Recall Is Not Protection: Evaluating Safety Monitors Against Model Compliance

A safety filter's ability to recognize harmful requests can overstate how much protection it adds. Blocking a request has a different effect when the underlying model would already refuse it. This study separates requests that elicited a harmful answer at least once across repeated attempts from those that did not. Research abstract.

Across six monitor configurations and three model families, the author reports that missed prompts were 2.8 to 5.6 times more likely to receive harmful compliance than caught prompts. The result supports evaluating a filter together with the model it protects: aggregate detection rates can hide weaknesses on the requests most likely to get through.

“Safety monitors screen prompts sent to deployed language models, flagging harmful requests so they are never answered.”

“The prompts a monitor misses are 2.8 to 5.6 times more likely to be complied with than the prompts it catches.”

“This suggests that standard recall may overstate the protection monitors provide in practice, and that monitors should be evaluated against what their models will actually answer.”