2026/06/30 by Jun Wen Leong
Computer Science · Mathematics · #cs.LG #cs.CR #stat.ML
30 pages, 11 figures, 9 tables. Code and pre-registration at https://github.com/junwenleong/safety-classifier-shift-monitor
arxiv created 2026/08/04 · arxiv updated 2026/08/05
Reasoning models deployed as safety monitors exhibit a systematic vulnerability: reasoning-token budget starvation. Adversarial inputs require 3.3× more reasoning tokens than benign inputs to produce valid safety scores (T50,adv=154 vs. T50,benign=46 for o3), so low-budget deployments silently starve the monitor on exactly the inputs it must catch. This compounds the central failure mode: gradient-based evasion remains the residual threat -- template jailbreaks fail at 99%, but GCG-optimized suffixes flip encoder decisions reliably. We systematize a canary construction -- score-disagreement monitoring between a targeted and un-targeted classifier -- and quantify its reliability under targeted evasion. We derive the exact security boundary -- a confidence-gated equilibrium at which a monitor-aware attacker stalls (validated gap = 1/(2λ), within 95% CI of theory) -- and identify a failure mode in post-shift conformal adaptation. Three contributions. (1) Factorial drift benchmark. A pre-registered 800-cell evaluation (4 classifiers × 5 shift types × 20 seeds × 2 windows) reveals detection difficulty is dominated by a classifier×shift interaction (η2 = 0.185): encoders detect paraphrase drift in 28 steps but miss adversarial suffixes for 37; decoders show the opposite. (2) Conformal collapse in generative embeddings. Weighted conformal prediction fails on decoder classifiers: logistic density-ratio estimation achieves perfect separability in 3584--4096-dimensional space, clipping all importance weights to zero. Projecting to ≤32 dimensions restores coverage (+33pp). (3) Adversarial canary threat model. Across 35 frontier models, a 4-tier threat model yields deployment guarantees (≥71% detection, <1.5% FPR at N=1000)