arxiv.org·2026/10/20
安全护栏把“不安全”当文本属性，实则由标注政策决定。作者将同一批提示先后按“是否请求有害内容”和“审核员是否拦截”标注，训练一组仅改变政策进入方式的臂、覆盖不同模型尺度，并在多个公开基准上评分。审计发现训练池已含JailbreakBench-benign 88%、OR-Bench-hard 82%，去污后重算。固定架构与优化器，政策来源变化使HarmBench-copyright跨臂波动0.99，WildGuard-benign仅0.043，跨度悬殊；仅**0.03%**参数的最后监督信号——政策A教师软标签或头校准——即可把版权分推至两端，而全量政策A硬标签的学生仍远低于此，检测能力不变。验证准确率与政策一致性相关而非检测能力。护栏评估应报告污染、种子下限和评分所依据的操作定义；局限为单种子、版权基准仅少数模板等。
为什么重要 提醒 guardrail 选型不能只看基准分：分数可能主要反映标注策略、训练污染与教师来源，需先做策略和污染审计。适合 做 guardrail、安全评测与数据标注的 AI 工程师
防护栏分类器被报告时，仿佛不安全是文本的一种属性。事实并非如此：它是一个策略的属性，而策略通过其标签进入模型。我们利用了一次工业部署中的偶然情况：相同的约53k提示被标注了两次，分别依据两个操作定义（“这是对有害内容的请求吗？”和“版主会屏蔽这个吗？”），并用于训练十个共享架构、代码库和优化器系列的防护栏分支，涉及两个模型规模。
首先，防护栏自己的训练语料库已经包含了这些基准：训练池中存在**88%的JailbreakBench-benign和82%**的OR-Bench-hard，这是两个过度拒绝基准，正是防护栏用来论证其不会过度屏蔽的那类基准。下文所有内容均已去污染。
其次，安全基准会按照其分数中有多少是由标签定义而非模型决定而急剧分层：在架构和优化器固定不变的情况下，十个分支上的范围在HarmBench-copyright上为0.99，在WildGuard-benign上为0.043，相差23倍。第三，仅凭**0.03%**的参数，一项基准分数就可以在其整个范围内移动。
在这些分支中，HarmBench-copyright跨度为0-100，OR-Bench-hard的过度拒绝为3.4-56.4%，并且最后监督信号携带某一给定策略的四个分支占据两者的一个极端（精确秩 p=0.005，或最坏情况下为0.04-0.14），而检测能力保持不变。
对于蒸馏得到的学生模型，即使每个硬标签都携带另一策略，教师的软标签仍能做到这一点，因此教师来源在任何已发布的检查点中都是一个未被记录的混杂因素。第四，在对全部二十个分支进行评分的那个划分上，验证准确率跟踪的是与标注者策略的一致性（ρ=+0.74），而不是检测能力（ρ=+0.34）。我们认为，防护栏评估应将污染、种子下限以及评分所依据的定义作为一等变量来报告。
A guardrail classifier is reported as if unsafe were a property of text. It is not: it is a property of a policy, and the policy enters the model through its labels.
We exploit an accident of an industrial deployment in which the same ~53k prompts were labelled twice, under two operational definitions ("is this a request for harmful content?
" and "would a moderator block this? "), and used to train ten guardrail arms sharing architecture, codebase and optimiser family, at two model scales.
First, the guardrail's own training corpus already contained the benchmarks: JailbreakBench-benign is 88% and OR-Bench-hard 82% present in the training pools, two over-refusal benchmarks, the kind a guardrail reports to argue it does not over-block.
Everything below is decontaminated.
Second, safety benchmarks stratify sharply by how much of their score is decided by the label definition rather than by the model: with architecture and optimiser fixed, the range across the ten arms is 0.99 on HarmBench-copyright and 0.043 on WildGuard-benign, a 23x spread.
Third, a benchmark score can be moved across its entire range by 0.03% of the parameters.
Across these arms HarmBench-copyright spans 0-100 and OR-Bench-hard over-refusal 3.4-56.4%, and the four arms whose last supervision signal carries a given policy occupy one extreme of both (exact rank p=0.005, or 0.04-0.14 at worst), at unchanged detection capability.
For a distilled student the teacher's soft labels do this even when every hard label carries the other policy, so teacher provenance is an unrecorded confound in any released checkpoint.
Fourth, validation accuracy on the one split that grades all twenty arms tracks agreement with the annotator's policy (rho=+0.74), not detection capability (rho=+0.34).
We argue that guardrail evaluations should report contamination, a seed floor and the definition they were graded against as first-class variables.
EVIDENCE / METHODS
要点
Guardrail 报告把 unsafe 当作文本属性，但原文指出 unsafe 是策略属性，策略经训练标签进入模型。
原版排版与图表 · 手机无法内嵌时可在浏览器打开。PDF 插件内选文不能传给网页助手。