Paper deep dive
Safeguards Based on Copyable Context Cannot Provide Reliable Safety for LLMs
Pingyu Wu, Lingyao Zhu, Weiming Zhang, Nenghai Yu
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 92%
Last extracted: 8/3/2026, 3:18:53 AM
Summary
The paper proves that LLM safeguards relying on copyable context (such as request history and intent) cannot provide reliable safety for dual-use tasks because attackers can mimic legitimate users. This creates a 'safety trilemma' where Useful Capability, Reliable Safety, and Open Access cannot coexist. The authors propose using trusted credentials with hard-to-copy information to predict actual downstream use and eliminate the attacker assistance floor.
Entities (2)
Relation Signals (0)
No relation signals yet.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Large language model safeguards decide whether to answer before seeing how an answer will be used. This creates a basic problem for dual-use tasks: the same answer can help an authorized professional or an attacker, while an attacker can imitate a benign request and interaction history. We separate the capability released by the model from the evidence available about downstream use. When that evidence is copyable, we derive the exact worst-case floor on attacker assistance while preserving useful answers. The result yields a safety trilemma: Useful Capability, Reliable Safety, and Open Access cannot coexist. We then show how a trusted credential can complement existing safeguards by adding hard-to-copy information that predicts actual downstream use, and identify the stronger condition needed to eliminate the floor. Evidence from dual-use evaluations, adaptive attacks, and deployed trusted-access programs supports the practical relevance of these conditions.
Tags
Links
- Source: https://arxiv.org/abs/2607.27951v1
- Canonical: https://arxiv.org/abs/2607.27951v1
Trouble viewing inline? Open PDF directly →
Full Text
53,415 characters extracted from source content.
Expand or collapse full text
Safeguards Based on Copyable Context Cannot Provide Reliable Safety for LLMs Pingyu Wu1,2, Lingyao Zhu3, Weiming Zhang1 , Nenghai Yu1 Abstract Large language model safeguards decide whether to answer before seeing how an answer will be used. This creates a basic problem for dual-use tasks: the same answer can help an authorized professional or an attacker, while an attacker can imitate a benign request and interaction history. We separate the capability released by the model from the evidence available about downstream use. When that evidence is copyable, we derive the exact worst-case floor on attacker assistance while preserving useful answers. The result yields a safety trilemma: Useful Capability, Reliable Safety, and Open Access cannot coexist. We then show how a trusted credential can complement existing safeguards by adding hard-to-copy information that predicts actual downstream use, and identify the stronger condition needed to eliminate the floor. Evidence from dual-use evaluations, adaptive attacks, and deployed trusted-access programs supports the practical relevance of these conditions. 1 Introduction LLM safeguards based on safety training, request and response filtering, and safe-completion policies decide what to release from information available before downstream use is observed (Bai et al. 2022; Sharma et al. 2025; Yuan et al. 2025). This timing matters for dual-use tasks: the same vulnerability analysis can support an authorized assessment or an intrusion without any change in its technical content (Forge 2010; Bostrom 2011; Grinbaum and Adomaitis 2024; Kang et al. 2024). For the tasks studied here, the safety-relevant object is therefore the released answer together with its downstream application, rather than the request alone (Forge 2010; Grinbaum and Adomaitis 2024). Expressed intent and interaction history can improve routing when users reveal useful information about their goals (Uppaal et al. 2026; Ferrao et al. 2026; Zheng et al. 2026; Deng et al. 2026). These methods infer purpose from what a user says and does before release, so their observable evidence still precedes the later downstream application (Uppaal et al. 2026; Zheng et al. 2026; Deng et al. 2026). Intent concealment and adaptive attacks show how a malicious user can reshape requests and interactions after learning how a defense works (Wu et al. 2025b; Nasr et al. 2025). We therefore study attackers that can submit the same request as an authorized user, claim the same purpose, and reproduce the same answers to access questions. If the two uses look identical before release, the safeguard cannot know which request should receive a different answer. The missing information concerns actual downstream use rather than the choice of classifier. This raises a question: how much attacker assistance is unavoidable when every useful answer can also aid malicious use? Existing work identifies unsafe information leakage (Glukhov et al. 2024), computational barriers to prompt and output filtering (Ball et al. 2025), and constraints faced by utility-preserving defense wrappers (Bhatt et al. 2026). These results expose different safety obstructions but do not give the exact assistance floor created by hidden downstream use and reproducible evidence. The question becomes more important as models complete longer and more operational tasks (Kwa et al. 2025; Wijk et al. 2024; OpenAI 2025). We answer it by separating released capability from evidence about downstream use. The paper makes three contributions: • Why Safeguards Keep Failing. We identify a common weakness behind intent checks, filters, and interactive defenses: before an answer is used, attackers can present the same evidence as legitimate users. • Useful, Safe, Open: Pick Two. We prove exactly how much help must still reach attackers, even when safeguards ask additional questions, vary their decisions, or combine evidence across repeated attempts. • What Reliable Safety Requires. We show what must change: reliable safety requires evidence attackers cannot copy and that is tied to actual use, not better guesses from prompts or conversations. Figure 1: Illustrative capability allocation with copyable evidence and trusted credentials. A trusted credential can improve capability allocation by adding noncopyable information that predicts downstream use. 2 Related Work Dual use and capability control. Dual-use and information-hazard scholarship distinguishes an artifact’s capability from the purposes to which it is put (Forge 2010; Bostrom 2011; Grinbaum and Adomaitis 2024). Unlearning, filtering, and modular training change which capabilities remain available (Li et al. 2024; O’Brien et al. 2025; Roland et al. 2026). We instead characterize the minimum attacker assistance that necessarily remains at a fixed legitimate-use target. Safety, utility, and impossibility. Glukhov et al. (2024) study leakage from composing individually permissible answers; Ball et al. (2025) prove computational barriers to filtering; Bhatt et al. (2026) constrain continuous, utility-preserving defense wrappers. Our result places no continuity or computational restriction on the release rule. Under copyable evidence, arbitrary interactive safeguards reduce exactly to a static release-menu frontier. We quantify imperfect copying, trusted evidence, and correlated sessions relative to this frontier. Intent and trusted credentials. Intent-aware evaluation and clarification study how expressed purpose can improve average routing (Uppaal et al. 2026; Ferrao et al. 2026; Zheng et al. 2026; Deng et al. 2026). Access-control work introduces verified information about users or authorization (Wybitul 2025; Kembery et al. 2024; Adler et al. 2024; Shih et al. 2025). We connect these regimes by asking exactly when observable access evidence has value against a strategic user. 3 Main Result Our analysis separates capability allocation from evidence quality. For a fixed task context, the available releases and their two downstream utilities determine a capability floor Γ(q) (q) at legitimate-use target q. The evidence channel determines whether a safeguard can assign different release distributions to legitimate and malicious uses and move below that floor. Finite spaces make both parts explicit. For a finite set X, let Δ() (X) denote its probability simplex. A randomized decision rule from X to Y is a Markov kernel. We write TV(P,Q)=12∑x|P(x)−Q(x)|TV(P,Q)= 12 _x|P(x)-Q(x)|. For every function f:→[0,1]f:X→[0,1], |P[f]−Q[f]|≤TV(P,Q). |E_P[f]-E_Q[f] | (P,Q). (1) All approximate results below use this total-variation inequality to measure copying error and credential separation. 3.1 Counterfactual Use and Access Evidence Fix one observed public task context W=wW=w, containing the complete task and the identity, role, and downstream use claimed in the request. The release rule uses W to determine the task-specific release menu, but a claimed use is not evidence of actual downstream use. Let ℳwM_w be the nonempty set of malicious downstream uses in the threat model. For this context, =wA=A_w is the finite release menu: the terminal outputs distinguished by the deployment’s utility resolution, including a refusal a0a_0. We compare the same release under two counterfactual downstream-use worlds. In world BB, the identity, task, and use stated in w are genuine and legitimate, and the release is used only for that task. In world MM, a human chooses an allowed malicious use after receiving the release. The functions uB,w:→[0,1]u_B,w:A→[0,1] and vM,w,m:→[0,1]v_M,w,m:A→[0,1] evaluate the direct instrumental value of the same release in the legitimate use and in a malicious use m, respectively. Because a downstream user can choose how to exploit an answer after observing it, define uM,w(a)=supm∈ℳwvM,w,m(a).u_M,w(a)= _m _wv_M,w,m(a). In the vulnerability-analysis example, BB evaluates the answer inside the authorized assessment and MM evaluates the most useful allowed misuse of the byte-identical answer. These utilities measure assistance available at release, not the probability or severity of realized downstream harm. We suppress w in local results. After w is fixed, H=(X1,Y1,…,XT,YT)H=(X_1,Y_1,…,X_T,Y_T) records dialogue observed before release in an access-verification exchange. At turn t, a user strategy draws XtX_t, and the committed policy κt _t returns a verification response YtY_t. If the exchange continues, the user’s reply to YtY_t becomes part of Xt+1X_t+1; neither variable records how the terminal release is ultimately used. Task-serving clarification that changes the task, menu, or utilities is absorbed into W. The exchange culminates in one terminal release A∼g(⋅∣h)A g(· h). Let ℋH denote the finite transcript space. Useful partial releases are covered by the multi-release causal process below. If btb_t is the legitimate-reference user kernel and mtσm_t^σ is the kernel chosen by malicious strategy σ, the access laws factor as PBκ(h) P_B^κ(h) =∏t=1Tbt(xt∣w,ht−1)κt(yt∣w,ht−1,xt), = _t=1^Tb_t(x_t w,h_t-1) _t(y_t w,h_t-1,x_t), (2) PM,σκ(h) P_M,σ^κ(h) =∏t=1Tmtσ(xt∣w,ht−1)κt(yt∣w,ht−1,xt). = _t=1^Tm_t^σ(x_t w,h_t-1) _t(y_t w,h_t-1,x_t). The joint observational law is Pzκ,g(h,a)=Pzκ(h)g(a∣h)P_z^κ,g(h,a)=P_z^κ(h)g(a h), with the strategy index included for z=Mz=M. The kernel g represents the model and every safeguard that affects the terminal release. For any transcript law P, Uz(P,g)=∑h,aP(h)g(a∣h)uz(a),z∈B,M.U_z(P,g)= _h,aP(h)g(a h)u_z(a), z∈\B,M\. (3) The legitimate-use target q requires UB(PBκ,g)≥qU_B(P_B^κ,g)≥ q, the expected legitimate-use utility for this task and reference process. Optimizing first over all finite Markov kernels g isolates the strongest allocation guarantee available from the modeled observations. The implementation boundary below then identifies what restricted mechanisms inherit. 3.2 Minimum Attacker Assistance We first solve the capability-allocation problem when both downstream processes receive the same output distribution. The next two subsections show why copyable evidence forces this baseline in the worst case. Continue to condition on one public context w, assume a refusal a0a_0 has zero utility for both purposes, and let qmax=maxauB(a)q_ = _au_B(a). The minimum attacker assistance is Γ(q)=minμ∈Δ()∑aμ(a)uB(a)≥q∑aμ(a)uM(a),0≤q≤qmax. (q)= _ subarraycμ∈ (A)\\ _aμ(a)u_B(a)≥ q subarray _aμ(a)u_M(a), 0≤ q≤ q_ . (4) It is the minimum attacker assistance compatible with legitimate-use utility q. If both utilities happen to be equal for every release, then Γ(q)=q (q)=q. Equality is not required for the results below. For finite A, randomized outputs realize every point in the polytope =conv(uB(a),uM(a)):a∈V=conv\(u_B(a),u_M(a)):a \, so Γ(q)=miny:(x,y)∈,x≥q (q)= \y:(x,y) ,\ x≥ q\ is attained, nondecreasing, convex, and piecewise linear. Removing actions cannot enlarge V and weakly raises the minimum at the same feasible q. Example. For the running vulnerability-analysis context, the menu includes refusal, mitigation-only advice naming no exploitable path, a root-cause analysis that explains the defect without a working chain, and a complete exploit chain. The last carries nearly all of the assessor’s value and nearly all of the intruder’s, so it sits near the diagonal. The intermediate releases retain assessment value while advancing intrusion considerably less, placing V below the diagonal. Whether such actions exist is a property of the released capability and not of the access rule. Adding an output below the current tradeoff can lower Γ(q) (q); reweighting the existing menu is already included in the minimization that defines Γ(q) (q). Dual-use condition. We study tasks satisfying the following condition: uB(a)>0⟹uM(a)>0for every a∈.u_B(a)>0 u_M(a)>0 every a . (5) This says that every release with legitimate value has at least one malicious downstream use. It does not require equal value in the two uses. This condition defines the dual-use task class studied here; tasks with uB=uMu_B=u_M form a nonempty subclass. For a task with qmax>0q_ >0, finiteness of A allows us to define ρ=mina:uB(a)>0uM(a)uB(a)>0.ρ= _a:u_B(a)>0 u_M(a)u_B(a)>0. Then uM(a)≥ρuB(a)u_M(a)≥ρ u_B(a) for every release, and every distribution feasible for Equation (4) satisfies μ[uM]≥ρμ[uB]≥ρq.E_μ[u_M]≥ _μ[u_B]≥ρ q. Therefore Γ(q)≥ρq>0for every feasible q>0. (q)≥ρ q>0 every feasible q>0. (6) Thus a shared output distribution cannot provide positive legitimate value with zero attacker assistance. Finiteness establishes positivity, not a deployment-scale margin: a quantitative ceiling β>0β>0 is impossible only when β<Γ(q)β< (q) at the chosen utility resolution. 3.3 Copyable Evidence Public context W, access evidence H, and public randomness may be used by classifiers, filters, and interactive checks. The relevant question is whether the attacker can reproduce the resulting evidence distribution. Section 3.5 instead introduces a trusted signal S that predicts downstream use and cannot be freely reproduced; a trusted credential supplies this signal. For local targets q∈[0,qmax]q∈[0,q_ ] and an assistance ceiling β∈[0,1]β∈[0,1], the three deployment objectives are: preserve expected legitimate-use utility at least q, keep worst-case attacker assistance at most β, and maintain open access, meaning that release requires no trusted credential and uses only copyable evidence. We call the worst-case ceiling β a reliable safety guarantee because it is evaluated against actual downstream use; zero assistance is the special case β=0β=0. Formally, let ΣM _M denote the admissible malicious strategy class. The defender commits to (κ,g)(κ,g), the attacker observes this commitment, and then chooses σ∈ΣMσ∈ _M. Strategy σ induces PM,σκP_M,σ^κ. Randomized and limiting attacks form κ=co¯PM,σκ:σ∈ΣM.C_κ= co\P_M,σ^κ:σ∈ _M\. (7) The following observation gives a sufficient condition for copyability. Proposition 1 (Copying the legitimate strategy). Fix an access policy κ. If the malicious strategy class contains a strategy σcopy _copy whose user kernels equal the legitimate reference kernels at every reachable history, then PM,σcopyκ=PBκand hencePBκ∈κ.P_M, _copy^κ=P_B^κ hence P_B^κ _κ. (8) Proof. Substituting the same user kernels into Equation (2) gives identical probabilities for every transcript. Membership in κC_κ follows immediately. ∎ The proposition covers any number of adaptive questions and any public randomization by the safeguard. Interaction can reveal a difference only when the malicious process cannot implement the legitimate user’s response strategy, or when the exchange uses evidence that is not copyable. We say that the evidence is copyable under policy κ when PBκ∈κ.P_B^κ _κ. (9) This includes exact copying and arbitrary approximation through randomized and limiting strategies. A trusted credential creates noncopyable evidence when its predictive distribution differs across downstream uses and the attacker cannot reproduce it. The results below cover exact and approximate copying; Section 4 assesses the corresponding empirical premises. For the fixed context w, define κ(q) _κ(q) =g:UB(PBκ,g)≥q, =\g:U_B(P_B^κ,g)≥ q\, Rκ(q) R_κ(q) =infg∈κ(q)supQ∈κUM(Q,g), = _g _κ(q) _Q _κU_M(Q,g), and RT⋆(q)=infκRκ(q)R_T (q)= _κR_κ(q). The attacker may adapt to both committed components. The strategy class generates its transcript laws under κ before the terminal kernel g acts, so κC_κ is indexed by the access policy. Assigning task utility to the terminal release makes both application utilities functions of A. 3.4 Worst-Case Value of Copyable Evidence Theorem 1 (Exact interactive-to-static reduction under copyable evidence). For finite ℋ,H,A, if PBκ∈κP_B^κ _κ, then Rκ(q)=Γ(q)for every feasible q.R_κ(q)= (q) every feasible q. (10) If the evidence is copyable for every κ, then RT⋆(q)=Γ(q)R_T (q)= (q). Proof. For any feasible g, copyability makes the reference transcript law admissible in the closed attacker class. Its marginal release distribution μg(a)=∑hPBκ(h)g(a∣h) _g(a)= _hP_B^κ(h)g(a h) has legitimate-use utility at least q, so its attacker assistance is at least Γ(q) (q). Conversely, a transcript-independent optimizer of Equation (4) has attacker assistance Γ(q) (q) under every transcript law. ∎ Corollary 1 (LLM safety impossibility trilemma). Suppose the dual-use condition holds, fix a feasible q∈(0,qmax]q∈(0,q_ ] and an assistance ceiling β<Γ(q)β< (q), and suppose every permitted access-verification policy κ uses copyable evidence: PBκ∈κP_B^κ _κ. Then no release mechanism (κ,g)(κ,g) can jointly satisfy 1. useful released capability, represented by legitimate-use utility at least q, 2. reliable safety, represented by worst-case attacker assistance at most β, and 3. open access, which requires no trusted credential and uses only copyable evidence. In particular, Equation (6) makes zero assistance such a ceiling for every feasible q>0q>0. Proof. The incompatibility follows from Theorem 1. Useful capability and open access are attained by a transcript-independent frontier optimizer; reliable safety and open access by constant refusal; useful capability and reliable safety by a trusted credential with disjoint legitimate and malicious supports. ∎ Corollary 2 (Implementation boundary). For an implementation-restricted class impl G_impl, define Rκ,impl(q)R_κ,impl(q) by replacing the feasible benchmark rules in Rκ(q)R_κ(q) with feasible rules in impl G_impl. The copied-law argument never optimizes over g, so it applies verbatim and gives Rκ,impl(q)≥Γ(q),R_κ,impl(q)≥ (q), (11) with equality whenever impl G_impl contains a transcript-independent optimizer of Equation (4). For restricted implementations, Γ(q) (q) remains the universal floor; any strict gap above it is implementation loss. Only the matching upper-bound construction in Theorem 1 uses the unrestricted-kernel benchmark. Imperfect copying. The bound changes continuously when copying is imperfect. Let δκ=infQ∈κTV(PBκ,Q) _κ= _Q _κTV(P_B^κ,Q). Imperfect copying changes the exact result by at most this distance: [Γ(q)−δκ]+≤Rκ(q)≤Γ(q).[ (q)- _κ]_+≤ R_κ(q)≤ (q). (12) Applying Equation (1) to h↦∑ag(a∣h)uM(a)h _ag(a h)u_M(a) at a law within δκ+ϵ _κ+ε of PBκP_B^κ and letting ϵ↓0ε 0 gives the lower bound; the transcript-independent optimizer gives the upper bound. Thus δκ _κ is the operational distance from exact copying discussed in Section 4. 3.5 Trusted Credentials and Downstream Use The preceding result identifies the missing object: information whose distribution differs across actual downstream uses and that the attacker cannot reproduce. This information augments rather than replaces the existing safeguard. The fixed context W defines the requested task and release menu, the access history H records observable interaction, and the joint release rule below uses both H and the additional signal. The actual downstream application determines whether the release belongs to the legitimate or malicious use process. Neither the claimed intent nor a credential defines that label. Continue to condition on W=wW=w, and let S be a finite-valued trusted signal with value space S, checked at release. A deployment mechanism that supplies S is a trusted credential when the attacker cannot freely acquire or reproduce the signal and its distribution predicts actual downstream use. The signal may encode verified authorization, role, continuity, or execution-environment state. Let Z∈B,MZ∈\B,M\ index which specified actual downstream-use process receives the release. Let PBSP_B^S and PMSP_M^S be the signal marginals induced by the two values of Z, and define d=TV(PBS,PMS)d=TV(P_B^S,P_M^S). Under equal priors on the two processes, the best binary predictor using S alone has balanced accuracy Acc⋆(S)=1+d2,Acc (S)= 1+d2, (13) the standard equal-prior testing identity (Tsybakov 2009). If p=Acc⋆(S)p=Acc (S) denotes this optimal balanced accuracy, then d=2p−1d=2p-1. Here d measures equal-prior separation rather than accuracy under the deployment prevalence. In the copyable-evidence comparison, d measures how well S distinguishes downstream use at release. More generally, the incremental value of S relative to H depends on the joint law of (H,S)(H,S). A signal with d=0d=0 has no predictive value. Acquisition, transfer, compromise, account creation, and misuse by authorized holders determine the malicious signal law PMSP_M^S and hence its prediction value. Given κ, let KBκ(h∣s)K_B^κ(h s) be the legitimate reference access kernel and define PBH,S,κ(s,h)=PBS(s)KBκ(h∣s).P_B^H,S,κ(s,h)=P_B^S(s)K_B^κ(h s). (14) For each malicious strategy σ, let PM,σH,S,κP_M,σ^H,S,κ be its induced joint law on (S,H)(S,H), and set κH,S=co¯PM,σH,S,κ:σ∈ΣM,(PM,σH,S,κ)S=PMS.C_κ^H,S= co\P_M,σ^H,S,κ:σ∈ _M,\ (P_M,σ^H,S,κ)^S=P_M^S\. (15) Every law in κH,SC_κ^H,S has the fixed marginal PMSP_M^S. Define the conditional-copy law Qcopyκ(s,h)=PMS(s)KBκ(h∣s)Q_copy^κ(s,h)=P_M^S(s)K_B^κ(h s). Fix any version of KBκ(⋅∣s)K_B^κ(· s) outside the support of PBSP_B^S; this makes the copied law defined on the support of PMSP_M^S without affecting legitimate-use utility. Conditional copying asks whether legitimate access behavior can be reproduced after fixing S=sS=s. For a joint law P on (S,H)(S,H) and a joint release rule g, extend Equation (3) by Uz(P,g)=∑s,h,aP(s,h)g(a∣s,h)uz(a)U_z(P,g)= _s,h,aP(s,h)g(a s,h)u_z(a); for an S-conditioned rule r:→Δ()r:S→ (A), write Uz(PS,r)=∑s,aPS(s)r(a∣s)uz(a)U_z(P^S,r)= _s,aP^S(s)r(a s)u_z(a). Using the same unrestricted class of release kernels on (S,H)(S,H), define RκH,S(q) R_κ^H,S(q) =infg:UB(PBH,S,κ,g)≥qsupQ∈κH,SUM(Q,g), = _ subarraycg:U_B(P_B^H,S,κ,g)≥ q subarray _Q _κ^H,SU_M(Q,g), (16) ΓS(q) _S(q) =infr:→Δ()UB(PBS,r)≥qUM(PMS,r). = _ subarraycr:S→ (A)\\ U_B(P_B^S,r)≥ q subarrayU_M(P_M^S,r). (17) Thus ΓS _S is the minimum assistance attainable by conditioning the release allocation on S after W fixes the task and release menu. The next theorem asks whether H adds any worst-case information beyond this trusted signal. Theorem 2 (Trusted-signal reduction). If Qcopyκ∈κH,SQ_copy^κ _κ^H,S, then RκH,S(q)=ΓS(q)for every feasible q.R_κ^H,S(q)= _S(q) every feasible q. (18) If the premise holds for every κ, the equality above holds for every access-verification policy, so optimizing over κ does not change the minimum. Proof. For feasible g, average over the reference kernel: rg(a∣s) r_g(a s) =∑hKBκ(h∣s)g(a∣s,h), = _hK_B^κ(h s)g(a s,h), UB(PBH,S,κ,g) U_B(P_B^H,S,κ,g) =UB(PBS,rg)≥q, =U_B(P_B^S,r_g)≥ q, UM(Qcopyκ,g) U_M(Q_copy^κ,g) =UM(PMS,rg)≥ΓS(q). =U_M(P_M^S,r_g)≥ _S(q). Admissibility of the copied law proves the lower bound. Conversely, let r⋆r attain ΓS(q) _S(q) and set g⋆(a∣s,h)=r⋆(a∣s)g (a s,h)=r (a s). Every admissible malicious law has marginal PMSP_M^S, so this feasible rule attains ΓS(q) _S(q). ∎ Corollary 3 (When zero assistance is attainable). Assume the dual-use condition in Equation (5), and define 0=s∈:PMS(s)=0.S_0=\s :P_M^S(s)=0\. (19) For every q∈[0,qmax]q∈[0,q_ ], ΓS(q)=0⟺q≤qmaxPBS(0). _S(q)=0 q≤ q_ P_B^S(S_0). (20) Under the conditional-copying premise of Theorem 2, the same condition is equivalent to RκH,S(q)=0R_κ^H,S(q)=0. Proof. If a rule has zero attacker assistance, then for every s with PMS(s)>0P_M^S(s)>0, it can assign positive probability only to releases with uM(a)=0u_M(a)=0. The dual-use condition gives uB(a)=0u_B(a)=0 for those releases. Legitimate utility can therefore arise only on 0S_0, where it is at most qmaxPBS(0)q_ P_B^S(S_0). Conversely, choose a release attaining qmaxq_ , use it on 0S_0, and refuse elsewhere. This rule has zero attacker assistance and reaches the upper endpoint; randomizing with refusal reaches every smaller q. ∎ Under conditional copying, access history is a randomized post-processing of S in the Blackwell sense (Blackwell and Girshick 1954); the lower bound also applies to restricted rules. Because PMSP_M^S changes across the stated acquisition and misuse scenarios, this minimum is conditional on the malicious signal distribution. A robust evaluation therefore holds one rule fixed against their union. For approximate copying, let ηκ=infQ∈κH,STV(Q,Qcopyκ) _κ= _Q _κ^H,STV(Q,Q_copy^κ). Here S collects the noncopyable information used to predict downstream use. Any systematic predictive component of H that the attacker cannot copy belongs in S; ηκ _κ measures residual approximation error for the remaining access history. Theorem 3 (Necessary condition with imperfect copying). For every feasible q, [ΓS(q)−ηκ]+≤RκH,S(q)≤ΓS(q),[ _S(q)- _κ]_+≤ R_κ^H,S(q)≤ _S(q), (21) and RκH,S(q)≥[Γ(q)−d−ηκ]+R_κ^H,S(q)≥[ (q)-d- _κ]_+. Therefore, if a q-feasible rule guarantees worst-case attacker assistance at most β, then β+d+ηκ≥Γ(q). β+d+ _κ≥ (q). (22) Proof. For feasible g, choose admissible QϵQ_ε within ηκ+ϵ _κ+ε of QcopyκQ_copy^κ. Equation (1) and the averaged rule rgr_g from the preceding proof give UM(Qϵ,g)≥UM(PMS,rg)−ηκ−ϵ≥ΓS(q)−ηκ−ϵU_M(Q_ε,g)≥ U_M(P_M^S,r_g)- _κ-ε≥ _S(q)- _κ-ε. Taking the supremum, infimum, and limit proves the first lower bound. The preceding S-conditioned optimizer gives the upper bound. For any feasible r, its release marginals μz(a)=∑sPzS(s)r(a∣s) _z(a)= _sP_z^S(s)r(a s) satisfy TV(μB,μM)≤dTV( _B, _M)≤ d by data processing. Since μB _B is feasible for Γ(q) (q), bounded utility gives ΓS(q)≥[Γ(q)−d]+ _S(q)≥[ (q)-d]_+, and combining bounds proves the second. ∎ Equation (22) gives a necessary condition whose three terms can be reported separately. By Equation (13), a program aiming at β needs a trusted signal whose optimal balanced accuracy for predicting downstream use satisfies p≥(1+Γ(q)−β−ηκ)/2p≥(1+ (q)-β- _κ)/2. With no credential, a constant S recovers Equation (12) with d=0d=0 and ηκ=δκ _κ= _κ. This accuracy threshold is necessary, not sufficient. For β=0β=0, Corollary 3 gives the exact additional support condition: enough legitimate utility must lie on signal values that the malicious process cannot attain. 3.6 Robustness and Scope Extensions The following results preserve the same capability and evidence decomposition across task families, per-turn copying error, and repeated access. Task families. For a finite family 0W_0, let each w have its own malicious application set, utility uM,wu_M,w, and minimum Γw _w. Given fixed weights ν and local targets =(qw)wq=(q_w)_w, copyable evidence within every context gives the weighted lower bound Γ¯ν()=∑w∈0ν(w)Γw(qw) _ν(q)= _w _0ν(w) _w(q_w) by the same copied-law proof. Local constant optimizers attain this bound in the unrestricted-kernel benchmark. Local targets preserve the meaning of capability for each w. Attacker-selected contexts enter the attacker optimization in place of the fixed average. Per-turn approximation. If the legitimate-reference and malicious next-message kernels differ by at most ϵt _t in total variation at turn t, uniformly over coupled reachable histories, maximal coupling gives TV(PBκ,PM,σκ)≤min1,∑tϵtTV(P_B^κ,P_M,σ^κ)≤ \1, _t _t\, which upper-bounds δκ _κ in the copyable-evidence model. Retries and task decomposition. Retries and task decomposition split one objective across many sessions, so the complete access process is the relevant unit. Allowing arbitrary causal state and correlated randomness, we study additive assistance, for which the local minimum values yield an exact process-level value. Across N sessions, let session i have observed public context wiw_i, local menu wiA_w_i, utilities uB,i=uB,wiu_B,i=u_B,w_i and uM,i=uM,wiu_M,i=u_M,w_i, target qiq_i, and minimum Γi _i formed from these two utilities on wiA_w_i. A causal policy may condition on all previous transcripts and releases and use correlated randomness. For a committed policy π, write ℙBπP_B^π for the legitimate-reference law of the complete process N=(H1,A1,…,HN,AN)O_N=(H_1,A_1,…,H_N,A_N), and let NπC_N^π be the closed convex set of complete-process laws induced by admissible malicious strategies. Define RNsum()=infπ:ℙBπ[uB,i(Ai)]≥qifor every isupQ∈NπQ[∑i=1NuM,i(Ai)],R_N^sum(q)= _ subarraycπ:\ E_P_B^π[u_B,i(A_i)]≥ q_i\\ for every i subarray _Q _N^πE_Q\! [ _i=1^Nu_M,i(A_i) ], (23) using the same unrestricted-kernel benchmark convention as the main result. Proposition 2 (Exact additive composition under correlated access). If ℙBπ∈NπP_B^π _N^π for every committed feasible policy π, including through arbitrary approximation in the closed class, then RNsum()=∑i=1NΓi(qi)R_N^sum(q)= _i=1^N _i(q_i). No independence assumption is required. Proof. Fix any feasible causal policy π. Under the copied complete-process law ℙBπP_B^π, the marginal μiπ _i^π of AiA_i satisfies ∑aμiπ(a)uB,i(a)≥qi _a _i^π(a)u_B,i(a)≥ q_i. It is therefore feasible for Γi(qi) _i(q_i), so ∑aμiπ(a)uM,i(a)≥Γi(qi) _a _i^π(a)u_M,i(a)≥ _i(q_i). Linearity of expectation gives assistance at least ∑iΓi(qi) _i _i(q_i) under the copied law, which lies in NπC_N^π. Conversely, drawing Ai∼μi⋆A_i _i from an optimizer of each Γi(qi) _i(q_i) while ignoring all transcripts meets every target and has iith release marginal μi⋆ _i under every complete-process law, giving exactly that sum. ∎ Thus the exact floor adds across correlated sessions, and task decomposition cannot reduce it. Only noncopyable history predictive of downstream use can move the floor. Binary objectives. Additive assistance is one aggregation rule; an attacker who needs a single success faces a different aggregation objective. If every fresh attempt succeeds with conditional probability at least r given no earlier success, cumulative success probability is at least 1−(1−r)N1-(1-r)^N. Each per-response quantity therefore pairs with an access budget and a composition rule. Predictive cumulative history can enter S as part of the trusted signal. 3.7 Design Implications Equation (22) shows what an intervention must change. Changing the available outputs can lower Γ(q) (q). As long as the changed menu still satisfies the dual-use condition, however, it cannot make Γ(q) (q) zero while preserving a feasible q>0q>0. With copyable evidence, refusal can reach zero assistance only by reducing legitimate-use utility to zero. A trusted credential adds predictive information unavailable in copyable evidence while W and H continue to support task and capability decisions. Its value depends on the induced malicious signal distribution across the stated acquisition and misuse scenarios. At a fixed released capability, reducing assistance below Γ(q) (q) requires noncopyable evidence that predicts downstream use. Prediction advantage alone is insufficient for zero assistance: Corollary 3 requires enough legitimate utility on signal values the malicious process cannot attain. In the language of the trilemma, preserving useful released capability with zero-assistance safety requires adding a trusted credential to the existing safeguard. It therefore gives up access based only on copyable evidence. 4 Empirical Evidence We assess how the conditions of the theory arise in LLM practice: dual-use outputs, copyable evidence, capability loss under blocking, and the use of trusted credentials in deployed access programs. 4.1 Dual Use in LLM Outputs Equation (5) motivates the empirical question: whether useful LLM releases also have malicious downstream uses. Existing LLM evaluations provide evidence that such tasks exist. Internal Safety Collapse constructs legitimate professional tasks whose correct completion requires a reusable harmful artifact and observes the corresponding failure mode across frontier models (Wu et al. 2026). OpenSafeIntent holds the underlying task fixed while varying benign, dual-use, and malicious intent, and finds that model assistance varies across matched and paraphrased variants (Uppaal et al. 2026). Together, they identify candidate dual-use task families even without overtly malicious requests. Establishing the action-level dual-use condition and measuring ρ require evaluating each family’s attainable release menu. 4.2 Attackers Can Reproduce Legitimate Evidence Evidence is copyable when the specified attacker class can reproduce the legitimate reference law. Concealment of Intent hides malicious objectives through skill composition and bypasses prompt and response filters (Wu et al. 2025b); multi-turn attacks construct innocuous-looking trajectories through escalation, decomposition, or complementary requests (Russinovich et al. 2025; Jiang et al. 2025; Weng et al. 2025). The Attacker Moves Second optimizes only after observing the defense and reports success above 90% against most of twelve recent defenses (Nasr et al. 2025). Documented cyber misuse combined task decomposition with a false claim of acting for a legitimate security organization (Anthropic 2025), making a purpose declaration copyable evidence rather than evidence about downstream use. Evidence from defense evaluations is consistent with the same weakness. Malicious-input detectors can rely on instructional patterns and trigger words (Wang et al. 2025a), while outcome-aware evaluations find reliance on surface semantic and stylistic cues (Wu et al. 2025a). Some interactive checks are reproducible: automated solvers already pass deployed CAPTCHAs at human-comparable rates (Searles et al. 2023; Plesner et al. 2024). Together these observations make evidence copying a realistic threat for software-capable attackers facing text and interaction evidence. Deployment claims nevertheless require policy-specific estimates of δκ _κ against the stated attacker class: Equation (12) keeps the worst-case value near Γ(q) (q) only when this distance is small. 4.3 Capability Reduction and Utility Loss When the evidence is copyable, Theorem 1 shows that blocking cannot guarantee assistance below Γ(q) (q) at a fixed legitimate-use target. A particular implementation may still reduce excess assistance above this minimum. Consistent with the underlying safety–utility conflict, guardrail evaluations find that security cannot be assessed independently of benign utility (Kumar et al. 2025; Wang et al. 2025b). XSTest and OR-Bench document broad over-refusal on safe prompts sharing surface features with unsafe requests (Röttger et al. 2024; Cui et al. 2025). In cybersecurity, Defensive Refusal Bias finds elevated refusal on authorized defensive tasks (Campbell et al. 2026), and same-lineage comparisons report lost vulnerability-analysis utility in aligned models relative to refusal-ablated counterparts (Li et al. 2026). CarryOnBench finds that benign users recover withheld utility only through clarification, with utility lock-in and unsafe recovery (Zheng et al. 2026). For tasks exhibiting Internal Safety Collapse, SafeRedirect obtains much of its mitigation by permitting task failure and unresolved placeholders (Pan et al. 2026). Across distinct mechanisms, these studies exhibit the predicted empirical signature: capability reduction changes what the model releases without predicting downstream use. Under the copyability premise, this pattern is consistent with lowering excess assistance while leaving the theoretical floor in place. 4.4 Trusted Credentials in Deployed Access Programs Trusted credentials must encode information that predicts downstream use and that a software-only attacker cannot freely reproduce. Hardware-rooted attestation and unforgeable tokens can supply verified platform state and prior authorization events (Parno et al. 2010; Coker et al. 2011; Davidson et al. 2018). Documented cyber programs condition access on identity and trust verification, account security, and verified roles (OpenAI 2026a, b); a verification program for security researchers has also been described (Anthropic 2026). These programs add verification while retaining content safeguards and misuse controls, matching the joint role of W,H,SW,H,S. They instantiate noncopyable signals such as verified roles, platform state, and persistent history. A deployment-specific worst-case claim must estimate d and ηκ _κ under credential transfer, compromise, account creation, and misuse by authorized holders; zero assistance additionally requires the support condition in Corollary 3. Theorem 3 governs how these terms move the worst-case floor, while Equation (22) states the necessary condition with terms that can be reported separately. 5 Limitations The characterization assumes a fixed utility calibration, finite operational resolution, and a specified attacker class. Deployment-specific claims additionally require a policy-specific copying-error estimate. These choices determine the bound and whether its premise applies; when the copied-law premise holds, the reduction is exact. Throughout this paper, open access means credential-free access to a committed inference-time mechanism, rather than access to released model weights. Settings in which users obtain the weights and deploy or modify the model under their own control change the mechanism or release menu and fall outside the access-evidence model. 6 Conclusion An LLM safeguard decides before observing actual downstream use. For dual-use tasks with copyable request and interaction evidence, any release rule preserving legitimate utility leaves worst-case attacker assistance at least Γ(q)>0 (q)>0. Changing the output menu can lower this capability floor; moving below it requires adding a trusted credential whose noncopyable evidence predicts downstream use. References S. Adler, Z. Hitzig, S. Jain, C. Brewer, W. Chang, et al. (2024) Personhood credentials: artificial intelligence and the value of privacy-preserving tools to distinguish who is real online. arXiv preprint arXiv:2408.07892. External Links: Link Cited by: §2. Anthropic (2025) Disrupting the first reported AI-orchestrated cyber espionage campaign. Note: https://w.anthropic.com/news/disrupting-AI-espionagePublished November 13, 2025 Cited by: §4.2. Anthropic (2026) Introducing claude opus 4.7. Note: https://w.anthropic.com/news/claude-opus-4-7Accessed 2026-07-19 Cited by: §4.4. Y. Bai, S. Kadavath, S. Kundu, A. Askell, et al. (2022) Constitutional AI: harmlessness from AI feedback. arXiv preprint arXiv:2212.08073. Cited by: §1. S. Ball, G. Głuch, S. Goldwasser, F. Kreuter, O. Reingold, and G. N. Rothblum (2025) On the impossibility of separating intelligence from judgment: the computational intractability of filtering for AI alignment. arXiv preprint arXiv:2507.07341. Cited by: §1, §2. M. Bhatt, S. Munshi, V. S. Narajala, I. Habler, A. Al-Kahfah, K. Huang, J. Webb, B. Gatto, and M. T. Hoque (2026) The defense trilemma: why prompt injection defense wrappers fail?. arXiv preprint arXiv:2604.06436. External Links: Link Cited by: §1, §2. D. Blackwell and M. A. Girshick (1954) Theory of games and statistical decisions. John Wiley & Sons, New York. Cited by: §3.5. N. Bostrom (2011) Information hazards: a typology of potential harms from knowledge. Review of Contemporary Philosophy 10, p. 44–79. External Links: Link Cited by: §1, §2. D. Campbell, N. Kale, U. M. Sehwag, B. Herring, N. Price, D. Borges, A. Levinson, and C. Q. Knight (2026) Defensive refusal bias: how safety alignment fails cyber defenders. arXiv preprint arXiv:2603.01246. External Links: Link Cited by: §4.3. G. Coker, J. Guttman, P. Loscocco, A. Herzog, J. Millen, B. O’Hanlon, J. Ramsdell, A. Segall, J. Sheehy, and B. Sniffen (2011) Principles of remote attestation. International Journal of Information Security 10 (2), p. 63–81. Cited by: §4.4. J. Cui, W. Chiang, I. Stoica, and C. Hsieh (2025) OR-bench: an over-refusal benchmark for large language models. In Proceedings of the 42nd International Conference on Machine Learning, Proceedings of Machine Learning Research, Vol. 267, p. 11515–11542. External Links: Link Cited by: §4.3. A. Davidson, I. Goldberg, N. Sullivan, G. Tankersley, and F. Valsorda (2018) Privacy pass: bypassing internet challenges anonymously. Proceedings on Privacy Enhancing Technologies 2018 (3), p. 164–180. Cited by: §4.4. M. Deng, Z. Li, X. Li, T. Zhu, Y. Zhao, Z. Guo, and W. Wang (2026) Uncertainty-aware clarification in LLM agents with information gain. arXiv preprint arXiv:2606.03135. Cited by: §1, §2. J. Ferrao, N. Müller-Hof, I. Sîrbu, T. Rebedea, and Y. Ziser (2026) Paved with true intents: intent-aware training improves LLM safety classification across training regimes. arXiv preprint arXiv:2606.27210. Cited by: §1, §2. J. Forge (2010) A note on the definition of “dual use”. Science and Engineering Ethics 16 (1), p. 111–118. External Links: Document Cited by: §1, §2. D. Glukhov, Z. Han, I. Shumailov, V. Papyan, and N. Papernot (2024) Breach by a thousand leaks: unsafe information leakage in “safe” AI responses. arXiv preprint arXiv:2407.02551. Cited by: §1, §2. A. Grinbaum and L. Adomaitis (2024) Dual use concerns of generative AI and large language models. Journal of Responsible Innovation 11 (1), p. 2304381. External Links: Document Cited by: §1, §2. Y. Jiang, K. Aggarwal, T. Laud, K. Munir, J. Pujara, and S. Mukherjee (2025) Red queen: exposing latent multi-turn risks in large language models. In Findings of the Association for Computational Linguistics: ACL 2025, p. 25554–25591. External Links: Document, Link Cited by: §4.2. D. Kang, X. Li, I. Stoica, C. Guestrin, M. Zaharia, and T. Hashimoto (2024) Exploiting programmatic behavior of LLMs: dual-use through standard security attacks. In 2024 IEEE Security and Privacy Workshops (SPW), p. 132–143. External Links: Document, Link Cited by: §1. E. Kembery, B. Bucknall, and M. Simpson (2024) Position paper: model access should be a key concern in AI governance. arXiv preprint arXiv:2412.00836. External Links: Link Cited by: §2. D. Kumar, N. A. Birur, T. Baswa, S. Agarwal, and P. Harshangi (2025) No free lunch with guardrails. External Links: 2504.00441, Link Cited by: §4.3. T. Kwa, B. West, J. Becker, A. Deng, K. Garcia, M. Hasin, S. Jawhar, et al. (2025) Measuring AI ability to complete long software tasks. arXiv preprint arXiv:2503.14499. External Links: Link Cited by: §1. M. Li, M. Qiu, Z. Peng, H. Fan, S. Fu, J. Ding, and Y. Feng (2026) Beyond refusal: a same-lineage study of aligned and abliterated LLMs for vulnerability analysis. arXiv preprint arXiv:2607.05842. External Links: Link Cited by: §4.3. N. Li, A. Pan, A. Gopal, S. Yue, D. Berrios, et al. (2024) The WMDP benchmark: measuring and reducing malicious use with unlearning. arXiv preprint arXiv:2403.03218. Cited by: §2. M. Nasr, N. Carlini, C. Sitawarin, S. V. Schulhoff, et al. (2025) The attacker moves second: stronger adaptive attacks bypass defenses against LLM jailbreaks and prompt injections. arXiv preprint arXiv:2510.09023. Cited by: §1, §4.2. K. O’Brien, S. Casper, Q. Anthony, T. Korbak, R. Kirk, X. Davies, I. Mishra, G. Irving, Y. Gal, and S. Biderman (2025) Deep ignorance: filtering pretraining data builds tamper-resistant safeguards into open-weight llms. arXiv preprint arXiv:2508.06601. Cited by: §2. OpenAI (2025) Preparedness framework, version 2. Note: Technical frameworkAccessed July 17, 2026 External Links: Link Cited by: §1. OpenAI (2026a) Introducing trusted access for cyber. Note: https://openai.com/index/trusted-access-for-cyber/Accessed July 16, 2026 Cited by: §4.4. OpenAI (2026b) Scaling trusted access for cyber with GPT-5.5 and GPT-5.5-Cyber. Note: https://openai.com/index/gpt-5-5-with-trusted-access-for-cyber/Accessed July 16, 2026 Cited by: §4.4. C. Pan, Y. Wu, and X. Yao (2026) SafeRedirect: defeating internal safety collapse via task-completion redirection in frontier LLMs. arXiv preprint arXiv:2604.20930. External Links: Link Cited by: §4.3. B. Parno, J. M. McCune, and A. Perrig (2010) Bootstrapping trust in commodity computers. In 2010 IEEE Symposium on Security and Privacy, p. 414–429. Cited by: §4.4. A. Plesner, T. Vontobel, and R. Wattenhofer (2024) Breaking reCAPTCHAv2. In 2024 IEEE 48th Annual Computers, Software, and Applications Conference (COMPSAC), p. 1047–1056. Cited by: §4.2. E. Roland, M. Cubuktepe, E. Martinez, S. Servaes, K. Pepper, M. Vaiana, D. S. de Lucena, J. Rosenblatt, A. Foote, C. Anil, and A. Cloud (2026) Modular pretraining enables access control. arXiv preprint arXiv:2607.08077. External Links: Link Cited by: §2. P. Röttger, H. Kirk, B. Vidgen, G. Attanasio, F. Bianchi, and D. Hovy (2024) XSTest: a test suite for identifying exaggerated safety behaviours in large language models. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), p. 5377–5400. External Links: Document, Link Cited by: §4.3. M. Russinovich, A. Salem, and R. Eldan (2025) Great, now write an article about that: the crescendo Multi-Turn LLM jailbreak attack. In 34th USENIX Security Symposium (USENIX Security 25), p. 2421–2440. External Links: Link Cited by: §4.2. A. Searles, Y. Nakatsuka, E. Ozturk, A. Paverd, G. Tsudik, and A. Enkoji (2023) An empirical study & evaluation of modern CAPTCHAs. In 32nd USENIX Security Symposium (USENIX Security 23), p. 3081–3097. Cited by: §4.2. M. Sharma, M. Tong, J. Mu, J. Wei, J. Kruthoff, et al. (2025) Constitutional classifiers: defending against universal jailbreaks across thousands of hours of red teaming. arXiv preprint arXiv:2501.18837. Cited by: §1. M. Shih, M. Rosenberg, H. Kailad, and I. Miers (2025) Zk-promises: anonymous moderation, reputation, and blocking from anonymous credentials with callbacks. In 34th USENIX Security Symposium (USENIX Security 25), Seattle, WA, p. 4995–5014. External Links: ISBN 978-1-939133-52-6, Link Cited by: §2. A. B. Tsybakov (2009) Introduction to nonparametric estimation. Springer, New York. Cited by: §3.5. R. Uppaal, S. Lyu, S. Sung, and J. Hu (2026) OpenSafeIntent: evaluating intent-calibrated safe completion across dual-use prompt sets. arXiv preprint arXiv:2607.02047. Cited by: §1, §2, §4.1. C. Wang, Z. Wei, Q. Liu, and M. Chen (2025a) False sense of security: why probing-based malicious input detection fails to generalize. arXiv preprint arXiv:2509.03888. External Links: Link Cited by: §4.2. X. Wang, Z. Ji, W. Wang, Z. Li, D. Wu, and S. Wang (2025b) SoK: evaluating jailbreak guardrails for large language models. arXiv preprint arXiv:2506.10597. External Links: Link Cited by: §4.3. Z. Weng, X. Jin, J. Jia, and X. Zhang (2025) Foot-in-the-door: a multi-turn jailbreak for LLMs. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, p. 1939–1950. External Links: Document, Link Cited by: §4.2. H. Wijk, T. Lin, J. Becker, S. Jawhar, N. Parikh, T. Broadley, L. Chan, et al. (2024) RE-Bench: evaluating frontier AI R&D capabilities of language model agents against human experts. arXiv preprint arXiv:2411.15114. External Links: Link Cited by: §1. R. Wu, Y. Quan, Z. Shi, Z. Wang, Y. Li, and R. Tang (2025a) Read the scene, not the script: outcome-aware safety for LLMs. arXiv preprint arXiv:2510.04320. External Links: Link Cited by: §4.2. X. Wu, A. Umrawal, and L. R. Varshney (2025b) Concealment of intent: a game-theoretic analysis. arXiv preprint arXiv:2505.20841. Cited by: §1, §4.2. Y. Wu, X. Liu, Y. Gao, X. Zheng, H. Huang, Y. Li, C. Wang, B. Li, X. Ma, and Y. Jiang (2026) Internal safety collapse in frontier large language models. arXiv preprint arXiv:2603.23509. External Links: Link Cited by: §4.1. E. Wybitul (2025) Access controls will solve the dual-use dilemma. arXiv preprint arXiv:2505.09341. Note: Accepted at the ICML Workshop on Technical AI Governance Cited by: §2. Y. Yuan, T. Sriskandarajah, A. Brakman, A. Helyar, A. Beutel, et al. (2025) From hard refusals to safe-completions: toward output-centric safety training. arXiv preprint arXiv:2508.09224. Cited by: §1. M. Zheng, M. Morgan, L. Jiang, C. Rose, and M. Sap (2026) Useless but safe? benchmarking utility recovery with user intent clarification in multi-turn conversations. arXiv preprint arXiv:2604.27093. Cited by: §1, §2, §4.3.