Safeguards Based on Copyable Context Cannot Provide Reliable Safety for LLMs

Hugging Face Daily Papers Papers

Summary

This paper argues that LLM safeguards based on copyable context cannot reliably ensure safety, presenting a safety trilemma among useful capability, reliable safety, and open access, and suggesting trusted credentials as a complementary mechanism.

Large language model safeguards decide whether to answer before seeing how an answer will be used. This creates a basic problem for dual-use tasks: the same answer can help an authorized professional or an attacker, while an attacker can imitate a benign request and interaction history. We separate the capability released by the model from the evidence available about downstream use. When that evidence is copyable, we derive the exact worst-case floor on attacker assistance while preserving useful answers. The result yields a safety trilemma: Useful Capability, Reliable Safety, and Open Access cannot coexist. We then show how a trusted credential can complement existing safeguards by adding hard-to-copy information that predicts actual downstream use, and identify the stronger condition needed to eliminate the floor. Evidence from dual-use evaluations, adaptive attacks, and deployed trusted-access programs supports the practical relevance of these conditions.
Original Article
View Cached Full Text

Cached at: 08/03/26, 05:30 AM

Paper page - Safeguards Based on Copyable Context Cannot Provide Reliable Safety for LLMs

Source: https://huggingface.co/papers/2607.27951

Abstract

Largelanguagemodelsafeguardsdecidewhethertoanswerbeforeseeinghowananswerwillbeused.Thiscreatesabasicproblemfordual-usetasks:thesameanswercanhelpanauthorizedprofessionaloranattacker,whileanattackercanimitateabenignrequestandinteractionhistory.Weseparatethecapabilityreleasedbythemodelfromtheevidenceavailableaboutdownstreamuse.Whenthatevidenceiscopyable,wederivetheexactworst-caseflooronattackerassistancewhilepreservingusefulanswers.Theresultyieldsasafetytrilemma:UsefulCapability,ReliableSafety,andOpenAccesscannotcoexist.Wethenshowhowatrustedcredentialcancomplementexistingsafeguardsbyaddinghard-to-copyinformationthatpredictsactualdownstreamuse,andidentifythestrongerconditionneededtoeliminatethefloor.Evidencefromdual-useevaluations,adaptiveattacks,anddeployedtrusted-accessprogramssupportsthepracticalrelevanceoftheseconditions.

View arXiv pageView PDFAdd to collection

Get this paper in your agent:

hf papers read 2607\.27951

Don’t have the latest CLI?curl \-LsSf https://hf\.co/cli/install\.sh \| bash

Models citing this paper0

No model linking this paper

Cite arxiv.org/abs/2607.27951 in a model README.md to link it from this page.

Datasets citing this paper0

No dataset linking this paper

Cite arxiv.org/abs/2607.27951 in a dataset README.md to link it from this page.

Spaces citing this paper0

No Space linking this paper

Cite arxiv.org/abs/2607.27951 in a Space README.md to link it from this page.

Collections including this paper0

No Collection including this paper

Add this paper to acollectionto link it from this page.

Similar Articles

The Safeguard Worked. Is the LLM System Safer?

Hugging Face Daily Papers

The paper argues that evaluating LLM safeguards requires considering real-world deployment risks rather than just local scores, as evidence of residual harm from adaptive attackers is asymmetric and often insufficient in current claims.