Open Problems

Model Safety, Alignment & Jailbreaks

Decision-Only and Logit-Free Safety Auditing and Alignment Evaluation for Black-Box Models

Barrier to removePartly addressed
Strong candidate · 4/5 runs17 papers report this59% from 2025+

Generated automatically from the limitations stated in 17 papers (NeurIPS, ICLR, ICML), listed under Evidence. It is not a paper, and it does not come from papers submitted to CSPaper.

The problem

Current safety auditing, jailbreak discovery, and representation-based alignment diagnostics overwhelmingly rely on white-box preconditions such as gradient access, intermediate activations, or output token logit distributions. When models are deployed behind production APIs that return only generated text, practitioners cannot run these diagnostic and red-teaming pipelines directly. Relying on surrogate transfer from open-source models produces high false-negative rates due to incomplete transferability across distinct architectures and tokenizers. Consequently, safety assessments for proprietary, API-governed models remain structurally disconnected from the methods developed in the literature.

Why it matters

Enables rigorous, standardized safety evaluations and red-teaming audits on closed-source, API-only models without requiring surrogate model assumptions or internal weight access.

Ways to approach it

Prior-work checks are free with an account. Results someone already ran are shown to everyone.

  1. 1

    Decision-based discrete optimization: Develop black-box search algorithms (e.g., adaptive token-mutation guided by text-level feedback metrics or semantic distance proxies) that evaluate model vulnerabilities using only generated text outputs. Measure attack success rate and query efficiency across closed and open LLMs compared to white-box baselines.

  2. 2

    Output-only surrogate calibration: Train query-efficient local emulator models solely from target text responses to approximate local decision boundaries, measuring whether generated safety-auditing prompts achieve parity with direct white-box gradient attacks.

  3. 3

    Multi-turn semantic feedback loops: Design automated red-teaming evaluators that iteratively probe model responses using conversational reframing without requiring probability distributions, measuring safety boundary violation rates across commercial black-box APIs.

Have a different approach?

Describe how you would tackle this problem and we'll look for papers that already do it. Free; your text stays private.

Free · 3 checks per day

Why it might fail

Purely black-box, discrete token space optimization may prove too query-intensive or get readily blocked by standard API rate limits and basic output filtering defenses. If black-box transferability from frontier open-weight models becomes universally sufficient, the need for direct black-box optimization would diminish.

Evidence

Each paper's own statement of the limitation, verbatim.

Show all 17 papers

Nearest existing work

Related open problems

Model Safety, Alignment & Jailbreaks

Barrier to removeOpen

A Framework for Deploying Activation- and Logit-Based Methods Against Closed-Source LLM APIs via Instrumented Proxy Models

A very large body of techniques — safety defenses, interpretability probes, evaluation metrics, decoding controls — requires hidden states, attention maps, gradients, or token-level probabilities, and is therefore silently restricted to open-weight models. As a result, published methods are never validated on, and cannot protect or audit, the models most people actually use (GPT-4, Claude, Gemini). This is the single most common self-reported scope limitation in the literature, yet each paper treats it as an isolated footnote rather than a solvable engineering and inference problem.

Strong candidate · 5/5 runs177 papers report this78% from 2025+

Model Safety, Alignment & Jailbreaks

Barrier to removePartly addressed

Recovering Internal Attention and Activation Signals from API-Visible Model Behavior

The shared wall is a dependence on inference-time extraction of layer-wise internal states — attention weights, hidden activations, per-layer execution — which are unavailable outside open-weight deployments and costly and per-model-fragile even where weights are open. Every technique built on those signals stops working the moment the model is served through an API; the sanctioned fallbacks, transferring from an open proxy or degrading to logit-only features, demonstrably forfeit most of the signal (one published detector drops from its white-box ceiling to 0.66 AUROC). Even with open weights, each release re-breaks the tooling: layer indices must be re-selected per model and multi-pass decoding adds latency. The result is a method family whose reach shrinks exactly as the most capable models become less open, and whose findings nobody without weight access can verify or use.

Strong candidate · 5/5 runs15 papers report this100% from 2025+

Model Safety, Alignment & Jailbreaks

Effect to explainPartly addressed

Robust Evaluation of Non-Binary and Phrasing-Agnostic Refusal in Safety-Aligned Language Models

Current safety benchmarks and verifiable reward mechanisms evaluate model refusals primarily through binary keyword matching, hand-crafted refusal templates, or uncalibrated model-based autoraters (which show inter-annotator agreement as low as $\alpha = 0.378$). This creates a blind spot where models that partially comply, use non-standard refusal vocabulary, or alter their stance under multi-turn pushback are misclassified as either fully compliant or safely refusing. Consequently, alignment interventions optimized against these brittle metrics suffer from artificial over-refusal on benign queries while leaking safety risks through stylistic variation and conversational pressure. Without a rigorous, non-binary evaluation standard across diverse phrasing distributions, researchers cannot reliably assess whether safety alignment generalizes beyond rigid heuristic templates.

Strong candidate · 4/5 runs14 papers report this71% from 2025+

Model Safety, Alignment & Jailbreaks

Barrier to removeOpen

Safety Monitoring and Alignment Interventions Under Black-Box and API-Only Constraints

Current state-of-the-art alignment monitoring, jailbreak detection, and activation-steering interventions explicitly require full white-box access to hidden state activations, KV caches, attention logits, or gradient flows. In practice, third-party safety auditors, downstream system builders, and end users interact with models exclusively via black-box query APIs or restricted endpoints. Because existing methods are structurally coupled to internal state inspection and modification, they cannot be deployed or evaluated on proprietary commercial models or in privacy-preserving environments.

Strong candidate · 5/5 runs7 papers report this100% from 2025+
Generated automatically, not curated by hand. Automated prior-work checks catch about a third of existing work, so treat this problem as a lead to investigate.