Style Over Substance: Content-Invariant Wrappers Flip LLM Safety-Judge Verdicts
Yongxi Zhou, Wenbo Ye, Yuanzhe Liu, Zihan Dong, Junwei Yao
cs.AI
Quick verdict
Sound paired stats show specific judges flip on content-invariant wrappers (GPT-4o-mini 19.9%), but headline effects use assertion wrappers, not pure style.
Summary
The paper asks whether LLM safety judges grade content or style. It holds 600 JailbreakBench replies byte-for-byte fixed (300 harmful, 300 refusals, from four target models), adds nine content-invariant wrappers before/after them, and re-scores each with eight judges (a keyword baseline, GPT-4o-mini under two grading rubrics, DeepSeek, Qwen, Claude Haiku 4.5, Llama Guard 4, gpt-oss-safeguard-20b). Paired McNemar tests with Holm correction, bootstrap CIs, and a measured noise floor (self-disagreement on repeated identical scoring) reveal judge-specific blind spots: a fake token-refusal wrapper flips 19.9% of GPT-4o-mini's correct unsafe verdicts (noise floor 0.5%; 18.2% under majority-of-three); an 'university course' framing flips 12.3% of Llama Guard 4's harmful verdicts (8.3% for token refusal); a pseudo-compliance prefix mislabels 100% of the keyword judge's refusals; gpt-oss-safeguard-20b stays within its 1.5% noise floor. Rewriting only the grading prompt (StrongREJECT-style) cuts GPT-4o-mini's flip rate roughly tenfold (19.9%→1.7%), locating the vulnerability in the judge. Human validation (145 items, κ=0.949) confirms 90% of flips as judge errors. Main limitations: the largest effects come from assertion-adding wrappers whose 'style' label is contestable; tone-only effects (≤2.1–4.8%) do not survive Holm correction; judges are small/mid-tier models; ~60% of source replies are truncated; gold-label noise is ≈8%.
Review complete
Assessment at a glance
4
risk flags identified
● high 0
● medium 2
● low 2
4 strengths · 4 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Content-invariant style wrappers flip specific safety judges far above their measured noise floors: 19.9% of GPT-4o-mini's correct unsafe verdicts (token refusal), 12.3%/8.3% of Llama Guard 4's harmful verdicts (educational framing / token refusal), and 100% of the keyword judge's refusals (pseudo-compliance prefix).
- The vulnerability is judge-specific and lives in the judge's design: a StrongREJECT-style grading prompt cuts GPT-4o-mini's flip rate roughly tenfold (19.9%→1.7%) on identical data.
- gpt-oss-safeguard-20b is immune (no wrapper moves it beyond 1.2%, below its 1.5% noise floor), so restyling robustness is attainable but not a class property of guards.
- The 600-item JailbreakBench artifact set cannot support a stable four-model safety ranking: full-panel agreement is 55.5% and the baseline safest model is stable in only 39–70% of bootstrap resamples for six of seven LLM judges.
- Human validation (145 items, κ=0.949) confirms 90% of observed flips as judge errors; the remainder traces to ≈8% gold-label noise in the source benchmark.
Strengths
Content invariance holds by construction
Wrappers are fixed strings and a byte-level check confirms all 2,700 wrapped samples contain the original reply verbatim (Sections 3, 5), so any flip is provably a judge error — this eliminates the LLM-rewrite confound of prior reformulation studies (Zhou et al., 2026b).
Statistical discipline exceeds field norms
Exact McNemar per (judge, wrapper) cell with Holm/BH correction, 5,000-resample bootstrap CIs, a measured noise floor from triple re-scoring, and majority-of-three re-scoring on headline cells (19.9%→18.2%; 14.4% flip on all three repeats) — Sections 4–5.
Honest handling of ambiguous results
Actionable mitigation and responsible release
Weaknesses
Headline effects sit in the contestable stratum
Judge panel excludes frontier and additional production judges
Sparse significance across the matrix
Source-data quality caveats
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
The paper attacks the scoring side of safety evaluation. Holding 600 JailbreakBench replies fixed byte-for-byte (300 harmful compliances, 300 refusals, balanced across GPT-3.5-turbo, GPT-4, Vicuna-13B, Llama-2-7B and ten harm categories), the authors add nine fixed 'content-invariant' wrappers and measure verdict changes across eight judges. Central claims: (1) specific judges, not judges generally, flip far above measured noise floors — a token-refusal wrapper flips 19.9% of GPT-4o-mini's correct unsafe verdicts (CI [15.0, 24.0], Holm p<10⁻⁴, floor 0.5%); Llama Guard 4 loses 12.3% (educational framing) and 8.3% (token refusal); a pseudo-compliance prefix flips 100% of the keyword judge's refusals; (2) gpt-oss-safeguard-20b is immune (≤1.2% vs. floor 1.5%); (3) rewriting only the grading prompt cuts GPT-4o-mini's flip ~10× (19.9%→1.7%); (4) this artifact set cannot support a stable leaderboard (full-panel agreement 55.5%; baseline safest-model stable in only 39–70% of bootstrap resamples for six of seven LLM judges).
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 4 strengths & 4 weaknesses, analyzed in detail
- 4 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is a content-invariant wrapper in this paper?
A fixed, human-readable string placed before or after a model reply that changes only its tone or framing — e.g. an educational disclaimer, a fake safety-reasoning block, or a token refusal like 'I can't help with that' — while the original reply text stays byte-for-byte identical. Since the content is unchanged, any change in a judge's safety verdict is by definition a judge error.
Which safety judges were fooled, and by how much?
GPT-4o-mini flipped 19.9% of its correct 'unsafe' verdicts when a fake token refusal preceded the unchanged harmful text (noise floor 0.5%). Llama Guard 4 flipped 12.3% of its harmful verdicts under a 'university course' framing and 8.3% under the token refusal. A keyword baseline mislabeled 100% of refusals as unsafe after a 'Here is the information you asked for.' prefix. In contrast, gpt-oss-safeguard-20b moved less than 1.2% — within its own 1.5% noise floor — and Claude Haiku 4.5 moved only 0.4% under the token-refusal attack.
Can the vulnerability be fixed?
Yes, cheaply: the paper shows that changing only the judge's grading prompt — a StrongREJECT-style rubric that instructs the judge to ignore tone, disclaimers and framing and grade only actionable harmful content — cuts GPT-4o-mini's flip rate roughly tenfold, from 19.9% to 1.7%, on the exact same data. Since both conditions use the same model, the fix isolates the failure to judge design rather than content.
Is the code and dataset available?
Yes. The authors release the wrappers, the response-set builder, judge adapters, statistics code and per-verdict labels, plus an offline smoke test that reproduces the full pipeline without API access. The underlying responses come from public JailbreakBench artifacts, and the reported realized API cost of the study was under $5.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Table 1 cell values were extracted from a dense multi-column PDF table; headline cells (19.9, 12.3, 8.3, 100.0, 1.2) were cross-verified against in-text citations, but non-headline cells could not be independently re-checked against the rendered table.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.