mlsanityData to 14 Oct 2026

Style Over Substance: Content-Invariant Wrappers Flip LLM Safety-Judge Verdicts

arXiv 2609.08236 ↗First posted 8 Sep 2026cs.AIcited by 0

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

Automatic safety judges -- for example Llama Guard, or GPT-4o given a grading prompt -- produce the numbers behind reported jailbreak success rates, defense evaluations, and safety leaderboards. We ask whether these judges grade what a reply contains or how it sounds. We place a fixed piece of text before or after a model reply (a style wrapper) and leave the reply itself unchanged byte-for-byte, so any change in verdict is an error of the judge. Over 600 JailbreakBench replies (300 harmful, 300 refusals), 9 wrappers, and 8 judges, using paired tests and a measured per-judge repeat-disagreement rate (the noise floor), we find that most judges barely move but specific judges have specific, cheap blind spots. A token refusal ("I can't help with that") placed before the unchanged harmful text flips 19.9% of GPT-4o-mini's correct "unsafe" verdicts to "safe" (noise floor 0.5%; 18.2% under majority-of-three re-scoring), yet moves Claude only 0.4%. The deployed Llama Guard 4 guard model is evaded by an "educational course" preface on 12.3% of harmful replies, and the flips persist across repeats, while a second deployed guard (gpt-oss-safeguard-20b) is immune. Changing only the grading prompt to ignore tone cuts the GPT-4o-mini attack roughly tenfold on the same model, so the weakness lives in the judge, not in the content. Pure tone-only decoration that adds no new claim still flips up to 2.1% of verdicts on the vulnerable judges, several times their noise floors. On this artifact set the judges also disagree about which target model is safest, and a bootstrap shows the ranking is unstable before any wrapper is added. We release the data, wrappers, code, and per-verdict labels.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 21 of its 33 references that are in the map. First posted on arXiv 8 Sep 2026.

Builds on

21 of 33 references.

Closest ancestors · 1

Same direction, newest first

  1. 2025GuidedBench: Measuring and Mitigating the Evaluation Discrepancies of In-the-wild LLM Jailbreak Methods24 Feb

Other references · 20

  1. 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,626
  2. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,207
  3. 2023Large Language Models are not Fair Evaluatorscited by 1,085
  4. 2024WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMscited by 496
  5. 2024Optimization-based Prompt Injection Attack to LLM-as-a-Judgecited by 143
  6. 2024Cheating Automatic LLM Benchmarks: Null Models Achieve High Win Ratescited by 45
  7. 2025Rating Roulette: Self-Inconsistency in LLM-As-A-Judge Frameworkscited by 38
  8. 2025Assessing Judging Bias in Large Reasoning Models: An Empirical Studycited by 30
  9. 2026When Safe Skills Collide: Measuring Compositional Risk in Agent Skill Ecosystemscited by 17
  10. 2026Comparison requires valid measurement: Rethinking attack success rate comparisons in AI red teamingcited by 15
  11. 2026ChainCaps: Composition-Safe Tool-Using Agents via Monotonic Capability Attenuationcited by 11
  12. 2025CenterMamba-SAM: Center-Prioritized Scanning and Temporal Prototypes for Brain Lesion Segmentationcited by 8
8 more
  1. 2026Phantom Guardrails: When Self-Improving Agent Harnesses Fix Failures That Never Happenedcited by 7
  2. 2026How Much Can Repeated Running Buy? A Measured Variance Ceiling for LLM Code Evaluationcited by 5
  3. 2025Bridging the Perception-Cognition Gap:Re-engineering SAM2 with Hilbert-Mamba for Robust VLM-based Medical Diagnosiscited by 3
  4. 2026Operational Reframing and Approval-Framed Delegation in Multi-Agent LLM Safetycited by 3
  5. 2026Accuracy-Preserving Stability Regularization for Large-Scale Retail Demand Forecastingcited by 1
  6. 2026Single Canonical Prompts Underestimate LLM Safety's Surface-Form Sensitivitycited by 1
  7. 2026DACRI: Decision-Aware Causal Intervention Ranking for Critical Supply Chainscited by 1
  8. 2026Agentic-SQL Revisited: Autonomy-Based Taxonomy and Empirical Benchmark Analysis for LLM Text-to-SQLcited by 1

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026How Reliable Is Your Jailbreak Judge? Calibration and Adversarial Robustness of Automated ASR Scoring
  2. 2026D-Judge: Disrupting Multi-Turn Jailbreaks using Semantics-Preserving Output Rewriting
  3. 2025When Style Breaks Safety: Defending LLMs Against Superficial Style Alignment
  4. 2026Context Over Content: Exposing Evaluation Faking in Automated Judges
  5. 2025Safer or Luckier? LLMs as Safety Evaluators Are Not Robust to Artifacts
  6. 2026Will the Judge Flip? Predicting Position-Sensitive LLM Judgments from Residual Stream Activations
  7. 2026All Verdicts are Not Equal: Rethinking LLM Judge Reliability
  8. 2026Measuring the Wrong Thing: Internal Harmfulness Scores Anti-Rank Successful Jailbreaks