Safety in Batches? Understanding and Mitigating Safety Failures in Batch Prompting

2026-08-02

AI Summary

This work identifies and characterizes a previously unrecognized security vulnerability introduced by batched prompting in large language models: harmful queries that would otherwise be rejected can elicit unsafe responses when processed together with benign prompts in the same batch. Distinct from in-context learning or long-context effects, this failure stems from the dilution of refusal signals and the weakening of alignment cues during batched inference. To address this issue, the authors propose a batch-aware preference optimization framework. Through black-box adversarial evaluations and alignment analyses on both open-source and state-of-the-art commercial models, they demonstrate that their approach effectively mitigates the safety degradation caused by batching, significantly enhancing model robustness without compromising inference efficiency.

Abstract

Batch prompting is a practical inference strategy for large language models, but its safety implications remain underexplored. We show that the success of batch prompting for utility does not extend to safety: a harmful question that is reliably refused in isolation can elicit a harmful response when embedded in a batch of benign questions. We identify this as a distinct safety failure mode, not reducible to known vulnerabilities such as in-context learning or long-context effects, and analyze its causes from two complementary perspectives: alignment signal weakening and refusal signal dilution. Across widely used open-source and frontier commercial models, batch prompting consistently achieves high attack success rates as a simple black-box attack. We further show that batch-aware preference optimization effectively mitigates the vulnerability. These findings highlight a blind spot in current safety alignment and point to batch-aware alignment as a necessary step toward robust deployment.

Problem

• batch prompting
• safety failures
• alignment
• harmful responses
• large language models

Innovation

• batch prompting
• safety failure
• alignment signal weakening
• refusal signal dilution
• batch-aware preference optimization