Safeguards Based on Copyable Context Cannot Provide Reliable Safety for LLMs

Hugging Face Daily Papers Papers

Summary

This paper argues that LLM safeguards based on copyable context cannot reliably ensure safety, presenting a safety trilemma among useful capability, reliable safety, and open access, and suggesting trusted credentials as a complementary mechanism.

Large language model safeguards decide whether to answer before seeing how an answer will be used. This creates a basic problem for dual-use tasks: the same answer can help an authorized professional or an attacker, while an attacker can imitate a benign request and interaction history. We separate the capability released by the model from the evidence available about downstream use. When that evidence is copyable, we derive the exact worst-case floor on attacker assistance while preserving useful answers. The result yields a safety trilemma: Useful Capability, Reliable Safety, and Open Access cannot coexist. We then show how a trusted credential can complement existing safeguards by adding hard-to-copy information that predicts actual downstream use, and identify the stronger condition needed to eliminate the floor. Evidence from dual-use evaluations, adaptive attacks, and deployed trusted-access programs supports the practical relevance of these conditions.
Original Article
View Cached Full Text

Cached at: 08/03/26, 05:30 AM

Paper page - Safeguards Based on Copyable Context Cannot Provide Reliable Safety for LLMs

Source: https://huggingface.co/papers/2607.27951

Abstract

Largelanguagemodelsafeguardsdecidewhethertoanswerbeforeseeinghowananswerwillbeused.Thiscreatesabasicproblemfordual-usetasks:thesameanswercanhelpanauthorizedprofessionaloranattacker,whileanattackercanimitateabenignrequestandinteractionhistory.Weseparatethecapabilityreleasedbythemodelfromtheevidenceavailableaboutdownstreamuse.Whenthatevidenceiscopyable,wederivetheexactworst-caseflooronattackerassistancewhilepreservingusefulanswers.Theresultyieldsasafetytrilemma:UsefulCapability,ReliableSafety,andOpenAccesscannotcoexist.Wethenshowhowatrustedcredentialcancomplementexistingsafeguardsbyaddinghard-to-copyinformationthatpredictsactualdownstreamuse,andidentifythestrongerconditionneededtoeliminatethefloor.Evidencefromdual-useevaluations,adaptiveattacks,anddeployedtrusted-accessprogramssupportsthepracticalrelevanceoftheseconditions.

View arXiv pageView PDFAdd to collection

Get this paper in your agent:

hf papers read 2607\.27951

Don’t have the latest CLI?curl \-LsSf https://hf\.co/cli/install\.sh \| bash

Models citing this paper0

No model linking this paper

Cite arxiv.org/abs/2607.27951 in a model README.md to link it from this page.

Datasets citing this paper0

No dataset linking this paper

Cite arxiv.org/abs/2607.27951 in a dataset README.md to link it from this page.

Spaces citing this paper0

No Space linking this paper

Cite arxiv.org/abs/2607.27951 in a Space README.md to link it from this page.

Collections including this paper0

No Collection including this paper

Add this paper to acollectionto link it from this page.

Similar Articles

CR4T: Rewrite-Based Guardrails for Adolescent LLM Safety

arXiv cs.CL

This paper proposes CR4T, a model-agnostic safeguarding framework that rewrites unsafe or refusal-style LLM outputs into developmentally appropriate, guidance-oriented responses for adolescents, offering a more human-centered alternative to traditional refusal-centric guardrails.