I Can't Believe It's Not Robust: Catastrophic Collapse of Safety Classifiers under Embedding Drift
On the map: LLM reasoning → Reasoning for agents, planning and code
Abstract (arXiv)
Instruction tuned reasoning models are increasingly deployed with safety classifiers trained on frozen embeddings, assuming representation stability across model updates. We systematically investigate this assumption and find it fails: normalized perturbations of magnitude σ=0.02 (corresponding to ≈ 1^circ angular drift on the embedding sphere) reduce classifier performance from 85% to 50% ROC-AUC. Critically, mean confidence only drops 14%, producing dangerous silent failures where 72% of misclassifications occur with high confidence, defeating standard monitoring. We further show that instruction-tuned models exhibit 20% worse class separability than base models, making aligned systems paradoxically harder to safeguard. Our findings expose a fundamental fragility in production AI safety architectures and challenge the assumption that safety mechanisms transfer across model versions.
Key facts. Cited by 3 papers in the map (data through 14 Oct 2026). Placed in Reasoning for agents, planning and code, one of 17 directions in LLM reasoning. Builds on 5 of its 9 references that are in the map. First posted on arXiv 1 Mar 2026.
Builds on
5 of 9 references.
References · 5
- 2024Towards evaluations-based safety cases for AI schemingcited by 33
- 2025Understanding Model Calibration -- A gentle introduction and visual exploration of calibration and the expected calibration error (ECE)cited by 20
- 2023A benchmark for toxic comment classification on Civil Comments datasetcited by 11
- 2025Who Evaluates AI's Social Impacts? Mapping Coverage and Gaps in First and Third Party Evaluationscited by 4
- 2025Position: The Complexity of Perfect AI Alignment -- Formalizing the RLHF Trilemmacited by 2
Built on by
Citing papers per year: 2026: 3.
3 papers.
- 2026Online Shift Detection and Conformal Adaptation for Deployed Safety Classifierscited by 2
- 2026Calibration of Structured Ignorance Certificates for Diagnosing Unknown Unknowns in Reasoning Modelscited by 0
- 2026Measuring the Wrong Thing: Internal Harmfulness Scores Anti-Rank Successful Jailbreakscited by 0
- 2026Measuring the Wrong Thing: Internal Harmfulness Scores Anti-Rank Successful Jailbreaks10 Aug 2026
- 2026Online Shift Detection and Conformal Adaptation for Deployed Safety Classifiers10 Jun 2026
- 2026Calibration of Structured Ignorance Certificates for Diagnosing Unknown Unknowns in Reasoning Models7 Jun 2026
Similar, not cited
Close in wording, no citation either way
- 2026Empirical Validation of the Classification-Verification Dichotomy for AI Safety Gates
- 2026When Safety Geometry Collapses: Fine-Tuning Vulnerabilities in Agentic Guard Models
- 2025Noise Injection Systemically Degrades Large Language Model Safety Guardrails
- 2026Safety Paradox: How Enhanced Safety Awareness Leaves LLMs Vulnerable to Posterior Attack
- 2025Vulnerability Mitigation for Safety-Aligned Language Models via Debiasing
- 2025Probing the Robustness of Large Language Models Safety to Latent Perturbations
- 2026HyperSafe: Inference-Time Safety Recovery for Fine-Tuned Language Models
- 2026The Off-Support Barrier: Why Semantic Safety Constraints Are Not Learning-Problem Invariants, and What Follows for Prior Design, Containment, and Verification