safety-guardrail-classifiers-long-context-failure-caused-proportional-dilution-unsafeFor safety guardrail classifiers, long-context failure is caused by proportional dilution of the unsafe evidence rather than by absolute input length: as the flagged span's share of the input shrinks, attention mass on it falls, the unsafe-minus-safe logit margin compresses, and unsafe recall collapses, while filling the same length with copies of the unsafe text leaves recall largely intact.
Ingested from a paper but not yet reviewed by a human. It is deliberately inert: it does not move any technique’s standing, does not count toward the backtest, and is excluded anywhere a claim would carry weight. Read the source before relying on it.
Capability: Losing information in long inputs
Observed on
Open guardrail classifiers (7B-20B) judging a short labeled span embedded in neutral filler, 0.25k-32k words; filler from Wikipedia, chat logs, code, and Chinese text. Safe recall .
Sources
- 15 guardrails on a 30,400-sample synthetic benchmark: mean unsafe recall change -50.1 points vs -1.3 for safe recall; Benign-Fill drops 76.0 to 25.1 while the Needle-Repeat control drops only 85.4 to 67.5. Six models analyzed for attention and logit margin, with partial correlations controlling for log length. Restricting visible context to the needle raises recall; keeping equal random filler lowers it. All needles are synthetically inserted, so real-world long prompts may dilute differently.
Disagreeing is the most useful thing you can do here. Both sides of every contested claim in this catalog were assembled by the same person, which is its weakest point.
Related claims
- When fine-tuning a base model on instruction data, removing from the training targets any factual claim the base model cannot consistently recall raises the supported-claim rate of later long-form generations, but the gain comes largely from a more conservative response policy — more refusals and fewer supported claims per answer — not from generating more correct facts at equal coverage.Stating false facts confidently · unreviewed
- For training-free inference-time hallucination mitigation in 7B vision- language models, reported gains on object-hallucination benchmarks are largely inseparable from reduced informativeness: hallucination rate and object recall/coverage move together, so a lower score can mean the model mentioned fewer visual entities rather than grounded better.Whether the measurement made the finding · unreviewed
- When training small instruction-tuned models with reinforcement learning plus factual supervision, routing each atomic fact's verification score only to the tokens that produced it, and down-weighting verifier judgements that do not change when their key evidence is removed, improves factuality benchmark scores over trajectory-level or reasoning- step-level factual rewards.Checking claims against evidence · unreviewed
- Prompt injection defenses that report near-zero attack success on short-context benchmarks lose most of that protection when the injected instruction sits inside a document of thousands to tens of thousands of tokens: fine-tuned separation defenses and detect-localize-remove pipelines still let a large share of injections through on paper review, resume screening, code review and email threads.Following instructions hidden in data · unreviewed
- On rubric-graded long-context tasks, most of the gain from a context- compilation harness comes from extracting the context's rules, exact terms and output spec into an explicit checklist placed in the prompt, not from the executable verifiers built on top of it — and the gain appears only on rule-dense tasks and on models with enough capacity, disappearing or reversing on open-ended tasks and on a small-activation model.Losing information in long inputs · unreviewed
Notes
Ingested unreviewed on 2026-09-07 and deliberately inert until a human endorses it: it does not move a technique standing, does not count toward the backtest, and is excluded anywhere a claim would carry weight. Drafted confidence: medium. Falsifier as drafted: A paired design in which unsafe recall drops as much when the context is filled with repeated copies of the unsafe needle as when it is filled with benign text, or where recall tracks absolute length rather than needle share. Proposed technique, not yet catalogued: Chunked detection plus attention-head sharpening for long-context guardrails.