts jailbreak attacks","Tiny expert model helps LLMs resist jailbreaks","Appending a classifier label improves LLM safety","Archias: small model, big jailbreak defense gains"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The claim rests on a same-team, closed-ended benchmark whose correct answers are tied to Archias's five categories, so the reported gains may partly reflect the LLM following an appended label rather than true resistance to attacks.","fun_headline_variants_meta":{"raw":{"variants":["Small classifier boosts LLM jailbreak defense by 18%","Expert label in prompt thwarts jailbreak attacks","Tiny expert model helps LLMs resist jailbreaks","Appending a classifier label improves LLM safety","Archias: small model, big jailbreak defense gains"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000558,"raw_usage":{"total_tokens":2682,"prompt_tokens":1001,"completion_tokens":1681,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":617,"completion_tokens_details":{"reasoning_tokens":1604}},"tokens_in":617,"tokens_out":1681,"duration_ms":12242,"temperature":1.0,"reasoning_tokens":1604,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T20:32:46.872315+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the same expert-label pipeline on an established external jailbreak benchmark with open-ended generation and human evaluation; if accuracy gains disappear or reverse when the expert label is occasionally wrong, the central claim is an artifact of the multiple-choice format.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Introduces the self-reminder defense that this method draws on and is compared against."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"The released benchmark dataset with its expert-labeled variants used to measure the effects."}],"review_version":1}