条件 regime 验证：安全分类器适配与监控的正确性估计
Regime-Conditional Verification: Correctness Estimation for Adapting and Monitoring Safety Classifiers
浏览论文内容
中文总结 AI 辅助
本文提出 Regime-Conditional Verification（RCV），通过轻量级封装器适配安全分类器，在不重新训练的情况下提升策略遵守度，可检测分布偏移并仅在必要时微调，在多分类器、数据集及部署场景中表现优异。
中文摘要 AI 辅助
部署在大型语言模型上的安全分类器常因两个原因失效：其决策反映的是训练时学习到的策略，而非部署方期望的策略；且随着部署流量演变，其性能会下降。本文提出 Regime-Conditional Verification（RCV，条件 regime 验证），这是一种轻量级封装器，可在不重新训练现成安全分类器的情况下对其进行适配。RCV 从分类器的内部表示中估计每个预测与部署方策略不一致的概率，并选择性修正可能错误的预测。相同的正确性估计还提供了无标签信号以检测分布偏移，支持维护循环：仅在必要时才更新正确性估计层并诉诸分类器微调。在三个现成安全分类器和两个基准数据集上，RCV 在所有分类器-数据集组合中均提升了对部署方策略的遵守度，在不修改底层分类器的情况下，捕捉到了此前未被发现的多达 0.81 的不安全内容。在包含十个攻击活动的部署研究中，每个攻击活动均为 RCV 训练时未包含的危害类别，RCV 在专用注入面板中检测到了所有攻击活动；在维护普查中，大多数漂移事件无需更新分类器即可修复，微调仅保留给修复无法恢复的剩余事件。
英文摘要
Safety classifiers deployed with large language models often fail for two reasons: their decisions reflect the policy learned during training rather than the deployer's desired policy, and their performance degrades as deployment traffic evolves. We present Regime-Conditional Verification (RCV), a lightweight wrapper that adapts an off-the-shelf safety classifier without retraining it. RCV estimates, from the classifier's internal representations, the probability that each prediction disagrees with the deployer's policy, and selectively corrects predictions likely to be wrong. The same correctness estimates also provide a label-free signal for detecting distribution shift, enabling a maintenance loop that updates the correctness estimation layer and resorts to classifier fine-tuning only when repair fails within a label budget. Across three off-the-shelf safety classifiers and two benchmark datasets, RCV improves adherence to the deployer's policy in every classifier-dataset combination, catching up to 0.81 of previously missed unsafe content without modifying the underlying classifier. In a deployment study with ten attack campaigns, each a harm category held out of RCV's training, RCV detects every campaign in a dedicated injection panel; in the maintenance census most drift episodes are repaired without updating the classifier, and the fine-tune is reserved for the residual episodes.
