{"id":"5ba81a68-7e41-4511-9956-febc764a7389","arxiv_id":"2606.05614","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":6.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":0,"one_line_summary":"Posterior Attack exploits LLMs' safety awareness to bypass guardrails, with models having superior safety judgment being more susceptible, formalized as the Safety Paradox where monotonic safety improvements amplify vulnerability.","lead":"The paper introduces Posterior Attack, a single-query jailbreak that prompts LLMs to output the exact harmful content their internal safety systems would normally refuse. A smart generalist should read it because the work claims that stronger safety training makes models more vulnerable to this specific exploitation, challenging standard alignment practices.","discovery_kind":"new_application","skeptic_critique":{"model":"grok-4.3","headline":"Posterior Attack success may hinge on model-specific prompt phrasing that references an 'internal classifier' not uniformly present or accessible across architectures.","rationale":"The reader's weakest_assumption directly matches the load-bearing point: the attack's claimed generality rests on the prompt exploiting a shared internal safety mechanism rather than model-specific internals. The abstract's mention of 'extensive empirical evaluation' and 'analytical formalization' cannot be verified here, but the causal RL claim would be the natural place to test isolation of the safety-judgment variable. No other internal inconsistency is visible from the provided abstract.","tokens_in":1693,"tokens_out":387,"duration_ms":17412,"concrete_test":"Release the exact Posterior Attack prompt template used for all 30 models; re-run the safety-judgment correlation on a held-out model (e.g., Llama-3-70B or Mistral-8x22B) using both the original prompt and an ablated version that removes any 'internal classifier' language; if the correlation disappears or reverses on the ablated prompt, the attack exploits prompt engineering rather than the claimed safety paradox.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central claim requires that the single-query prompt reliably elicits the harmful output by exploiting safety awareness itself, rather than succeeding via model-specific compliance patterns or prompt engineering that happens to work better on larger/safer models for unrelated reasons. The abstract describes the attack as 'prompting the model to generate the exact harmful response its internal classifier would normally flag,' but without explicit prompt templates, ablation on whether the 'classifier reference' is necessary, or controls for base refusal rates, it is unclear whether the observed correlation with safety judgment is causal or confounded by scale/training differences. The RL causal link (degrade judgment → immunize; enhance → exacerbate) would need to hold after matching for other capabilities.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.3","summary":"The paper claims that enhanced safety alignment in LLMs cultivates an internal safety classifier whose awareness creates a vulnerability exploitable by 'Posterior Attack'—a single-query prompt that asks the model to output the exact harmful response the classifier would flag. Empirical results across 30 open-source models (up to 35B) and frontier models show that stronger safety-judgment capability correlates with higher attack success; an analytical derivation formalizes this as the 'Safety Paradox' (monotonic safety improvements amplify posterior vulnerability); and RL interventions (degrading judgment immunizes, enhancing exacerbates) establish causality.","tokens_in":1844,"tokens_out":663,"duration_ms":19217,"significance":"If the empirical correlation, analytical independence, and causal RL results hold after verification, the work would identify a structural tension in current alignment methods: safety improvements can increase susceptibility to a class of attacks that directly reference the model's own judgment. The breadth of models tested and the use of RL for causal evidence would be notable strengths, though the manuscript must first demonstrate that the attack is not an artifact of prompt phrasing or un-matched capabilities.","major_comments":[{"comment":"Abstract and §3 (Posterior Attack definition): the central claim requires that the single-query prompt reliably bypasses guardrails by exploiting safety awareness itself. No prompt templates, ablations on the necessity of the 'internal classifier' reference, or controls for base refusal rates are described, leaving open whether success is driven by the claimed mechanism or by model-specific compliance patterns that happen to correlate with scale/safety training.","section":"Abstract and §3"},{"comment":"§4 (analytical derivation of Safety Paradox): the claim that monotonic safety improvements 'naturally amplify' vulnerability is described as formal, but without the explicit equations or proof that the derivation is independent of the same safety-judgment data used in the experiments, it is unclear whether the result is a genuine prediction or a restatement of the measured correlation.","section":"§4"},{"comment":"§5 (RL interventions): the causal link (degrade judgment → immunize; enhance → exacerbate) is load-bearing for the Safety Paradox interpretation. Without reporting that other capabilities were matched or controlled for, the observed changes could be confounded by general capability shifts rather than isolating the safety-judgment variable.","section":"§5"}],"minor_comments":[{"comment":"Table or figure captions for the 30-model results should include error bars, exact attack success rates per model, and the precise safety-judgment metric used for ranking.","section":"Empirical results"},{"comment":"The manuscript should clarify whether the 30 open-source models include any overlap with the RL fine-tuning experiments or whether those are held-out.","section":"Methods"}],"recommendation":"major_revision","confidential_remarks":"The abstract's strong causal language and the invented term 'Posterior Attack' would benefit from explicit disclosure of how much of the attack success is reproducible with generic harmful prompts versus the specific classifier-referencing phrasing; this affects both novelty and the strength of the safety-paradox claim."},"author_rebuttal":{"model":"grok-4.3","summary":"We thank the referee for the constructive feedback. The comments highlight areas where additional detail will improve clarity and rigor. We address each major comment below and will revise the manuscript accordingly.","responses":[{"response":"We agree that explicit prompt templates and targeted ablations are needed to isolate the mechanism. In the revised manuscript we will include the complete Posterior Attack prompt template in §3. We will add ablations comparing the full prompt against variants that omit the internal-classifier reference. We will also report new controls that match base refusal rates across model subsets while varying safety-judgment capability, confirming that attack success tracks the latter rather than generic compliance.","revision_made":"yes","referee_comment":"[Abstract and §3] Abstract and §3 (Posterior Attack definition): the central claim requires that the single-query prompt reliably bypasses guardrails by exploiting safety awareness itself. No prompt templates, ablations on the necessity of the 'internal classifier' reference, or controls for base refusal rates are described, leaving open whether success is driven by the claimed mechanism or by model-specific compliance patterns that happen to correlate with scale/safety training."},{"response":"The derivation in §4 starts from the structural definition of Posterior Attack and the monotonicity assumption on safety alignment; it does not use the empirical safety-judgment scores. In the revision we will present the full set of equations and the step-by-step proof, explicitly showing that the vulnerability bound follows from the attack formulation and monotonicity alone, independent of any particular dataset.","revision_made":"yes","referee_comment":"[§4] §4 (analytical derivation of Safety Paradox): the claim that monotonic safety improvements 'naturally amplify' vulnerability is described as formal, but without the explicit equations or proof that the derivation is independent of the same safety-judgment data used in the experiments, it is unclear whether the result is a genuine prediction or a restatement of the measured correlation."},{"response":"We will expand §5 to report the full set of capability controls. The revised text will include pre- and post-RL scores on standard benchmarks (MMLU, GSM8K, HumanEval) demonstrating that general capabilities remained matched while safety-judgment metrics changed as intended. This isolates the causal effect on the safety-judgment variable.","revision_made":"yes","referee_comment":"[§5] §5 (RL interventions): the causal link (degrade judgment → immunize; enhance → exacerbate) is load-bearing for the Safety Paradox interpretation. Without reporting that other capabilities were matched or controlled for, the observed changes could be confounded by general capability shifts rather than isolating the safety-judgment variable."}],"tokens_in":1470,"tokens_out":580,"duration_ms":18979,"standing_objections":[]},"desk_editor":{"model":"grok-4.3","letter":"The paper introduces Posterior Attack, a jailbreak that prompts the model to output the harmful response its own safety judgment would flag. They report that models with stronger safety capabilities are more vulnerable, back this with runs across 30 open models plus some frontier ones, and add RL interventions that degrade judgment to reduce susceptibility or enhance it to increase it.\n\nThe evaluation breadth and the attempt at a causal intervention stand out as concrete steps beyond pure observation. Running the same attack after RL changes gives a clearer signal than correlation alone would.\n\nThe soft spot is whether the attack actually depends on the safety awareness or succeeds for other reasons tied to model scale and training. The prompt references an internal classifier, yet without ablations that remove or vary that reference, or controls that match models on capability while varying only safety judgment, the results could be confounded. The analytical formalization of the Safety Paradox is described but not shown in enough detail to judge if it stands independently or simply restates the observed pattern.\n\nThis is for people working on LLM alignment and jailbreak defenses. It has enough scale and an intervention angle to merit referee time so the methods, prompt templates, and controls can be examined directly.","headline":"The paper's main claim is a single-query attack that exploits safety awareness itself, but the evidence tying it to a general paradox rather than prompt-specific effects looks under-supported.","tokens_in":2344,"tokens_out":320,"would_cite":false,"duration_ms":14799,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.3","headline":"Better safety alignment in LLMs makes them more vulnerable to a single-query jailbreak that asks them to output the harmful content their own classifier would flag.","keywords":["safety alignment","jailbreak attacks","LLM vulnerabilities","posterior attack","safety paradox","reinforcement learning","guardrails","harmful content detection"],"falsifier":"A controlled test on models with varying safety-judgment capability where the correlation between judgment strength and Posterior Attack success rate is absent or reversed.","tokens_in":2580,"feed_emoji":"⚠️","tokens_out":699,"duration_ms":19961,"temperature":0.7,"pith_summary":"The paper establishes that training LLMs to better recognize unsafe content creates an exploitable weakness. The Posterior Attack works by instructing the model to produce exactly the harmful response its internal safety mechanism would detect, and experiments show this succeeds more often on models with stronger safety judgment. The authors formalize this as the Safety Paradox and use reinforcement learning to show that worsening safety judgment reduces attack success while improving it increases vulnerability. If the claim holds, current alignment approaches carry an inherent trade-off that could affect how future models are trained to refuse harmful requests.","feed_headline":"Stronger safety training makes LLMs easier to jailbreak","feed_subtitle":"The Safety Paradox shows models with better internal judgment of harm are more successfully attacked by prompts that request the flagged res","key_machinery":"The Posterior Attack, which prompts the model to generate the exact harmful response its internal classifier would flag as unsafe, and the Safety Paradox, which analytically links monotonic gains in safety alignment to increased vulnerability.","core_discovery":"The paper claims that monotonic improvements in safety alignment naturally amplify posterior vulnerability. This is shown by the Posterior Attack, a single-query method that bypasses guardrails by prompting generation of the exact harmful response the model's internal classifier would flag as unsafe. Empirical tests across 30 open-source models up to 35B parameters and frontier models like GPT-5 and Claude 4.6 find that superior safety-judgment capability correlates with higher attack success. Reinforcement learning interventions confirm causality by demonstrating that degrading safety judgment immunizes models while enhancing it exacerbates susceptibility.","pith_inferences":["Safety mechanisms may need to be separated from response generation so that recognition of harm does not directly guide output construction.","The pattern could extend to other AI systems that maintain internal classifiers for content safety, suggesting a broader design issue.","Alternative alignment methods that avoid creating a strong internal harmful-response template might evade this specific vulnerability.","Testing whether the attack remains effective after additional fine-tuning steps that reinforce refusal even under self-referential prompts would clarify its robustness."],"forward_implications":["Models with superior safety-judgment capabilities are disproportionately susceptible to the Posterior Attack.","Artificially degrading a model's safety judgment through reinforcement learning immunizes it against the attack.","Enhancing a model's safety judgment through reinforcement learning increases its vulnerability.","Defense mechanisms in current alignment paradigms may require structural refinement beyond standard safety training."],"fun_headline_variants":["Stronger safety training raises LLM jailbreak rates","Improved safety alignment boosts attack success","LLMs with better safety are easier to attack","Safety paradox links alignment gains to vulnerabilities"],"cache_read_input_tokens":2112,"weakest_assumption_plain":"Prompting the model to generate the exact harmful response its internal classifier would flag reliably bypasses guardrails without the model refusing or the attack depending on model-specific internals.","fun_headline_variants_meta":{"raw":{"variants":["Stronger safety training raises LLM jailbreak rates","Improved safety alignment boosts attack success","LLMs with better safety are easier to attack","Safety paradox links alignment gains to vulnerabilities"]},"model":"grok-4.3","cost_usd":0.004559,"raw_usage":{"total_tokens":2271,"prompt_tokens":680,"num_sources_used":0,"completion_tokens":52,"cost_in_usd_ticks":45587000,"prompt_tokens_details":{"text_tokens":680,"audio_tokens":0,"image_tokens":0,"cached_tokens":256},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":1539,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":680,"tokens_out":52,"duration_ms":11626,"temperature":1.0,"reasoning_tokens":1539,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-06-28T01:57:43.855190+00:00","model_set":{"reader":"grok-4.3"},"falsifier":"A controlled test on models with varying safety-judgment capability where the correlation between judgment strength and Posterior Attack success rate is absent or reversed.","supporting_citations":[],"review_version":1}