Safeguards Based on Copyable Context Cannot Provide Reliable Safety for LLMs

2026-07-30

AI Summary

Current safety mechanisms in large language models (LLMs) are vulnerable to circumvention by adversaries who mimic legitimate users, as these mechanisms cannot anticipate the actual downstream use of generated content, thereby struggling to balance utility and security. This work presents the first formal analysis of the limitations inherent in safety protocols based on replicable context, introducing the “safety trilemma”: the impossibility of simultaneously achieving useful capabilities, reliable safety, and open access. We establish a worst-case performance lower bound under adversarial assistance when evidence is replicable. To overcome this fundamental limitation, we propose a novel security architecture grounded in non-replicable trusted credentials, integrating formal safety guarantees, adversarial evaluation, and dual-use task modeling. Through adaptive attack experiments and deployment in real-world systems, we empirically validate the efficacy of our approach, offering a new paradigm for LLM safety design.

Abstract

Large language model safeguards decide whether to answer before seeing how an answer will be used. This creates a basic problem for dual-use tasks: the same answer can help an authorized professional or an attacker, while an attacker can imitate a benign request and interaction history. We separate the capability released by the model from the evidence available about downstream use. When that evidence is copyable, we derive the exact worst-case floor on attacker assistance while preserving useful answers. The result yields a safety trilemma: Useful Capability, Reliable Safety, and Open Access cannot coexist. We then show how a trusted credential can complement existing safeguards by adding hard-to-copy information that predicts actual downstream use, and identify the stronger condition needed to eliminate the floor. Evidence from dual-use evaluations, adaptive attacks, and deployed trusted-access programs supports the practical relevance of these conditions.

Problem

• large language models
• safeguards
• dual-use tasks
• copyable context
• reliable safety

Innovation

• copyable context
• safety trilemma
• trusted credential
• dual-use tasks
• LLM safeguards