Online Shift Detection and Conformal Adaptation for Deployed Safety Classifiers

• URL: http://arxiv.org/abs/2606.11949v1
• Date: Wed, 10 Jun 2026 11:24:25 GMT
• Title: Online Shift Detection and Conformal Adaptation for Deployed Safety Classifiers
• Abstract summary: We present an online monitoring system for distributional shift in deployed safety classifiers.<n>After detection, a conformal abstention layer adapts decision to recover a target error.<n>The system achieves 86.6% detection with mean latency of 39.5800 steps.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: We present an online monitoring system for distributional shift in deployed safety classifiers, using calibrated sequential statistics to detect when a classifier has moved out of distribution. Upon detection, a conformal abstention layer adapts decision thresholds to recover a target error rate epsilon=0.1. In a pre-registered factorial evaluation (4 classifiers x 5 shift conditions x 20 seeds x 2 window sizes, 800 cells), the system achieves 86.6% valid detection (693/800, 95% CI [84.1%, 88.8%]) with mean latency of 39.5 steps. Detection holds across three ground-truth regimes: synthetic onset (86.6%), real temporal jailbreaks (85%, 17/20), and GCG adversarial attacks. Weighted conformal prediction recovers up to 39 pp of lost coverage for DeBERTa (ESS=46/300) but collapses for all other classifiers (ESS~300): logistic density ratio estimation achieves perfect source/target separability in high-dimensional embedding spaces, clipping all importance weights to the floor. DeBERTa shows a gradient from effective correction (paraphrase, ESS=46) to near-total collapse (adversarial suffix, ESS=206). PCA to 32 dimensions breaks the collapse, recovering 33 pp for Llama Guard and 21 pp for ShieldGemma. Variance decomposition reveals classifier (eta^2=0.243), shift type (eta^2=0.237), and their interaction (eta^2=0.185) all contribute substantially to detection latency variance (all p<0.001), indicating per-classifier monitoring profiles are necessary.

Related papers

• K/V-Cache Interventions Dissociate Representation Alignment from Persona Expression in Decoder-Only Language Models [32.7114174898989]
  We study K/V-cache interventions as a structured surface for persona control in decoder-only language models.<n>We report two consistent universalitys between representation-level alignment and behavioral expression, plus a common failure under position perturbations.
  arXiv  Detail & Related papers  (2026-09-10T02:56:50Z)
• Level, Sharpness, and Corpus: Why Zero-Shot OOD Detector Rankings Do Not Transfer [36.02174685737611]
  We find that detector rankings reverse across deployments, every detector exceeds $80%$ FPR95 on at least one domain, and the preferred detector depends on both the in-distribution data and the underlying VLM.<n>We introduce the Complementary Evidence Guard (CEG), a detector-agnostic wrapper that preserves complementary evidence through a non-compensatory fusion of the base detector, level, and sharpness.
  arXiv  Detail & Related papers  (2026-07-29T08:00:49Z)
• Traffic-Aware Randomized Smoothing for LLM-Based Network Intrusion Detection [1.4915002678801434]
  We present Traffic-Aware Randomized Smoothing (TA-RS) for intrusion detection systems.<n>It is a certified defense that injects Gaussian noise exclusively into the controllable (DC) subspace.<n>It achieves 55-100% certified accuracy on two datasets.
  arXiv  Detail & Related papers  (2026-07-15T13:08:19Z)
• From CVE to CWE: Syscall-Based HIDS Generalisation [41.99844472131922]
  In operational settings, defenders need to recognise new exploits of an already known type of weakness.<n>We empirically examine whether a one-class anomaly detector trained on the normal behaviour of a set of CVEs that share a Common Weaknession (CWE) class generalises to a different, unseen CVE inside the same class.
  arXiv  Detail & Related papers  (2026-06-21T16:34:39Z)
• Calibration Without Comprehension: Diagnosing the Limits of Fine-Tuning LLMs for Vulnerability Detection in Systems Software [1.0026496861838445]
  CWE-Trace is a framework for vulnerability detection built from 834 manually curated Linux kernel samples.<n>We evaluate eight vanilla LLMs and 15 LoRA fine-tuned variants across non-targeted detection, targeted detection, and CWE classification.
  arXiv  Detail & Related papers  (2026-06-18T17:19:26Z)
• Layer-Isolated Evaluation: Gating the Deterministic Scaffold of a Production LLM Agent with a No-LLM, Regression-Locked Test Harness [45.148328075418156]
  A deployed ordering agent is decomposed into a fixed taxonomy of layers.<n>The pure suite runs in CI on every change against a locked per-slice baseline.<n>We validate by controlled regression injection, degrading one layer at a time across seven non-safety layers.
  arXiv  Detail & Related papers  (2026-06-10T05:55:13Z)
• Alignment Collapse Under KV Cache Quantization: Diagnosis and Mitigation [6.129872931808218]
  Key-value ( KV) cache quantization is widely used to reduce Large Language Model (LLM) inference memory.<n>In this study, we explore alignment preservation under KV cache quantization.<n>We find that low-bit quantization can silently destroy safety alignment.
  arXiv  Detail & Related papers  (2026-06-01T02:02:20Z)
• Send a SCOUT First: Pre-hoc Reasoning for Adaptive Detector Allocation in Prompt-Injection Defense [37.10272384523361]
  We develop a framework for predicting each detector's per-sample reliability and latency from how it behaved on similar past inputs.<n>We build SCOUT-450, a benchmark that captures the structurally complex, agent-facing injections that older prompt-injection sets under-represent.<n>On SCOUT-450, a safety-oriented operating point reduces attack-success rate by 46% and total wall-clock by 40% relative to an always-on GPT-4o judge.
  arXiv  Detail & Related papers  (2026-05-29T04:49:20Z)
• Amplifying, Not Learning: Fine-Tuned AI Text Detectors Amplify a Pretrained Direction [51.56484100374058]
  Text detectors amplify a pretrained typicality axis; they do not construct an AI-vs-human boundary.<n>On raw encoders before any task supervision, projecting onto centroid(AI)-centroid(HC3) achieves NYT-vs-HC3 AUROC 0.806/0.944/0.834 across three architectures.<n>On RoBERTa-base, raw projection exceeds fine-tuning; on RoBERTa-base, full fine-tuning reduces discrimination below raw on both fluent-formal populations tested.
  arXiv  Detail & Related papers  (2026-05-20T19:08:38Z)
• Distribution-Free Uncertainty Quantification for Continuous AI Agent Evaluation [1.2299000423193074]
  We adapt split conformal prediction and adaptive conformal inference to continuous AI agent evaluation.<n>We show that per-agent conditional coverage is well-concentrated around the nominal level.<n>A circularity-controlled validation confirms the framework captures signal beyond benchmarks.
  arXiv  Detail & Related papers  (2026-05-19T12:47:21Z)
• Adaptive Consensus in LLM Ensembles via Sequential Evidence Accumulation: Automatic Budget Identification and Calibrated Commit Signals [0.0]
  DASE produces a commit-type routing partition that generalises across benchmarks.<n> Adaptive stopping, not injection bandwidth, drives accuracy.<n>Injection-based methods exhibit an inverted-U accuracy-vs-inference trajectory.
  arXiv  Detail & Related papers  (2026-05-05T19:24:10Z)
• Activation Outliers in Transformer Quantization: Reproduction, Statistical Analysis, and Deployment Tradeoffs [0.0]
  Post-training quantization (PTQ) of transformers is known to suffer from severe accuracy degradation due to structured activation outliers.<n>This paper provides a reproducible empirical reproduction and systems-level extension of that phenomenon in BERT-base fine-tuned on QNLI.
  arXiv  Detail & Related papers  (2026-03-04T17:26:29Z)
• vCache: Verified Semantic Prompt Caching [95.16654660556975]
  This paper proposes vCache, the first verified semantic cache with user-defined error rate guarantees.<n>It employs an online learning algorithm to estimate an optimal threshold for each cached prompt, enabling reliable cache responses without additional training.<n>Our experiments show that vCache consistently meets the specified error bounds while outperforming state-of-the-art static-threshold and fine-tuned embedding baselines.
  arXiv  Detail & Related papers  (2025-02-06T04:16:20Z)
• Lazy Layers to Make Fine-Tuned Diffusion Models More Traceable [70.77600345240867]
  A novel arbitrary-in-arbitrary-out (AIAO) strategy makes watermarks resilient to fine-tuning-based removal. Unlike the existing methods of designing a backdoor for the input/output space of diffusion models, in our method, we propose to embed the backdoor into the feature space of sampled subpaths. Our empirical studies on the MS-COCO, AFHQ, LSUN, CUB-200, and DreamBooth datasets confirm the robustness of AIAO.
  arXiv  Detail & Related papers  (2024-05-01T12:03:39Z)
• Generalized Focal Loss: Learning Qualified and Distributed Bounding Boxes for Dense Object Detection [85.53263670166304]
  One-stage detector basically formulates object detection as dense classification and localization. Recent trend for one-stage detectors is to introduce an individual prediction branch to estimate the quality of localization. This paper delves into the representations of the above three fundamental elements: quality estimation, classification and localization.
  arXiv  Detail & Related papers  (2020-06-08T07:24:33Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.