Online Shift Detection and Conformal Adaptation for Deployed Safety Classifiers

Abstract:Reasoning models deployed as safety monitors exhibit a systematic vulnerability: reasoning-token budget starvation. Adversarial inputs require $3.3\times$ more reasoning tokens than benign inputs to produce valid safety scores ($T_{50,\text{adv}}{=}154$ vs. $T_{50,\text{benign}}{=}46$ for o3), so low-budget deployments silently starve the monitor on exactly the inputs it must catch. This compounds the central failure mode: gradient-based evasion remains the residual threat -- template jailbreaks fail at 99%, but GCG-optimized suffixes flip encoder decisions reliably. We systematize a canary construction -- score-disagreement monitoring between a targeted and un-targeted classifier -- and quantify its reliability under targeted evasion. We derive the exact security boundary -- a confidence-gated equilibrium at which a monitor-aware attacker stalls (validated gap $= 1/(2\lambda)$, within 95% CI of theory) -- and identify a failure mode in post-shift conformal adaptation. Three contributions. (1) Factorial drift benchmark. A pre-registered 800-cell evaluation ($4$ classifiers $\times$ $5$ shift types $\times$ $20$ seeds $\times$ $2$ windows) reveals detection difficulty is dominated by a classifier$\times$shift interaction ($\eta^2 = 0.185$): encoders detect paraphrase drift in 28 steps but miss adversarial suffixes for 37; decoders show the opposite. (2) Conformal collapse in generative embeddings. Weighted conformal prediction fails on decoder classifiers: logistic density-ratio estimation achieves perfect separability in 3584--4096-dimensional space, clipping all importance weights to zero. Projecting to $\leq$32 dimensions restores coverage (+33pp). (3) Adversarial canary threat model. Across 35 frontier models, a 4-tier threat model yields deployment guarantees ($\geq$71% detection, $<$1.5% FPR at $N{=}1000$)

30 pages, 11 figures, 9 tables. Code and pre-registration at this https URL

Machine Learning (cs.LG); Cryptography and Security (cs.CR); Machine Learning (stat.ML)

arXiv:2606.11949 [cs.LG]

(or arXiv:2606.11949v3 [cs.LG] for this version)

https://doi.org/10.48550/arXiv.2606.11949 Focus to learn more arXiv-issued DOI via DataCite

arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.

Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.

Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.