3 papers
cs.CR2026
Unread or Unenforced? Separating Representation from Enforcement Failure in Content Guards
Haoyu Zhang, Yi Feng, Shibo Zheng +6
When an encoded attack passes a content guard, the guard either never represented the payload's harmful content or represented it and failed to act. End-to-end attack success rate…
cs.CR2026
Refusing Everything Looks Safe: Restoring the Benign Arm to Encoded-Prompt Evaluation
Haoyu Zhang, Haowen Xu, Xiao Luo +7
Encoded-prompt attacks are evaluated almost entirely on their harmful arm: a benchmark sends obfuscated harmful requests and reports how often the model complied. A high refusal ra…
cs.CR2026
The Uncontrolled Variable: Vision-Language Refusal Is Conditioned on the Image-Attachment Interface, and Not Robust to Irrelevant Image Properties
Haoyu Zhang, Yi Feng, Shibo Zheng +8
We show that aligned vision-language models also condition refusal on a property of a request's form: whether an image is attached, holding everything the request asks fixed. Attac…