Return
Should LLM Safety be More Than Refusing Harmful Instructions?
U
M
U
DOI:10.1007/s10994-026-07107-w.png)
Abstract
En 中文
This paper presents a systematic evaluation of Large Language Models’ (LLMs) behavior on encrypted texts to discuss its safety implications. We introduce a two-dimensional evaluation framework that separately assesses early instruction refusal (whether models refuse harmful-looking instructions) and generation safety (whether models suppress harmful content generation). Previous works have demonstrated that models possessing decryption capabilities are susceptible to under-generalization attacks, where safety mechanisms trained on natural language fail to generalize to encrypted formats. In this work, we show that such scenarios inevitably result in failure along at least one safety dimension: either the generation of unsafe responses (inadequate generation safety) or the over-refusal of legitimate requests (excessive early refusal). Based on these findings, we evaluate a number of pre-LLM and post-LLM safeguards in the encryption schemes where models possess decryption capability (i.e., easy ciphers) and our findings reveal that: (1) most models struggle at balancing both dimensions effectively—prioritizing either instruction refusal or response suppression; (2) pre-LLM defenses fail due to lack of semantic comprehension of encrypted content; (3) post-LLM defenses achieve strong harmful response suppression but are susceptible to over-refusal. This work contributes systematic evaluation methodology and identifies fundamental trade-offs in current safety approaches by analyzing encrypted content.
Keywords:
Language model safety and security
Cryptanalysis
AI Alignment
AI Summary
Key information extracted from the uploaded paper, including a brief overview, abstract, background, key highlights, visual analysis, and future outlook.
Journal
IF:
2.9
Papers:
2.6K
Citations:
3.4W
