safety security
The Guardrail’s Option Label Changed the Decision
An audit of typed decision models separates prohibited actions allowed from permitted actions blocked.
Summary
An audit of typed decision models separates prohibited actions allowed from permitted actions blocked.
Seven open-weight models scored 36% to 72% on screening tests. On synthetic tool policies, misleading names for the permissive option raised fail-open rates to 93%–100% on four label-sensitive models. The tested attacks remained confidently wrong; confidence-based escalation did not repair them. The results concern those models and controlled policies.
Why it matters
An audit of typed decision models separates prohibited actions allowed from permitted actions blocked.
Limits and context
- The tested attacks remained confidently wrong; confidence-based escalation did not repair them.
Key claims
An audit of typed decision models separates prohibited actions allowed from permitted actions blocked.
Qualification: The tested attacks remained confidently wrong; confidence-based escalation did not repair them.
Evidence: source-2026-10-09-021
Sources
- arXiv preprint 2610.12292, original v1arXiv / submitting research authors · primary research
Corrections
No corrections have been recorded for this story.