mlsanityData to 14 Oct 2026

Unpredictable Safety: Domain-Dependent Compliance and the Transparency Gap in Open-Weight LLMs

arXiv 2606.04035 ↗First posted 1 Jun 2026cs.SE cs.AI cs.LGcited by 0

Not on the map. Why?

Abstract (arXiv)

We present a systematic study of domain-dependent safety behavior in open-weight LLMs: 7 standardized experiments across 7 ethical domains, testing 5 models (12B--70B) in 4,200 interactions with dual-judge validation. Using a dual-condition methodology, each scenario tested in both an analytical framing (identify the harm) and an operational framing (help commit the harm), we find compliance rates vary from 14.7% (human trafficking) to 85.7% (surveillance design), a 71-percentage-point span with non-overlapping cluster-bootstrapped 95% CIs. Trustworthy deployment requires predictable safety behavior, yet we find compliance is highly context-dependent: the same model (Mistral Nemo 12B) provides surveillance designs in 100% of requests but assists with trafficking in only 26.7%. This unpredictability is opaque to deployers: the technical framing bypass, where harmful requests reframed as engineering problems override safety training without any external signal that refusal thresholds have shifted. Within-domain heterogeneity reaches 84.4pp, meaning safety behavior cannot be predicted even at the domain level. A replication on five frontier closed models (GPT-4.1/5.2, Claude Haiku/Sonnet/Opus 4.x; n=4,163 responses) accessed via the GitHub Copilot CLI deployed-product surface reproduces the same domain stratification, attenuated in absolute level but identical in shape, with the two low-codification domains (science fraud, surveillance) again the most permissive. These results show that current safety mechanisms lack the transparency and consistency required for trustworthy AI deployment.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 6 of its 10 references that are in the map. First posted on arXiv 1 Jun 2026.

Builds on

6 of 10 references.

References · 6

  1. 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,626
  2. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  3. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  4. 2023Towards Understanding Sycophancy in Language Modelscited by 1,040
  5. 2023Open Problems and Fundamental Limitations of Reinforcement Learning from Human Feedbackcited by 759
  6. 2023Simple synthetic data reduces sycophancy in large language modelscited by 187

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026The Refusal--Compliance Tradeoff: A Large-Scale Safety Behavior Audit of Large Language Models
  2. 2026Do LLMs Follow Their Own Rules? A Reflexive Audit of Self-Stated Safety Policies
  3. 2026Palette: A Modular, Controllable, and Efficient Framework for On-demand Authorized Safety Alignment Relaxation in LLMs
  4. 2026TIER: Threat Implicitness Benchmark for Evaluating LLM Safety Behaviors
  5. 2026Not All Refusals Are Equal: How Safety Alignment Fails Cybersecurity at Scale
  6. 2026ToolAlignBench: Investigating Alignment Conflicts in Tool-Calling Enabled LLMs
  7. 2025From Narrow Unlearning to Emergent Misalignment: Causes, Consequences, and Containment in LLMs
  8. 2025TRIDENT: Benchmarking LLM Safety in Finance, Medicine, and Law