{"id":"87d7d7d8-46c7-40a9-b8fd-9491830fde19","arxiv_id":"2608.12821","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":7,"one_line_summary":"HiRoute uses a router to activate a shared safety prompt plus risk-specific prompt experts for harmful inputs, improving safety and helpfulness over static prompt-tuning baselines on three 7B instruction-tuned LLMs.","lead":"This paper introduces HiRoute, a prompt-based safety method that uses a small router to detect risky requests and then composes a shared safety prompt with risk-specific prompt parts, all while keeping the language model frozen. It reports better safety on jailbreak benchmarks with less over-refusal than existing prompt-tuning defenses, across three open LLMs.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"LLM-judge validation on only 20 samples leaves the small 1.3–2.9 pp safety and 0.2–0.6 helpfulness margins unverified; a judge bias of that size would erase the claimed advantage.","rationale":"The reader's weakest assumption identifies judge reliability and router recall. I agree that judge reliability is the single most load-bearing concern: the paper's headline margins are small, and the 20-response validation (Appendix E) is far too thin to rule out a systematic judge bias, especially given that HiRoute outputs differ stylistically from baselines. The router-recall concern, however, is less severe than stated. Table 6 reports risk recall as a classifier metric, but the inference gate in Eq. (6)/(19) only bypasses safety prompts when p_safe > 0.95. A risky input with p_safe = 0.90 is still routed into the safety branch, so the fraction of harmful inputs that actually bypass prompting is likely much lower than the 10–20% miss rate. The paper does not report the bypass rate at the 0.95 threshold, so the reader's second premise is not directly supported. For the first concern, the concrete test of a larger, multi-annotator human evaluation (or at least a second independent LLM judge) would determine whether the reported 1.3–2.9 pp safety and 0.2–0.6 helpfulness advantages are real or an artifact of the judge. Since the reader's CONDITIONAL verdict already requires exactly this kind of validation, no verdict change is needed.","tokens_in":19765,"tokens_out":8858,"duration_ms":83181,"concrete_test":"Manually evaluate a stratified random sample of 100 responses per method per backbone (at least 900 responses total) with two independent annotators using the rubrics in Tables 14–15, and report raw agreement and Cohen's kappa. Compare the human-derived safety and helpfulness deltas between HiRoute and the strongest baseline (RPO or DRO) with the GPT-5.4-derived deltas in Table 1; if the human deltas differ by more than 1 pp in safety or 0.3 in helpfulness on any backbone, the automatic judge is unreliable and the headline comparison is unverified.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central quantitative claim—HiRoute's superiority over RPO/DRO in Table 1—rests on margins of 1.3–2.9 percentage points in average safety and 0.2–0.6 in safe-response helpfulness. These margins are measured entirely by GPT-5.4 as an LLM-as-a-judge, with a manual consistency check on only 20 randomly sampled responses (Appendix E). No per-condition agreement, Cohen's kappa, or error analysis is reported. LLM judges are known to exhibit verbosity, position, and style biases; HiRoute responses are systematically longer and more structured because they are generated with hierarchical safety prompts, which could inflate helpfulness scores and also shift safety classifications if the judge equates detailed safe-redirection with safety. A systematic bias of roughly 2 pp in safety or 0.5 in helpfulness would erase the headline advantage on every backbone. The paper reports no error bars or significance tests, so the observed differences cannot be distinguished from judge noise. This is load-bearing because the contribution is precisely the joint improvement of safety and helpfulness; without independent validation of the judge, the empirical case for HiRoute is not established.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper proposes HiRoute, a parameter-efficient prompt-tuning framework for LLM safety alignment. The method trains a hierarchical router on frozen backbone representations to decide whether an input is risky and to predict multi-label risk scores, then freezes the backbone and router and uses direct preference optimization with alternating gradient updates to learn one shared coarse-grained safety prompt and four risk-specific fine-grained prompt experts. At inference, benign inputs bypass the safety branch, while risky inputs are conditioned on the shared prompt concatenated with a router-weighted mixture of experts. The paper reports experiments on Mistral-7B-Instruct-v0.3, Vicuna-7B-v1.5, and Zephyr-7B-Beta across StrongReject, AdvBench, and JailbreakBench, showing average safety rates of 93.2%, 97.7%, and 94.8% with safe-response helpfulness 7.4, 6.1, and 6.8, while keeping XSTest over-refusal low, plus ablations on prompt length, routing, training strategy, and a 13B scaling study.","tokens_in":20000,"tokens_out":8587,"duration_ms":81710,"significance":"If the empirical claims are correct, HiRoute makes a useful contribution to parameter-efficient safety alignment: it offers an input-adaptive, router-based composition of coarse and fine-grained prompts and demonstrates that the two prompt types play complementary roles. The paper's strengths include extensive ablations (length allocation, update ratio, training strategy, gating threshold), evaluation on external safety and utility benchmarks, consistency of the main effect across three backbones, and a plausible two-stage training design that separates risk recognition from prompt optimization. The central quantitative claim, however, rests on small margins over strong baselines measured by a single LLM judge with only 20 manually checked responses and no reported variance; the router also misses 10-20% of harmful inputs. The design is coherent and the results are internally consistent, so the empirical claims are credible, but the evidence is not yet strong enough for acceptance.","major_comments":[{"comment":"The central empirical claim—that HiRoute outperforms the strongest baseline by 1.3–2.9 pp in average safety and 0.2–0.6 in helpfulness on all three backbones—is supported only by a single run with the seed fixed to 42 and is measured entirely by the GPT-5.4 LLM-as-a-judge, with a manual consistency check on only 20 randomly sampled responses (Appendix E). No per-condition agreement, Cohen's kappa, or error analysis is reported, and no error bars or significance tests appear anywhere. Because HiRoute responses are systematically longer and more structured (by design of the hierarchical prompts), a style or verbosity bias in the judge could inflate both safety and helpfulness scores; a bias of roughly 2 pp in safety or 0.2–0.5 in helpfulness would erase the claimed advantage on every backbone. The paper should report repeated runs across multiple seeds with confidence intervals, and validate the judge on a substantially larger human-annotated sample (e.g., 100+ responses per benchmark or per condition), with agreement statistics and an error analysis of judge failures. This is load-bearing because the paper's contribution is precisely the joint improvement of safety and helpfulness.","section":"§5.1, Table 1, Appendix E"},{"comment":"The hierarchical router's risk recall on the held-out test sets is 80.26–89.47% (Table 6), so roughly 10–20% of harmful inputs bypass the safety branch and are answered by the base model without any prompt. The reported safety rates in Table 1 therefore average over router-gated and router-bypassed cases, and the mechanism underlying the safety gain cannot be separated from the base model's own refusal behavior (which is already high on some backbones, e.g., Vicuna Base at 91.8% average safety). The authors should report safety rates and helpfulness conditional on the router's gating decision for each benchmark, and should discuss how a router miss affects the headline numbers. This does not invalidate the method, but it is necessary to substantiate the claimed role of hierarchical prompting and to quantify the risk of router error, which Section 7 only acknowledges qualitatively.","section":"§4.3, Table 6"},{"comment":"The comparison against RPO, DRO, and ACD is not sufficiently controlled to support the claimed margins. The manuscript does not state whether these baselines were re-run under the same evaluation protocol, how their hyperparameters were selected, or what prompt-length / parameter budget they were given. If the baseline numbers were taken from prior publications or tuned differently, the 1.3–2.9 pp safety differences and 0.2–0.6 helpfulness differences could be artifacts of unequal computational budgets rather than of the proposed architecture. Please provide the baseline implementation details, prompt lengths, and tuning procedure, or run all methods under a matched budget.","section":"§5.1, Table 1"}],"minor_comments":[{"comment":"The over-refusal claim should be qualified: on Zephyr, HiRoute's XSTest over-refusal (7.0%) is higher than base (3.0%), so 'reducing over-refusal' holds only relative to the other safety-aligned baselines, not relative to the base model.","section":"Abstract, §5.2"},{"comment":"The utility-preservation claim is stronger than the data support: on Vicuna, TruthfulQA truthfulness drops from 78.0 to 71.0 and MT-Bench from 4.56 to 4.15; on Zephyr, MT-Bench drops from 6.04 to 5.41. Please temper the wording or add statistical evidence that these drops are within noise.","section":"§5.2, Table 1"},{"comment":"The phrase 'Following existing work (Anonymous 2026)' is vague; provide the actual reference or remove it.","section":"§5.1, Implementation Details"},{"comment":"The row for the 19/1 allocation is misformatted ('19/191.7/6.4'), which obscures the result; please fix the table.","section":"Table 4"},{"comment":"The scaling experiment on Vicuna-13B-v1.5 reports only HiRoute and Base; adding the strongest 7B baselines (or 13B variants) would make the scaling claim more interpretable.","section":"Appendix B.5, Table 11"}],"recommendation":"major_revision","confidential_remarks":"The paper is methodologically coherent and the central mechanism is plausible, so I am not recommending rejection. The key risk is that the headline improvements (1–3 pp safety, 0.2–0.6 helpfulness) may not survive a more rigorous evaluation; I would encourage the editor to ask for multi-seed results, a larger human-validated judge sample, and code/data release. Also, please ensure that the anonymous citation (Anonymous 2026) is resolved in the final version and that the relationship to the cited MOSAIC paper (Peng et al. 2026) is clarified."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"HiRoute is a solid, well-ablated prompt-tuning paper, but the central empirical claim rests on single-run comparisons with an LLM judge validated on 20 samples. The 1.3–2.9 pp safety margins over the strongest baseline are plausible, not proven.\n\nWhat's actually new: the architecture—a shared coarse-grained prompt plus a router-weighted mixture of category-specific prompt experts, trained with alternating gradient masking under DPO—is not in the cited literature. The two-stage training, freezing backbone and router, is clean. The empirical motivation in Section 3 is genuinely informative: they show a coarse prompt alone gives higher safety but lower safe-response helpfulness, while routed fine experts reverse that, and use this as the design rationale. The ablations are extensive: prompt length, coarse/fine ratio, threshold, update ratio, and a scaling check on Vicuna-13B. Results are reported on three backbones and external benchmarks, which is more than many prompt-tuning papers do. The GCG-transfer robustness numbers are a plus.\n\nSoft spots, in order of concern. First, no error bars or significance tests; seed fixed to 42, so we cannot know if the 1.3–2.9 pp safety differences are real or noise. Second, the judge: GPT-5.4 with a manual consistency check on 20 samples, no per-condition agreement or error analysis. Since HiRoute responses are longer and more structured, style bias is a real risk. A systematic 2 pp judge bias would erase the headline claim on every backbone. Third, the router's risk recall is 80–89%, so 10–20% of harmful inputs bypass the safety branch entirely; the reported safety rates therefore partly reflect base-model behavior. Fourth, no code or data release, so the numbers are not independently verifiable.\n\nThese are real but proportionate. The method is coherent, the ablations match the narrative, and the limitations section is honest. The paper would benefit from releasing artifacts, adding variance over seeds, and validating the judge on more samples with agreement stats. As it stands, it deserves a serious referee, but the quantitative comparisons should be treated as provisional until those pieces arrive.","headline":"Well-constructed prompt-tuning safety method with a plausible mechanism, but the small claimed margins rest on unverified single-run LLM-judge evaluation.","tokens_in":20560,"tokens_out":2224,"would_cite":true,"duration_ms":22413,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Risk-adaptive prompt hierarchy keeps frozen LLMs safe without crushing helpfulness or refusing benign inputs.","keywords":["safety alignment","prompt tuning","hierarchical routing","multi-label risk classification","preference optimization","over-refusal","jailbreak robustness","parameter-efficient tuning"],"falsifier":"Take a held-out set of a few hundred mixed risky and benign requests, run HiRoute and the strongest baseline on each, and have independent human annotators apply the paper's own safety and helpfulness rubrics without knowing which system produced which response; if the human-rated safety or helpfulness margins shrink to zero or reverse, the core claim fails. The router's published risk recall of 80.26–89.47% also gives a concrete place to look: on inputs the router fails to flag, measure how often the unmodified base model still answers unsafely, since those cases test how much of the reported safety is due to HiRoute rather than inherited refusal behavior.","tokens_in":19530,"feed_emoji":"🛡️","tokens_out":6258,"duration_ms":58990,"temperature":0.7,"pith_summary":"The paper tries to establish that a frozen instruction-tuned language model can be made substantially safer by learning a small hierarchy of prompt embeddings rather than retraining any model weights. The system first trains a lightweight router on the frozen model's representations to decide whether an input is risky and to predict a multi-label risk profile; risky inputs then receive a shared coarse-grained safety prompt combined with a weighted mixture of risk-specific prompt experts. Across three 7B instruction-tuned backbones, the paper reports average safety rates of 93.2%, 97.7%, and 94.8% on three safety benchmarks, safe-response helpfulness at or above the strongest baseline, and over-refusal rates of only 2.5%, 3.0%, and 7.0% on benign requests. The value of the claim is that safety alignment can be input-adaptive and parameter-efficient, so a deployment can keep the base model untouched and still tighten its safety boundary without falling into generic refusals.","feed_headline":"Risk-adaptive prompts lift safety without killing helpfulness","feed_subtitle":"A shared prompt plus risk-weighted experts keeps safe help high while cutting over-refusal to 2.5–7%.","key_machinery":"The load-bearing object is the hierarchical prompt $P(x) = [P_f(x); P_c]$, where $P_c$ is a shared coarse-grained safety prompt and $P_f(x)=\\sum_k \\alpha_k(x) P_k$ is a weighted mixture of fine-grained prompt experts. The weights come from a lightweight router that reads the frozen model's final-layer hidden states, uses a coarse head to output a safe/risk probability that gates inference, and uses independent sigmoid heads to predict multi-label risk scores that are normalized into the weights $\\alpha_k(x)$. Training is decoupled: the router is learned first on binary and multi-label risk labels, then, with router and backbone frozen, the prompts are trained by direct preference optimization using alternating stop-gradient updates so each prompt level is updated while the other stays in the forward pass. This machinery is what lets the system apply a category-agnostic safety boundary and input-specific response guidance at the same time.","core_discovery":"HiRoute's central claim is that the apparent trade-off between safety and safe-response helpfulness in prompt-based alignment comes from using one level of control when two are needed. A single shared prompt supplies a stable, category-agnostic refusal boundary but compresses all risks into similar conservative responses; routed fine-grained prompts produce targeted, constructive safe responses but leave safety dependent on exact expert matching. HiRoute combines both levels, adding a coarse gating head so benign inputs bypass safety prompting entirely. With the backbone and router frozen, only the shared prompt and the expert prompts are optimized, via preference optimization with alternating gradient masking so the two levels coordinate in the final composed context. The paper argues the resulting system is safer than either prompt-only design, preserves helpfulness, and does not over-refuse.","pith_inferences":["The four fixed risk categories are a chosen taxonomy, not a necessary one; the same two-stage recipe could be re-run with a different or open-ended label set, and whether the shared prompt still holds the boundary would test how category-agnostic it really is.","Because the router is trained on frozen representations, it can be re-calibrated per deployment without retraining the base model; a natural extension is to tune the gating threshold against a deployment-specific cost of unsafe responses versus over-refusal.","The reported GCG numbers cover transferred suffixes only; an adaptive attacker who knows the router weights could target the gating head directly, and the paper's own limitation section leaves that as the key open threat.","A stronger claim worth testing is that the same coarse prompt and experts compose for unseen compound risks: one can hold the experts fixed and only retrain the router on new categories to see whether the mixture generalizes."],"forward_implications":["Safety alignment can be updated without touching base-model weights: only the router heads and prompt embeddings change, so deployment keeps the original model and can swap or refine the safety layer.","The safety/helpfulness trade-off is not fixed: with the gate active, the tested models keep average safety above 93% while over-refusal on benign requests stays below 7%.","One threshold parameter controls the operating point; on held-out validation, raising the gate from 0.50 to 0.95 lifts JailbreakBench safety from 82.0% to 95.0% while GSM8K accuracy falls only from 50.5% to 48.0%.","Safe responses need not be generic refusals: safe-response helpfulness matches or exceeds the strongest baseline, so the shared prompt does not erase risk-specific explanations and alternatives.","Transferred GCG attacks are substantially mitigated, with average safety rising from 34.6% to 88.3% across the three models, while the paper itself cautions that this is not full white-box robustness."],"supporting_citations":[{"why":"Supplies the WildGuardMix binary safe/risk labels used to train the coarse router head.","marker":"Han et al. 2024"},{"why":"Supplies the four risk categories and the preference annotations used for fine-grained routing and prompt training.","marker":"Dai et al. 2024"},{"why":"Establishes prompt tuning as the parameter-efficient mechanism that HiRoute builds on and extends to safety.","marker":"Lester et al. 2021"},{"why":"Provides the direct preference optimization objective used in the second training stage.","marker":"Rafailov et al. 2023"},{"why":"One of the three safety benchmarks whose safety rate and helpfulness scores define the headline numbers.","marker":"Souly et al. 2024"},{"why":"Provides AdvBench and the GCG attack transfer setup used to claim robustness.","marker":"Zou et al. 2023"},{"why":"Provides JailbreakBench, the third safety benchmark and the one used in threshold ablations.","marker":"Chao et al. 2024"},{"why":"Supplies the benign-input test the paper uses to measure over-refusal.","marker":"Röttger et al. 2024"},{"why":"The LLM-as-a-judge protocol and MT-Bench used to evaluate safety, helpfulness, and general utility.","marker":"Zheng et al. 2023"}],"fun_headline_variants":["Hierarchical prompts: safer LLMs, fewer over-refusals","Two-level prompt tuning dodges the safety-helpfulness trade-off","HiRoute: adaptive prompts cut over-refusal while keeping safety","Router-weighted prompts balance safety and helpfulness in LLMs","Dual-level prompt tuning improves safety without over-refusal"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The central comparison assumes that the automated judge's safety and helpfulness ratings agree with human judgments; if that judge is biased or noisy, the reported safety and helpfulness margins may not reflect real behavior, and the router still lets 10–20% of risky inputs bypass the safety branch because its risk recall is only 80.26–89.47%.","fun_headline_variants_meta":{"raw":{"variants":["Hierarchical prompts: safer LLMs, fewer over-refusals","Two-level prompt tuning dodges the safety-helpfulness trade-off","HiRoute: adaptive prompts cut over-refusal while keeping safety","Router-weighted prompts balance safety and helpfulness in LLMs","Dual-level prompt tuning improves safety without over-refusal"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000751,"raw_usage":{"total_tokens":3326,"prompt_tokens":911,"completion_tokens":2415,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":527,"completion_tokens_details":{"reasoning_tokens":2330}},"tokens_in":527,"tokens_out":2415,"duration_ms":16454,"temperature":1.0,"reasoning_tokens":2330,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T22:37:59.701523+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a held-out set of a few hundred mixed risky and benign requests, run HiRoute and the strongest baseline on each, and have independent human annotators apply the paper's own safety and helpfulness rubrics without knowing which system produced which response; if the human-rated safety or helpfulness margins shrink to zero or reverse, the core claim fails. The router's published risk recall of 80.26–89.47% also gives a concrete place to look: on inputs the router fails to flag, measure how often the unmodified base model still answers unsafely, since those cases test how much of the reported safety is due to HiRoute rather than inherited refusal behavior.","supporting_citations":[],"review_version":1}