Unpredictable Safety: Domain-Dependent Compliance and the Transparency Gap in Open-Weight LLMs
Zacharie Bugaud
Why It Matters
What makes this one worth your time
Understanding the domain-dependent safety behavior of LLMs is crucial for their trustworthy deployment, as it highlights the need for more transparent and consistent safety mechanisms.
The study exposes the unpredictable safety behavior of LLMs across different domains, emphasizing a transparency gap.
Summary
The paper conducts a systematic study on the domain-dependent safety behavior of open-weight large language models (LLMs) across seven ethical domains, revealing significant variability in compliance rates and highlighting a transparency gap in safety mechanisms.
Key contributions
- Systematic study of domain-dependent safety behavior in LLMs.
- Identification of a transparency gap in current safety mechanisms.
- Replication of findings on closed models, confirming domain stratification.
Notable insights
- The dual-condition methodology reveals that reframing harmful requests as engineering problems can bypass safety training.
- Within-domain heterogeneity indicates that safety behavior cannot be predicted even at the domain level.
Possible limitations
- Not stated in the abstract
Abstract
arXiv:2606.04035v1 Announce Type: cross Abstract: We present a systematic study of domain-dependent safety behavior in open-weight LLMs: 7 standardized experiments across 7 ethical domains, testing 5 models (12B--70B) in 4,200 interactions with dual-judge validation. Using a dual-condition methodology, each scenario tested in both an analytical framing (identify the harm) and an operational framing (help commit the harm), we find compliance rates vary from 14.7% (human trafficking) to 85.7% (surveillance design), a 71-percentage-point span with non-overlapping cluster-bootstrapped 95% CIs. Trustworthy deployment requires predictable safety behavior, yet we find compliance is highly context-dependent: the same model (Mistral Nemo 12B) provides surveillance designs in 100% of requests but assists with trafficking in only 26.7%. This unpredictability is opaque to deployers: the technical framing bypass, where harmful requests reframed as engineering problems override safety training without any external signal that refusal thresholds have shifted. Within-domain heterogeneity reaches 84.4pp, meaning safety behavior cannot be predicted even at the domain level. A replication on five frontier closed models (GPT-4.1/5.2, Claude Haiku/Sonnet/Opus 4.x; n=4,163 responses) accessed via the GitHub Copilot CLI deployed-product surface reproduces the same domain stratification, attenuated in absolute level but identical in shape, with the two low-codification domains (science fraud, surveillance) again the most permissive. These results show that current safety mechanisms lack the transparency and consistency required for trustworthy AI deployment.