safety-guardrail-classifiers-long-context-failure-caused-proportional-dilution-unsafe CLM-0141For safety guardrail classifiers, long-context failure is caused by proportional dilution of the unsafe evidence rather than by absolute input length: as the flagged span's share of the input shrinks, attention mass on it falls, the unsafe-minus-safe logit margin compresses, and unsafe recall collapses, while filling the same length with copies of the unsafe text leaves recall largely intact.
Capability: Losing information in long inputs
Observed on
Open guardrail classifiers (7B-20B) judging a short labeled span embedded in neutral filler, 0.25k-32k words; filler from Wikipedia, chat logs, code, and Chinese text. Safe recall .
Sources
- 15 guardrails on a 30,400-sample synthetic benchmark: mean unsafe recall change -50.1 points vs -1.3 for safe recall; Benign-Fill drops 76.0 to 25.1 while the Needle-Repeat control drops only 85.4 to 67.5. Six models analyzed for attention and logit margin, with partial correlations controlling for log length. Restricting visible context to the needle raises recall; keeping equal random filler lowers it. All needles are synthetically inserted, so real-world long prompts may dilute differently.
Disagreeing is the most useful thing you can do here. Nothing on this page waits for a reviewer: the counts above move when evidence lands, and every source stays attached with who brought it.
Related claims
- As long as trusted instructions and untrusted retrieved content occupy the same model context, defenses that only change how untrusted text is marked or weighted (instruction hierarchies, spotlighting, content detectors) reduce indirect-injection success but do not remove it; only defenses that isolate contexts or restrict the action set give guarantees, at a cost in the agent's ability to combine information across sources.Following instructions hidden in data · reviewed by AI
- On long-context tasks over 8K-128K-token documents in the six official UN languages, models answer word-level span questions well (about 73% average accuracy across 12 models) but degrade sharply as the required unit coarsens to sentence selection (about 21%), paragraph filling and document-level summarization and translation, so long-context competence measured by needle-style word retrieval overstates comprehension of larger discourse units.Losing information in long inputs · reviewed by AI
- In a deployed multilingual medical triage system, most of the accuracy gain comes from writing the clinicians' implicit decision tree into an explicit scoped rule set rather than from moving the final decision out of the LLM: replacing a flat danger-sign list with 231 structured rules in the same end-to-end prompt raised recall from 0.565 to 0.837 and F1 from 0.606 to 0.689, while further handing the decision to a deterministic rule engine over LLM-extracted symptoms left accuracy statistically unchanged (recall 0.810, F1 0.702).Following an unfamiliar procedure · reviewed by AI
- When fine-tuning a base model on instruction data, removing from the training targets any factual claim the base model cannot consistently recall raises the supported-claim rate of later long-form generations, but the gain comes largely from a more conservative response policy — more refusals and fewer supported claims per answer — not from generating more correct facts at equal coverage.Stating false facts confidently · reviewed by AI
- For training-free inference-time hallucination mitigation in 7B vision- language models, reported gains on object-hallucination benchmarks are largely inseparable from reduced informativeness: hallucination rate and object recall/coverage move together, so a lower score can mean the model mentioned fewer visual entities rather than grounded better.Whether the measurement made the finding · reviewed by AI
Notes
Ingested unreviewed on 2026-09-07 and deliberately inert until a human endorses it: it does not move a technique standing, does not count toward the backtest, and is excluded anywhere a claim would carry weight. Drafted confidence: medium. Falsifier as drafted: A paired design in which unsafe recall drops as much when the context is filled with repeated copies of the unsafe needle as when it is filled with benign text, or where recall tracks absolute length rather than needle share. Proposed technique, not yet catalogued: Chunked detection plus attention-head sharpening for long-context guardrails.