Trust The Typical
Authors: Debargha Ganguly
Sreehari Sankar
Biyao Zhang
Vikash Singh
Kanan Gupta
Harshini Kavuru
Alan Luo
Weicong Chen
Warren Richard Morningstar
Raghu Machiraju
Vipin Chaudhary
Venue: ICLR 2026 Poster (2026)
Keywords: LLM Safety
Out-of-Distribution Detection
Jailbreaking
Representation Learning
Selective Generation
Anomaly Detection
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: Our paper presents T3, an efficient, out-of-distribution-based safety method that models the features of "safe" prompts to achieve state-of-the-art performance in detecting jailbreaks and toxic content while mitigating overrefusal.

Abstract: Current approaches to LLM safety fundamentally rely on a brittle cat-and-mouse game of identifying and blocking known threats via guardrails. We argue for a fresh approach: robust safety comes not from enumerating what is harmful, but from \emph{deeply understanding what is safe}. We introduce \textbf{T}rust \textbf{T}he \textbf{T}ypical \textbf{(T3)}, a framework that operationalizes this principle by treating safety as an out-of-distribution (OOD) detection problem. T3 learns the distribution of acceptable prompts in a semantic space and flags any significant deviation as a potential threat. Unlike prior methods, it requires no training on harmful examples, yet achieves state-of-the-art performance across 18 benchmarks spanning toxicity, hate speech, jailbreaking, multilingual harms, and over-refusal, reducing false positive rates by up to 40x relative to specialized safety models. A single model trained only on safe English text transfers effectively to diverse domains and over 14 languages without retraining. Finally, we demonstrate production readiness by integrating a GPU-optimized version into vLLM, enabling continuous guardrailing during token generation with less than 6\% overhead even under dense evaluation intervals on large-scale workloads.

Published as a conference paper at ICLR 2026
TRUST THE TYPICAL
Debargha Ganguly!~ Sreehari Sankar' Biyao Zhang'
Vikash Singh'
Kanan Gupta² Harshini Kavuru Alan Luo' Weicong Chen
Warren Morningstar' Raghu Machiraju Vipin Chaudhary'
'Case Western Reserve University, University of Pittsburgh
'hh Ohio State University, *Google Research
ABSTRACT
Current approaches to LLM safety fundamentally rely on a brittle cat-and-mouse game of identifying and blocking known threats via guardrails. We argue for a fresh approach: robust safety comes not from enumerating what is harmful, but from deeply understanding what is safe. We introduce Trust The Typical (T3), a framework that operationalizes this principle by treating safety as an out-of- distribution (OOD) detection problem. T3 learns the distribution of acceptable prompts in a semantic space and flags any significant deviation as potential threat. Unlike prior methods, it requires no training on harmful examples, yet achieves sfate-of-the-art performance across 18 benchmarks spanning toxicity, hate speech, jailbreaking, multilingual harms, and over-refusal, reducing false positive rates by up 40x relative specialized safety models. A single model trained only safe English text transfers effectively to diverse domains and over 14 languages without retraining. Finally, demonstrate production readiness by integrating GPU-optimized version into vLLM, enabling continuous guardrailing during token generation with less than 6% overhead even under dense evaluation intervals on large-scale workloads.
INTRODUCTION
Contemporary safety paradigms for large language models fundamentally reactive, relying on specialized classifiers trained to detect known categories of harmful content and adversarial prompts via explicit pattern recognition (Inan et al., 2023; Deng al., 2025; Gehman et al., 2020; Wallace et al., 2019; Carlini et al., 2021; Zou et al., 2023; Wei et al., 2023). This approach creates an inherent asymmetry, where attackers need only discover novel prompt structures that fall outside the training distribution of safety classifiers, while defenders must continuously expand their catalogs of harmful patterns dynamic that favors the adversary (Liu al., 2023c). The adversarial landscape evolves continuously with new attack vectors such as multi-turn jailbreaking, role-playing exploits, and encoding- based obfuscation emerging faster than defensive systems can adapt. Consequently, even sophisticated alignment techniques like Reinforcement Learning from Human Feedback (RLHF) and Constitutional AI, while improving general alignment, cannot guarantee robustness against adversarial inputs that fall outside their training distributions (Christiano et al., 2017; Bai et al., 2022; Ouyang et al., 2022; Casper et al., 2023). These adversarial prompts succeed precisely because they share a fundamental characteristie: they must deviate from the statistical regularities of "typical" natural language to exploit learned vulnerabilities, a property current defenses fail to leverage systematically.
This cat-and-man mouse dynamic reveals deeper issue: current safety mechanisms against explicitly known attack patterns, and cannot anticipate and defend against novel forms of attack. We explore a paradigm shift toward proactive safety through the lens of statistical typicality. Drawing from information theory, we observe that legitimate user interactions with language models, despite their surface diversity, occupy relatively concentrated region the model's 's semantic representation space, what Cover & Thomas (1999) term the "typical set." Adversarial prompts, by design, must deviate from natural language patterns to exploit model vulnerabilities, often manifesting as atypical points in this representation space (Nalisnick et al., 2019; Morningstar et al., 2021). This
only defend
"This work funded by NSF Awards 21 21449 and 21 122606.

---

Published as a conference paper at ICLR 2026
reframing suggests more efficient and robust paradigm for LLM safety. Rather than training specialized models to recognize specific harmful patterns, we can instead focus on characterizing the distribution of acceptable, in-distribution examples. Such approach offers two key advantages. First, it obviates the need for an exhaustive and constantly updated collection of harmful examples, requiring only specification of what constitutes safe usage. Second, by making no assumptions about the form of adversarial inputs, it provides a more principled defense against novel and unforeseen attack patterns. However, operationalizing this paradigm is challenging; one cannot directly query the true probability of prompt under the unknown distribution of "safe and intended use." While prior works have explored statistical methods for content filtering, they often remain vulnerable to novel attacks or incur high computational overhead (Gehman et al., 2020; Xu et al., 2021).
In this paper, we introduce T3, a novel framework that fundamentally reframes LLM safety from reactive pattern-matching to proactive statistical modeling. T3 operationalizes the principle of typicality by learning the geometric structure of safe language use, then detecting deviations that characterize harmful content. Our specific contributions are:
1. We extend the Forte framework (Ganguly al.. 2025c) from vision text, providing rigorous theoretical analysis of how the per-point PRDC metrics detect distributional shifts. We establish the expected values of the metrics in a much more general setting than Ganguly et al. (2025c): without any additional assumptions on the distributions in the case when samples are from the same distribution, and with mild assumptions on the density and support of the distributions in the case when they are different.
2. Across 18 benchmarks spanning toxicity, hate speech, jailbreaking, and multilingual harms, T3 achieves state-of-the-ars AUROC with a 10-40x reduction in false positive rates compared to specialized safety models. On important benchmarks, T3-OCSVM achieves FPR @95 of 2.0% (OffensEval) and 3.5% (Davidson) versus 75.2% and 61.7% for the best baseline. This improvement directly translates to 75% reduction in overrefusals compared to traditional methods on RRBBench.
3. Using a single model trained only on English seneral-purpose safe text, T3 achieves near- perfect transfer across specialized domains (99.6% AUROC code, 99.8% on HR) and maintains consistent performance across 14+ languages with less than 2% variance. This reduces the need for domain-specific training, multilingual data collection, language- specific calibration.
4. We co-design T3 within vLLM to enable continuous safety monitoring during token gener- ation, achieving sub-6% overhead even with aggressive 20-token evaluation intervals on 5,000-prompt workloads. By overlapping safety computations with inference operations on the same GPU, T3 enables immediate terminations of harmful generations without the latency penalties associated with post-pres post-processing approaches, making real-time guardrailing practical for production deployments.
2 RELATED WORKS
Detecting out-of catt-f-diitribution (OOD) inputs is crucial for reliably deploying models, as they often yield confident but incorrect predictions on novel data, vulnerability highlighted by adversarial perturbations (Szegedy et al., 2013) and poor calibration (Guo et al., 2017). Supervised OOD methods use labeled examples for explicit training (Hendrycks et al., 2019; Dhamija al., 2018), output calibration (Liang et al., 2018; Hsu et al., 2020), ensembles (Lakshminarayannal et al., 2017). or fitting distributions latent features (Meinke & Hein, 2020; Ganguly et al., 2025a). However, their reliance on known OOD examples limits effectiveness against novel threats. In contrast, unsupervised methods model the training data density p(x) (Bishop. 1994), but this approach can fail in nighndimensional spaces where OOD samples receive high likelihoods (Nalisnick et al., 2019; Choi et al., 2018). Solutions like likelihood ratios (Ren et al., 2019), typicality tests (Nalisnick et al., 2019). interpretable graph-base methods (Ganguly al., 2025a) and physics-inspires estimators (Morningstar et al., 2021) attempt to mitigate this paradox but still struggle with the curse of dimensionality.
The emergence of LLMs transformed OOD detection through the geometric property of isotropy, where embeddings spread uniformly in contrast to the narrow 'cones' of earlier models (Liu et al.,
2

---

Published as a conference paper at ICLR 2026
with Trcke Arsto
Carcerradee Demesiiniityy
09 My diparie
+33 109 125
1.5
hrm
Figure Geometric concentration safe text embeddings in high-dimensional space. The distribution of Euclidean distances from the mean for 10,000 safe embeddings (Alpaca, d=1024) empirically validates the concentration of measure phenomenon. (a, d) The distances closely follow theoretical X1024 distribution, confirmed by Q-Q plot (R²² > 0.99). (b, c, f) This results in concentrated "typical set" where 90% of data forms an annulus ("hollow sphere") around the mean, a structure visible even in 2D PCA projections. (e) As predicted by theory, this concentration tightens relative to the dimension (O(d-1/2)).
2023a). This structure makes simple distance metrics effective, resolving the representation de- generation that plagued previous methods (Ma & Zhu, 2022; Ethayarajh, 2019). Building on this, research reveals that pre-trained models are often superior OOD detectors because they form clean domain-lever clusters that task-specific fine-tuning fragments, inadvertently hiding OOD samples in the resulting gaps (Uppaal et al., 2023). This trade-off, which we term the fine-tuning paradox, is now being formalized by theoretical work connecting OOD robustness to PAC learning guarantees and the information-theone
concept of a 'typical set' (Cover Thomas, 1999).
OOD detection in LLMs follows three main paradigms, each with significant trade-offs. Likelihood- based methods use ratios between base and fine-tuned models as an OOD signal (Zhang et al., 2024; Ren et al., 2022), but are computationally prohibitive and assume the base model covers all anomalies. Representation-basel methods exploit embedding geometry via distance metrics (Podolskiy et al., 2021) or lightweight PEFT activations (Hayou al., 2024), but face paradox where the fine-tuning needed for tasks degrades the geometric structure required for detection. Finally, synthetic data generation implements Outlier Exposure (Hendrycks et al., 2018) by creating challenging outliers (Abbas et al., 2025; Chen et al., 2021; Fort et al., 2021); however, this approach remains reactive, requiring "OOD oracle" anticipate threats and thus failing against unknown-unknowns.
The connection between OOD detection and LLM safety is direct: adversarial prompts, including jailbreaks prompt injection (Liu et al., 2023b), and role-playing exploits (Wei et al., 2023), by definition out-of-distribuie
as they must deviate from natural language. This contrasts with dominant reactive defenses, such as specialized classifiers (Inan et al., 2023) or alignment techniques like RLHF (Ouyang et al., 2022) and Constitutional AI (Bai et al., 2022), which cannot generalize to novel threats and consistently lag the evolving adversarial landscape. While recent proactive work has begun applying OOD principles to address safety problems like anomaly detection, perplexity filtering (Jain al., 2023), hallucination detection, and uncertainty quantification (Kuhn et al., 2023; Kadavath et al., 2022), a unified framework is still lacking.
Our work synthesizes these insights into a unified framework that resolves their fundamental lim- itations. T3 operationalizes the principle that safety is fundamentally about typicality (Nalisnick et al., 2019; Cover & Thomas, 1999) by learning the distribution of safe usage directly from curated examples. This approach avoids the high cost of dual-model likelihood methods (Zhang et al., 2024), preserves the clean geometric structure that fine-tune fine-tuning corrupts (Uppaal et al., 2023), and requires no "OOD oracle" to anticipate threats synthetic data methods do (Abbas et al., 2025). By adapting a principled OOD framework from vision (Ganguly et al., 2025c) to leverage the unique isotropic geometry of LLM embeddings (Liu al., 2023a), we provide proactive defense that is both theoretically grounded and efficient.
METHODOLOGY
We consider the problem of detecting potentially harmful prompts and LLM outputs before processing further. Let Daate denote the distribution of benign prompts representing acceptable model usage. Given a reference corpus X = { ~ safe and test prompts Y (yj )= our goal is to determine whether each yj Drate (in-distribution) or yj Dharmful (out-
Problem Formulation:
3

---

Published as a conference paper at ICLR 2026
Mohalanabis Dist Distrib
Curves Anomaly Detection
Dist Distrib Comparison
Projection
SafelID)
Safe (ID)
from Safe Mean
Tokk (OOD)
0.08
Roric (OOD)
0.75
2.0
PC2 (2 22.5% var
0.25
7.00
0.50
0.00
0.04
0.25
0.8
0.02
Maha. (AUC
0.944)
-0.45
05N Typical Set
0.00
Mean
Mahalanobis Mean
Rate
Safe
Toxic
-0.25 022.0.00 0.25
PCI (4.0% var)
Figure 2: Distinguishing safe vs. toxic text using geometric typicality. This figure compares simple Fuclidean and Mahalanobis distances for separating 10,000 safe and 2,000 toxic embeddings. (a, b) Mahalanobis distance, which accounts for the safe data's ' covariance, provides far better separation between safe (green) and toxic (red) distributions. (c, d) This superiority is quantified by significantly higher ROC AUC (0.944 vs. 0.733) and confirmed by box plots. (e) A 2D PCA projection visually confirms that toxic samples fall predominantly outside the 95% typical set boundary of safe data.
of-distribution), where Pharmful represents an unknown distribution of adversarial prompts, toxic content, or off-topic queries. To this end, we adapt the multi-model framework of Ganguly et al. (2025c) from visual to textual domain. For each text sample z, we employ 3 sentence transformers: & (Qwen3-Fmmeeddigg-D) -...nbeedddin--..B,... & (BGE-M3), and &g (E5-Large-vv2. Each encoder & produces normalized embedding: 6x (z) ||*(()]]22 E gdh-1 where Sd denotes the unit hypersphere
(x)
in Rd This normalization ensures cosine similarity computations and mitigates encoder-specific scaling artifacts.
For each encoder and test point Yj. we compute four geometric features that capture the rela- tionship between test and reference distributions. Let [B; Z) denote the smallest ball cen- tered at containing its k nearest neighbors from set Z, and define the reference manifold esti-
mate: (x) - NB& (&x (z:); The per-point PRDC metrics Precision (i) 1
Sc(X)); Recall = - Σ 1(ox (z;) E ()) Dennsity (5)
E ((xx())) E
kmm
(ox(());;;; ( :overaae = 1 (x;)) E (ox() These metrics have use- ful mathematical properties that enable principled anomaly detection. Under the null hypothesis
Hu : Duss safe, we can compute the expected values of the metrics as follows.
Theorem 3.1 (Expected Values under the null hypothesis). When test and reference samples are drawn from the same distribution:
E|Recall k/n
E[Density (2) 1/m
E|[overagee (/) < 1-
lim E|Precision [2)
While the values of these metrics analytically intractable without additional information about the distributions when Daate * Diess we compute the values a number of interesting regimes and show that the metrics consistent tests in these regimes, i.e. they be used distinguish the null hypothesis from the alternative hypothesis. We prove these results as well as the theorem above in Appendix A.
1. Partial Support Mismatch: When Duamiut (uumptu(Supp(((( (aaee) = a > 0, harmful prompts
explore semantic regions outside typical usage, yielding lim EE| [reecciio =1-a
2. Density Shift: Even when supports coincide, if density ratio r(y) Psate ()))////fullll (3) is non-constant, coverage satisfies:
lim E[Coverage] = Eyr-Dramau
Akr(y)
- ー>
(1)
m0
where À lom m/n. This guarantees coverage is maximized only when distributions match.
3. Local Perturbations: For regions where r(y) I 1 - 1 with Phumfu-meassnn > 0, the coverage gap is at least 5(e Akk AAil- -n)), ensuring detection of targeted adversarial patterns.
4

---

Published as a conference paper at ICLR 2026
These results show that PRDC metrics sufficiently powerful to capture the differences in two distributions, but do not directly give us the threshold values of the metrics for distinguishing two distributions. We use density estimation methods, trained only the PRDC metrics computed from the In-Distribution data, to compute anomaly scores. We aggregate PRDC features across all encoders
to form single representation: T(y,) = [PRDC]
k 1 (
R where PRDC
[Recall (1) Density (3) Precision ( Coverage J This multi-view representation captures semantic anomalies that may be subtle in individual embedding spaces. We model the distribution of ' on safe data using two complementary approaches: Gaussian Mixture Model (GMM) with components selected via Bayesian Information Criterion, and One-Class SVM (OCSVM) with RBF kernel with V parameter tuned via validation accuracy. The anomaly score for test point yj is computed as the negative log- likeliod under the fitted model, with scores normalized [o, 1] via sigmoid transformation.
We contextualize the per-point PRDC metries within the broader literature on non- non-paraettric k- nearret-neiighoo--bseee two-sample testing. Classical pooled-graph tests ask the global question "do F and G match?"; by contrast, Forte tackles the harder, per-sample question of whether each Y/ is compatible with X, and it is intentionally asymmetric and scalable (reusing structure from the reference set). This asymmetry and the use of in-set rather than pooled neighbors mean these procedures not equivalent in general, and naively adapting pooled tests for repeated prediction would be computationally prohibitive at modern scales. Even so, viewing PRDC and Forte or T3 through the two-sample-test lens clarifies their mathematical behavior and suggests useful sanity checks. The details of this comparison are given in Appendix A.
We evaluate performance using Area under ROC curve (AUROC), measuring ranking quality across all thresholds, False positive rate at 95% true positive rate (FPR @95), important for safety-sensitive applications, Area Under the Perturbation Recall Curve (AUPRC), and Maximum F1 score with corresponding threshold, balancing precision and recall (Optimal F1).
Implementation Details. For PRDC computation, we randomly split the reference set into two equal halves to avoid self--imilarity bias when computing nearest neighbor statistics. The L2 distance on normalized embeddings is used throughout, exploiting the relationship || - yl12 = 2(1 cos(x: y)) for unit vectors. Embeddings are cached to disk in PyTorch format, enabling efficient reuse across experiments. The detector selection uses grid search over hyperparameters: GMM components E 21,2,4 4, 8, 16, 32, 64) constrained by sample size, and OCSVM v E {0.01, 0.05, 0.1, 0.5).
RESULTS
We conduct a comprehensive empirical evaluation, aiming answer five critical research questions:
In-Distribution Data. Following established OOD detection protocols (Hendrycks et al., 2019; Liang et al., 2022), we construct our in-distribution (ID) dataset from curated mix of safe, helpful prompts spanning diverse domains. Our ID corpus combines high-quality instruction-follovii data from Alpaca (Taori et al., 2023), Dolly (Conover et al., 2023), and OpenAssistant (Köpf et al., 2023), equally distributed across the datasets. totaling approximately 40K examples. Critically, no harmful, toxic, or adversarial examples are included in the ID data for any OOD detector, ensuring a fair test of generalization.
Out-of- -i------ittiitttinn Benchmarks. We evaluate on 12 challenging OOD benchmarks representing the spectrum of LLM safety threats: general toxicity detection (RealToxicityPromee (Gehman et al., 2020), CivilComments (Borkan et al., 2019)), targeted hate speech (HatEval (Basile al., 2019). Davidson (Davidson et al., 2017), HASOC (Mandl et al., 2019), OffensEval (Zampieri et al., 2019)), multilingual harms (XSafety (Wang et al., 2023)), and domain-specific policy violations across code, cybersecurity, education, HR, and social media contexts (PolyGuard (Kang et al., 2025)). Additionally, we use four adversarial benchmarks: AdvBench (Zou et al., 2023), HarmBench (Mazeika et al., 2024), JeincreakBenchh (Chao et al., 2025), and MaliciousInstruet (Huang al., 2023). Results on WildGuardMix (Han et al., 2024) are provided in Table 9.
Baselines. We compare against three categories of state-of-the-ar methods: (1) Specialized Safety Models: LlamaGuard 3-1B and 4-12B (Inam et al., 2023), WildGuard (Han et al., 2024), DuoGuard (Deng et al., 2025), MD-Judge (Li et al., 2024), PolyGuard (Kang et al., 2025), and L.LM-Guard
5

---

Published as a conference paper at ICLR 2026
(Mhatre et al., 2025): (2) Commercial Safery APIs: OpenAI Omni Moderation and Perspective API; (3) Representation based OOD Methods: We adapt ten established techniques to operate on semantic embeddings from
(Bai et al., 2023); ablations with larger embeddings (4B, 8B) are provided in Tables 10 and 11 text-native OOD baselines (Energy, KNN, Mahalanobis) are evaluated in Table 12, RMD (Ren et al., 2022), VIM (Wang et al., 2022), CIDER (Ming et al., 2022), GMM (Lee et al.. 2018), OpenMax (Bendale & Boult, 2016), ReAct (Sun et al., 2021), AdaScale (Regmi, 2025), NNGuide (Park et al., 2023), and FDBD (Liu & Qin, 2023).
Evaluation Metrics. We report AUROC, AUPRC, Fl-score, and FPR@9STPR (False Positive Rate 95% True Positive Rate) (Hendrycks et al.. 2019). For safety applications, @PR@95TPR is particularly critical as it measures the rate of false alarms while maintaining high detection sensitivity, Concretely, FPR @95TPR answers: "If we require catching 95% of harmful prompts, what fraction of truly safe prompts are mistakenly flagged?" For each benchmark, OOD (harmful) examples come from the respective dataset while ID (safe) examples come from our held-out safe corpus; we compute ROC curves over all scores and report FPR at the threshold achieving 95% TPR on OOD, Importantly, no OOD labels or test data are used to train T3's density estimators (GMM/OCSVM), and thresholds not tuned per- ger-benchmark- -hhre is data leakage from evaluation back into training.
RQ1: How does T3 compare against specialized safety models and traditional OOD methods on diverse harm detection benchmarks?
Table 1: Toxicity Detection Performance Across Six Benchmarks. T3 outperforms most baselines, including specialized safety models and traditional OOD methods. Performance is measured by AUROC (higher is better) and FPR @95 (lower is better). T3 achieves exceptionally low False Positive Rate (FPR @95), indicating high precision for practical deployment.
Datnset
Comments AUROC FPR
Davidson et al.
Hasoe
OffensEval
Toxieity
Metric
AUROC FPR895
AUROC
8PR899
AUROC
FP
AUROC FP
AUROC
Method
ADASCALE
0.3572
0.9971
0,1063
0.9999
0.4323
0.9925
0.3491
0.9890
0.2766
0.9987
0.5072
0.9672
CIDER
0.7395
0:9267
0.6791
0.9790
0.7800
0.8769
0.7827
0.8825
0.7469
0.9525
0.7535
0.8726
FDED
0.4903
0.9921
0.7694
0.8960
0.49%
0.994]
0.5357
0.9730
0.6099
0.9674
0.3519
0.9944
GMM
0,6249
0.9758
0.6297
0.9757
06723
0.9670
0.7077
0.9689
0.7284
0.9637
0.6297
0.9565
NNGUIDE
0.4710
0.9950
0.2193
0,999
0.5527
0.9919
0.4665
0,9649
0.4101
0.9995
0,8094
0.9600
OPENMAX
0.5347
0.9958
0.9997
0.9908
0.5874
0.6043
0.4396
0.9633
0.3432
0.9922
0.2016
0.999
0.3925
0.9913
0.3784
0.3059
0.9922
0,5536
0.9485
RMD
0.5560
0.9627
0,5989
0.9814
0.5982
0.9697
0.6123
0.9798
0.6529
0.9665
0.5635
0.9750
VIM
0.5626
0:9953
0.4742
0.9965
0.0046
0.9918
0.5776
0.9940
0.53 0.5967
0.9558
0.6001
0.9642
Perspective API
0,971
0,1413
0.9785
0.1068
0.9482
0,3062
0.9376
0,8070
0.9208
0.5171
0.9372
0,5106
OpenAl Omni
0,8916
0.8607
0.8926
0,9055
0.8591
0,9164
0.8561
0,8608
0.9069
0.9668
0.7557
0.9736
ELAMAGUARRD3-H
0:5714
1,0000
0.6344
1,0000
0:5881
1,0000
0.7475
1,0000
0.5027
1.0000
0,5858
1 1,0000
LLAMAGUA RDR-1RR
0.5368
0.5547
1,0000
1.0000
0.5496
0.5224
MANGUARDD-IB-LOGISS
0,7369
0.8214
0.8281
0.5217
0,7004
0,7820
WILDGUARD
0.7994
1,0000
0.8144
.,000
0.7707
1,0000
0.8191
1,0000
0. 7045
1.0000
0.6655
1,0000
MDJUDGE
0,2439
0.8552
0.7297
0,8540
0.7447
0.8397
0.7926
0.8201
0.7176
0.8755
0.5665
0.1866
DIOGUARD
0.8789
0.6742
0.9477
0.5170
0.324
0.8230
0. 0.7885
0.8119
0.8369
0.7516
0.7934
0.9110
POLYGUARD
0.7901
0.5446
03791
0.2216
0.7884
0,5200
0 0.8879
0.2595
0.7632
0.5315
0.7353
0.5380
T34GMM
0.9249
0.2079
0.9869
0,8366
0.9198
0.2022
0.9889
0.0451
0
0.0253
0.9282
0,1808
T340CSMM
0.9678
0,0350
0.1860
0.9940
0.9684
0.1670
Across six toxicity and hate speech benchmarks, T3 decisively outperforms all baselines, particularly in reducing false alarms. Our findings show that traditional OOD methods fail catastrophically when applied semantic safety, with most exhibiting false positive rates (FPR @95) exceeding 90%, rendering them unusable. While specialized safety models like DuoGuard and PolyGuard achieve better detection (AUROC), they hit a "precision ceiling," " suffering from prohibitively high false positive rates (e.g., 75.2% for DuoGuard on OffensEval and 61.7% on Davidson) due to their reliance on reactive caatternmaaching. In stark contrast, T3 achieves order-of-mannitude improvements in both detection and precision. T3-OCSVM delivers near-perfect AUROC (2 0.96 on of 6 benchmarks) and, most critically, slashes false positives. On OffensEval, T3's 2.0% FPR@99 represents 37x reduction over the best baseline, with similar dramatic gains across all datasets. This stable, seecpprciisoon performance demonstrates the superiority of T3's proactive approach, which models the "typical set" of safe content rather than attempting to enumerate all possible harms. (see Table 6 for component ablations).
For LlamaGuard, we evaluate both the standard discrete classification and a fine- fine-grained logit-based scoring variant (LLAMAGUARD3- CEEAAARDD----LOTTTEE IB-LOGITS). The exp(Cxate) (exp(faate) + exp(Lunstee) from the model's output logprobs, providing a continuous
approach extracts p(safe) =
6

---

Published as a conference paper at ICLR 2026
confidence score rather than a binary decision. This more favorable scoring improves LlamaGuard's calibration and reduces its FPR@95TPR; however, T3 still achieves substantially better performance across all benchmarks.
RQ2: Can T3, trained only on safe data, generalize to detect novel, unseen adversarial and jailbreaking attacks?
Against six diverse adversarial and jailbreaking benchmarks, T3 provides a substantially more robust defense than existing methods despite being trained only on safe data. Traditional OOD techniques again fail catastrophically, proving useless for practical defense with false positive rates (FPR @95) typically exceeding 97%. Specialized safety models exhibit attack-specific vulnerabilities and inconsistent protection; even the strongest baseline, PolyGuard, still incorrectly flags over 64% of safe prompts on every benchmark. In contrast, T3's attack-agnostic approach of identifying statistical deviations delivers significant gains. It excels against direct attacks, reducing the FPR @95 on AdvBench to 15.8%, a 4.2x improvement over PolyGuard, and performs well against contextual manipulations. While more subtle attacks remain challenging for all methods, T3's graduated response to threat sophistication, unlike the binary failures of other models, marks a significant step toward a more generalizable and practical adversarial defense.
RQ3: How effectively does T3 mitigate the common problem of overrefusal on benign-but- challenging prompts? How is the cold-start performance with limited ID data?
On the OR-Bench, designed to measure overrefusal on aufe-but-challenging prompts, T3 provides the best balance between safety and utility. While traditional OOD methods fail by flagging most benign edge cases as harmful (FPR 95 >68%). specialized models show inconsistent performance. Llama- Guard achieves an impressive low 14.8% % FPR @95 this specific task, result that sharply con- trasts its moderate performance on other benchmarks and suggests dataset-specific overfitting. Other models like DuoGuard and PolyGuard still over-refuse excessively (43.5% and 53.2% FPR @95). T3 delivers the most robust and well-rounded solution, with T3-GMM achieving an excellent 22.2% FPR @95 and T3-OCSVM the highest AUROC (0.934). We also evaluated an LLM-enhanced variant (denoted "Augment" in Table 3) that prepends a structured safety analysis from GPT-OSS-20B before embedding: however, this decreases OR-Bench performance, likely because the LLM's explicit safety labels shift borderline-safe prompts toward the harmful distribution in embedding space. Furthermore, T3 is highly sample-efficient and does not suffer from a cold start problem. As shown in Figure 3, performance converges rapidly with small number of in-distribution examples. With just 500 safe samples, T3-OCSVM already achieves high AUROC and significantly reduced FPR @95 across most benchmarks.
Table 2:
T3 provides zero-shot defense against adversarial and jailbreaking attacks. Trained only on safe data, T3 demonstrates significantly better generalization against six diverse attack benchmarks. It provides a robust, attack-agnoste defense, in contrast to specialized models which show inconsistent, attack-specine vulnerabilities.
Dataset
AdyBench AUROC FPR
BauverTalls
JullbreakBBench AUROC FPR
MallciousInstruct
XSTest
Metrie
AUROC
FPR
AURDC:
AURRX: FPR095
AUROX
FPR
Method
ADASCALE
0.5894
0.9827
0.2833
0.9986
0.4441
0.9900
0.3500
0.9879
0.2094
1.0000
0.2803
0.9952
CIDER
0.296.
1,0000
0.2777
0.9974
0.4799
0.9650
0.3566
0.9555
0.2580
1.0000
0.3345
1.0000
FOBD
0.5689
0:3750
0.7226
0.8754
0.342
0.9200
0.6195
0.9317
0.8510
0.7100
0.8021
0.7918
GMM
0.2737
0.99811
0.2515
0.3972
0.163
0.9900
0,5377
0.9625
0.2252
1000
0.22%8
10000
NNGUIDE
0.3989
0.9981
0.2239
0.9994
0.4233
0.9850
0.3795
0.9863
0.1623
1.0000
0.2144
1 1,0000
OPENMAX
0.3681
0:9942
0.9364
0.4904
0.9500
0.5861
0.5954
0,6308
0.9952
0.2655
0.9900
1,0000
02570
1,0000
0.191
0,2373
0.2575
0.9681
0.3568
0.9727
0.4346
1,0000
0.4816
0.9898
0.3869
1,0000
0,3730
10000
VIM
0.3380
0.9981
0.2169
0.9997
0.3369
1,0000
0.4032
1,0000
0.144L
1.0000
0.1565
1.0000
Perspective API
0.7895
0.9558
0.7922
0.8429
0.7247
0,9500
7233
0.9795
0.6808
1.0000
0.7930
0.738
OpenAT Ownii
0.8908
0.8369
0.8091
0. 0.9488
03188
0.9690
0J8369
036724
0.8875
0.9200
0.8257
O 0.9667
0.8894
1,0000
0.7135
1,0000
03887
1,0000
0:7248
1.0000
0.8509
1.0000
0.7843
1,0000
0.8100
0.7500
0.3398
0.3366
0,5887
0,3600
0.7293
0.5791
0.0542
0.9095
LLAMAGUAR 111-
0.8822
1,0000
LIKEO
10000
0.8718
1.0000
0.8150
1000
WILDGUARD
0.8658
08218
1,0000
0.6978
1,00K]
0.
0.9922
0,7920
1,0000
MIJUDGE
0.7814
0 0.9922
0.779
0 0.8987
0
0,9050
0. 0.702
0.8908
0. 1.757
0.9700
0,7906
0.9238
DUOGUARD
0.8241
0.9327
0.8525
0.8064
0.5007
0.9550
0.6820
0.9898
0.714
1.0000
0.8418
0.7810
POLYGUARD
0.8670
0.5654
0.5071
0. 0.7369
0.8595
0,6155
0.7904
0.720
0.3301
0.7800
0,8007
0.8914
13:GMM
0.9675
I.1577
0.7276
0.7847
0.7578
0.6700
0.7588
0.5358
0,8280
0.5900
0.6794
0,8143
13+0CSYM
0.9578
0.1731
0.5850
0.4539
0.7586
0.5500
0.8762

---

Published as a conference paper at ICLR 2026
Figure 3: T3 highly sample-efficient, avoid- ing the cold start problem. T3's detection per- formance (AUROC) rapidly converges = 90% with as few as 1000 in-distribution training sam- ples, demonstrating its ability to learn the manifold of safe usage from small, curated dataset.
Table 3: Performance on OR-Bench, benchmark designed to measure overrefusal safe-but-challenging prompts. T3 achieves an excellent bal- ance of safety and utility, with T3-GMM delivering low FPR@95 while T3- OCSVM achieves the highest AUROC. This outperforms most specialized mod- els like DuoGuard, though LlamaGuard shows an strong FPR@1 @95 on this specific task.
T3-OCSVM AUROC Performance
Method Metrie
AUROC
FPRG95
AUPRC
F1
Ailkaa
RMD
0.7474
0.7500
0.8674
0.8491
VIM
0.7162
0.7250
0.5386
0.5493
CIDER
0,7900
0.7117
0.9019
0.8536
FDBD
03517
Nanber Trandng
184
NNGUIDE
REACT
0,5438
0.6220
0.223
0.9417
0.7862
0,2420
0.8333
0.8333
TV-CCVVI FPREASTPR Performance
GMM
0.7530
0.883
09783
OPENMAX
0,410
0.811
0.6871
03333
LLAMAGEARD3-BB
0,5905
0.1453
0.9466
LLAMAGUARD4-22
0.9796
MIJUUDGE
0
0.990
8.4478
0.982
DUOGUARD
0,9311
0.4500
0.9729
0.9063
POLYGUARD
0.5312
T3+GMM
B.910
02221
8.9265
0.9405
T34GMM (Augmentt)
0.8594
0.3267
0:9022
0.9153
T3+CCVM
0:2517
0.9293
Sovertill
On-Bend
T3+0CSVM (Angment)
0,4000
0.9114
0.9060
Barebbock
Serry fonsh
333id
Trundag Sanples
RQ4: Does T3's performance generalize across different languages and specialized domains without retraining?
T3 demonstrates exceptional zero-shot generalization across specialized domains, using single model trained only on general-purpose English prompts. Without any domain-specifh training, T3 achieves near-perfect, out-of-the-box performance, with AUROC scores exceeding 99.5% and false positive rates (F5R@95) below 1% on both Code and HR policy violations, and similarly strong results in cybersecurity and education. In stark contrast, all baselines fail to generalize; traditional OOD methods are unusable (FPR@9 >93%), and specialized models like PolyGuard and LlamaGuard perform poorly even on their intended domains. This 40-100x improvement in FPR 95 validates T3's core principle: harmful content, whether it's malicious code or an HR violation, creates consistent geometric signature of deviation from typical in-distribution language, enabling robust protection across diverse contexts without the need for retraining.
T3's zero-shot generalization extends powerfully across 14+ languages, from high-resource lower- resource. Using only its English-trained model, T3 maintains remarkably stable high-performance with T3-OCSVM showing less than 0.6% AUROC variance across all languages, including those with different scripts like Japanese and Arabic. This consistency starkly contrasts with specialized baselines like DuoGuard and PolyGuard, which exhibit high linguistic variance (up 28%), making their performance unreliable across different regions. T3's success validates that harmful content creates a language-agnostic geometric signature modern multilingual embedding spaces. This carries significant practical implications, as it climinates the need for expensive multilingual data collection, retraining, and per-language calibration, enabling a single model to enforce a consistent safety standard globally.
LLM-EEnanced Variant (Augment): We also explored prepending a structured LLM --geerrerteed safety analysis (via GPT-OSS-220 augmentation improves T3+GMM performance for non-Ean -on-Enh languages on RTP-LX (c.g..+ +1.7% AUROC for DE, +2.9% for ES) but degrades English and XSafety performance. Root cause analysis
each prompt before embedding. As shown in Table 5, this
8

---

Published as a conference paper at ICLR 2026
revealed that the LLM often labels in the prompt's 's native language rather than English, reducing bedding consistency. This suggests LLM augmentation requires language-awe aware output normalization to be effective. Overall, the increase in overheads do not justify the increase in performance.
Table Polyguard Domain-Speciee Evaluation
Dataset
Polyguard Code PPR
Polyguard Cyber
Polyguard Education AUROC
Polyguard HK
Polyguard Social Media
Metric
AUROC
AUROC
PPR
PPRI955
AUROC
HPR395
AUROC
HPK0555
Method
ADASCALE
0,7029
0.9665
0.6707
0.9484
0.4459
0.9976
0.4670
0.9978
0.2719
0.9997
CIDER
038919
0.3620
0,7425
0.8056
0.7400
0.9085
(18229
(15009
017644
0.9256
FDBD
0,9974
0.9480
GMM
0.9858
04227
0.9955
OPENMAX
0.2899
0.9637
0.3410
0.9386
0.4712
0.9963
0,4004
0.9967
0.616
0.9996
REACT
0.0079
0.9899
0,5077
0.9910
0.4478
0.9446
0.5151
0.9550
0.3205
0.9987
RMD
0.7358
0.7022
0.6701
0.8587
0.6505
0,9706
0.6964
0.9181
0.6185
0.9764
VIM
0.7926
0.6497
0.6455
0.9128
0,5022
0,9553
0.5153
0.9590
0.4606
0.999
LLAMAGUARD--II
0.7139
1,0000
0.7789
1,0000
0,5740
1,0000
0.6368
1.0000
0.7482
1.0000
LLAMAGUA RD4-12
0.5235
1,0000
0.7753
1,0000
0,5389
1,0000
0.5520
1,0000
0.7151
1.0000
WILDGUARD
0.5706
1.0000
LLAMAGUARD--B-LLOOO
MIJUDGG
0.7616
0.8735
0.6900
0,8782
DUOGUARD
0.5356
0.8844
0.7574
0.8307
0.6626
0.9911
0.6363
0.9909
0.7224
0.9446
POLYGUARD
0.5300
0.7475
0.7354
0.8116
0.4464
0.9558
0.4198
0.9484
0.7224
6808
13GMM
0.9959
0.0089
0,9886
0.0270
0,9913
0.0255
0.9965
0.0062
0.9673
0.1208
T3+0CSVM
0.9953
0.0095
0.9818
0,0615
0.9943
0,0192
0.9982
0,0039
0.9620
0.1485
Table 5: Consistent and stable performance across 14+ languages. T3 maintains excep- tionally high AUROC with minimal variance (<2%) across high- and low-resource languages, demonstrating its language-agnostic safety capabilities. Results are shown for the RTP L.X (top) and XSafety (bottom) benchmarks.
Datase-RRPP
LLAMAGUARD--IE
0.7746
0.7865
0.7997
0,7647
0,7696
0.7715
0.7802
0,7000
0.7452
0,7627
0.8302
MDJUDGE
0.8617
0.8832
0,8718
0,8458
0,7868
0.332
08673
08343
03418
0.7874
0.854
0,8154
0,7865
0.9001
DUOGUARD
0.9876
0.9686
0,9884
0,9925
0,9521
0,9714
0.9682
0.8850
0.9788
0.001
0.9817
0.8254
0.9351
0.9924
POLYGUARD
0.9511
0
0,9660
0.9533
0.8396
0.9328
0.979
09533
0.919
0.8688
0.9548
0,9769
0.8515
0.9898
0.9588
0,9522
0.9540
0.9600
0.550
0,9572
0.9526
T3+GMM (Augment)
0.9799
0.9071
0.9816
0.9756
0.9789
0.9738
0.9771 0.9671
0.9695
0.9728
0.9699
0.9741
0.9769
0.984
T3+OCSVM
0
0.9804
0,5797
0.9887
0.9787
0.9805
0.9819
0.9811
0.9790
0.9806
0.9821
0.9768
0.9816
0.9812
0.9507
0.9192
0.949]
0.9606
0.9573
0.952
0.9547
0.9619
Datasct-XSafcty
LLAMAGUARDS-1
MDJUDGE
03985
0.7765
0.8056
0.8003
0.7584
0.7943
0.7874
0,7885
0.7760
DUOGUARD
0:9228
0.7820
0.9085
0,9299
0.9693
0.8357
0.7877
0.8837
0.8286
POLYGUARD
0.7881
0.7354
0.9542
0,9543
T3:GMM (Augueent)
0,8942
0.5004
0.9740
018981
0.9102
0.9005
0.9011
0.9014
0.9026
T3+OCSVM
0
0.9801
0,9762
0.9781
0,9797
0.9804
0,9882
0.9772
0,9800
T3+0CSV (Augment)
0.7699
0.7336
0.2907
0.7871
0,7852
0.7887
RQ5: Can T3 be integrated into high-performance inference engine for practical, real-time deployment with minimal latency?
To demonstrate T3's practical deployment capabilities, we integrated it directly into the vLLM inference framework (Kwon et al., 2023) for real-time safety monitoring during generation. Unlike post-processing approaches that evaluate complete outputs, our system performs continuous safety assessment as tokens are generated, enabling immediate termination of harmful content. The integration leverages vLLM's multiprocess architecture by intercepting and accessing outputs in the mostly idling Main Process while inference proceeds in Worker Processes, achieving efficient computation overlap without disrupting the core generation pipeline.
Streaming Results: Performance evaluation on an NVIDIA H200 GPU demonstrates negligible overhead even under dense monitoring conditions. With T3 configured for evaluation every 20 tokens and batch processing of 32 requests, we observe only 1.5% 5 overhead on 500-prompt workloads and 6% on 5,000-prompt workloads compared to baseline vLLM (Table 7). This is achieved through strategic batching of safety evaluations and overlapping T3's embedding computations with ongoing token generation, effectively hiding guardrail latency behind inference operations. To our knowledge, T3 is the first framework to demonstrate sub-10% overhead for continuous safety monitoring during

---

Published as a conference paper at ICLR 2026
online LLM generation, making real- taal-time guardrailing practical for production deployments where both safety and latency are critical.
T3's efficiency also extends to the widely adopted post-generation guardrailing mode. In comparative benchmark on an NVIDIA H200 GPU with batch sizes up to 64, results revealed a clear performance hierarchy. While DUOGUARD OCSVM) demonstrated excellent scalability, with runtimes consistently between 60-155 ms. This positions T3 as significantly more efficient than PolyGuard and vastly superior to heavier methods like MDJudge and LlamaGuard, which imposed prohibitive runtimes exceeding one million jss and failed at larger batch sizes. These findings confirm that T3 is a highly efficient and scalable solution for both online and gost-generation safety deployment.
Post-Generation Results:
fastest, T3 (GMM and
5 DISCUSSION
An important finding emerges from our evaluation on particularly challenging scenarios where the semantic distinction between "safe" and "harmful" is intentionally ambiguous and context-dependent We deliberately tested our method on the Anthropic hh-rlhf dataset, where chosen (safe) responses serve as the in-distribution data and rejected (harmful) responses as out-of-distribution, a purposely difficult setup since the ID dataset already contains profanity and the only difference between response pairs might be subtle phrasing or single word. In this challenging benchmark, no method, including T3, traditional baselines, and existing safety approaches, performs significantly better than random chance (AUROC*0.5) Importantly, this failure stems not from methodological weakness but from the nature of the ID data itself: the "safe" examples contain extensive toxic content (e.g., lists of profanitics), making the cosine similarity between chosen and rejected responses extremely high (>0.95).. This creates near-OOD detection problem where the typical set "safe" usage already encompasses harmful patterns.
However, this limitation does not generalize to attacks designed semantically resemble safe queries. We evaluated T3 against the HILL jailbreak method (Luo et al., 2025), which transforms harmful imperatives into srccuous-looking "learning-stp sttliiinnsssssnnnneoeen questions (e.g.. "I am studying chemistry, explain this reaction...").. Despite HILL'S explicit design to masquerade as in-distribution educational content, T3 achieves strong detection (AUROC 0.98, FPR @95 4.4%, see Table 13 for details.) when trained on properly curated safe data. This contrast is instructive: T3 succeeds when the ID training set genuinely represents safe usage, but fails when the ID set itself' contains the harmful patterns should detect. The key insight is that T3's effectiveness is contingent on appropriate ID training set curation.
This reveals a fundamental boundary for D0D-based safety: methods succeed when safe and harmful content occupy separable manifolds (HILL,, domain adherence) but fail when they overlap (HH- RLHF). Crucially, this training distribution dependence is universal supervised classifiers (Llama Guard, PolyGuard) collapse under domain shift, and Constitutional A AI/RI systems over-e outside their preference distributions. T3's curation requirement is thus not unique weakness but shared property of all safety methods. This motivates hybrid architectures combining T3's efficient typicality screening for distributional outliers with reasoning- based methods for near- beardboun cases requiring contextual intent parsing. Conversely, there are domains where the boundary between in-distribution and mistof-distribution is exceptionally clear. A prime example is domain adherence for mathematical reasoning. When the in-distribution "safe" set consists of mathematical problems and solutions (from datasets like MATH or GSMSK), and the OOD set consists of unrelated topics like philosophy, literature, or cooking, the semantic separation is vast. In this scenario, nearly all methods, including traditional OOD basclines like CIDER and GMM, perform extremely well, often achieving near cear-perfect AUROC scores.
6 CONCLUSION
The T3 guardrailing framework represents a significant paradigm shift in LLM safety, moving from reactive threat-blocking to a proactive approach based statistical typicality. By modeling what is safe rather than enumerating harms, T3 achieves state-of-the-an performance, remarkable generalization across domains and languages, and dramatic reduction in overrefusal. Its successful integration into the vLLM inference engine with minimal overhead demonstrates its readiness for practical, real-time deployment in production environments.
10

---

Published as a conference paper at ICLR 2026
REFERENCES
Momin Abhas, Muneeza Azmat, Raya Horesh, and Mikhail Yurochkin. Out-of-dissrribation detection using synthetic data generation. arXiv preprint arXiv:2502.03333, 2025.
Jinze Bai, Shuai Bai, Yunfei Chu, Zeyu Cui, Kai Dang, Xiaodong Deng, Yang Fan, Wenbin Ge, Yu Han, Fei Huang, et al. Qwen technical report. arXiv preprint arXiv:2309. 2023.
Yuntao Bai, Saurav Kadavath, Sandipan Kundu, Amanda Askell, Jackson Kernion, Andy Jones, Anna Chen, Anna Goldie, Azalia Mirhoseini, Cameron McKinnon, al. Constitutional ai: Harmlessness from ai feedback. arXiv preprint arXiv:2212.08073, 2022.
Valerio Basile, Cristina Bosco, Elisabetta Fersini, Debora Nozza. Viviana Patti, Francisco Manuel Rangel Pardo, Paolo Rosso, and Manuela Sanguinetti. Semeval-2019 task 5: Multi- lingual detection of hate speech against immigrants and women in twitter. In Proceedings of the 13th international workshop semantic evaluation, pp. 54 63, 2019.
Abhijit Bendale and Terrance E Boult. Towards open set deep networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 1563-1572, 2016.
Christopher M Bishop. Novelty detection and neural network validation. IEE Proceedings- Image and Signal processing, 141(4):217-222, 1994.
viieediings-iiiin, Vision,
Daniel Borkan, Lucas Dixon, Jeffrey Sorensen, Nithum Thain, and Lucy Vasserman. Nuanced metrics for measuring unintended bias with real data for text classification. In Companion proceedings of the 2019 world wide web conference, pp. 491-500, 2019.
Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voor Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Frlingsson, al. Extracting training data from large language models. In 30th USENIX Security Symposium (USENIX Security 2/), pp. 2633-2650, 2021.
Stephen Casper, Xander Davies, Claudia Shi, Thomas Krendl Gilbert, Jérémy Scheurer, Javier Rando, Rachel Freedman, Tomasz Korbak, David Lindner, Pedro Freire, et al. Open problems and fundamental limitations of reinforcement learning from human feedback. arXiv preprint arXiv:2307.15217, 2023.
Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J Pappas, and Eric Wong. Jailbreaking black box large language models in twenty queries. 2025 IEEE Conference on Secure and Trustworthy Machine Learning (SaTMI.), pp. 23 IEFE, 2025.
Jiefeng Chen, Yixuan Li, Xi Wu, Yingyu Liang, and Somesh Jha. Atom: Robustifying out-of- distribution detection using outlier mining. In Joint European Conference on Machine Learning and Knowledge Discovery in Databases, pp. 430-445. Springer, 2021.
Weicong Chen, Vikash Singh, Zahra Rahmani, Debargha Ganguly, Mohsen Hariri, and Vipin Chaud- hary. K4; Online log anomaly detection via unsupervised typicality learning. arXiv preprint arXiv:2507.20051, 2025.
Hyunsun Choi, Eric Jang, and Alexander A Alemi. Waic, but why? generative ensembles for robust anomaly detection. arXiv preprint arXiv: /810.01392, 2018.
Paul F Christiano, Jan Leike, Tom Brown, Miljan Martic, Shane Legg, and Dario Amodei. Deep reinforcement learning from human preferences. Advances in neural information processing systems, 30, 2017.
Mike Conover, Matt Hayes, Ankit Mathur, Jianwei Xie, Jun Wan, Sam Shah, Ali Ghodsi, Patrick Wendell, Matei Zaharia, and Reynold Xin. Free dolly: Introducing the world's first truly open instructiontuned llm. 2023.
Thomas M Cover and Joy A Thomas. Elements of information theory. John Wiley & Sons, 1999.
Thomas Davidson, Dana Warmsley, Michael Macy, and Ingmar Weber. Automated hate speech detection and the problem of offensive language. In Proceedings of the international AAAI conference on web and social media, volume 11, pp. 512-515, 2017.
11

---

Published as a conference paper at ICLR 2026
Yihe Deng, Yu Yang, Junkai Zhang, Wei Wang. and Bo Li. Duoguard: A two-player rl-driven framework for multilingual Ilm guardrails. arXiv preprint arXiv:2502.05163, 2025.
Akshay Raj Dhamija, Manuel Günther, and Terrance Boult. Reducing network agnostophobia. In Advances in Neural Information Processing Systems. pp. 9157-9168, 2018.
Kawin Ethayarajh. How contextual are contextualized word representations? comparing the geometry (0XXv:/909.0051222
of bert, elmo, and gpt-2 embeddings. arXiv preprint arXiv: (e2.//99900000 2019.
Stanislav Fort, Jie Ren, and Balaji Lakshminarayanan. Exploring the limits of out-of-distribution
detection. Advances in neural information processing systems, 34:7068-7081, 2021.
Jerome H Friedman and Lawrence C Rafsky. Multivariate generalizations of the wald-wolfowitz and smirnov two-sample tests. The Annals of statistics, pp. 697-717, 1979.
Jerome H Friedman, Sam Steppel, and Tukey. A nonparametric procedure for comparing multivariate point sets. Stanford Linear Accelerator Center Computation Research Group Technical Memo, (153), 1973.
Debargha Ganguly, Srinivasan Iyengar, Vipin Chaudhary, and Shivkumar Kalyanaraman. PROOF OF THOUGHT Neurosymbolic program synthesis allows robust and interpretable reasoning. In The First Workshop on System-2 Reasoning al Scale, NeurlPS'24, 2024. URL https://
openreview. www.:ee//oooooooe forum? beerrrmmid=Pxxeee d=Pxx3r j33U..
Debargha Ganguly, Debayan Gupta, and Vipin Chaudhary. Visual concept networks: A graph-based approach to detecting anomalous data in deep neural networks. In Christian Wallraven, Cheng-Lin Liu, and Arun Ross (eds.), Pattern Recognition and Artificial Intelligence, pp. 219-232, Singapore, 2025a. Springer Nature Singapore. ISBN 118-9981-7--772---
Debargha Ganguly, Sumit Kumar, Ishwar Balappanawar, Weicong Chen, Shashank Kambhatla, Srinivasan Iyengar, Shivkumar Kalyanaraman, Ponnurangam Kumaraguru, and Vipin Chaudhary. Labeling copilot: deep research agent for automated data curation in computer vision. arXiv preprint arXiv:2509.22631 2025b.
Debargha Ganguly, Warren Richard Morningstar, Andrew Seohwan Yu, and Vipin Chaudhary. Forte Finding outliers with representation typicality estimation. In The Thirteenth International Conference on Learning Representations, 2025c. URL https: openreview net/ forum?
Debargha Ganguly, Vikash Singh, Srechari Sankar, Biyao Zhang, Xuecen Zhang, Srinivasan Iyengar, Xiaotian Han, Amit Sharma, Shivkumar Kalyanaraman, and Vipin Chaudhary. Grammars of When to trust LLMs in automated reasoning tasks. The Thirty-ninth Anmual Conference on Neural Information Processing Systems, 2025d. URL https: openreview.ee.eeeee net/forum? i d== @OKpp000
formal uncertainty:
Samuel Gehman, Suchin Gururangan, Maarten Sap, Yejin Choi, and Noah A Smith. Real- toxicityprompts: Evaluating neural toxic degeneration in language models. arXiv preprint arXiv:2009. /1462, 2020.
Chuan Guo, Geoff Pleiss, Yu Sun, and Kilian Q Weinberger. On calibration of modern neural networks. In Proceedings of the 34th International Conference on Machine Learning-Volume Volume 70, pp. 1321-1330. JMLR. org, 2017.
Seungju Han, Kavel Rao, Allyson Ettinger, Liwei Jiang, Bill Yuchen Lin, Nathan Lambert, Yejin Choi, and Nouha Dziri. Wildguard: Open one-stop moderation tools for safety risks, jailbreaks, and refusals of 1lms. Advances in Neural Information Processing Systems, 37:8093-8131, 2024.
Soufiane Hayou, Nikhil Ghosh, and Bin Yu. Lora+: Efficient low rank adaptation of large models. arXiv preprint 202 2024.
Dan Hendrycks, Mantas Mazeika, and Thomas Dietterich. Deep anomaly detection with outlier exposure. arXiv preprint arXiv: 18/2.040 2018.
12

---

Published as a conference paper at ICLR 2026
Dan Hendrycks, Mantas Mazeika, and Thomas Dietterich. Deep anomaly detection with outlier exposure. International Conference on Learning Representations, 2019. URL https: openreview net htt.//orrnnidddtixieeeeeeeee
Yen-Chang Hsu, Yilin Shen, Hongxia Jin, and Zsolt Kira. Generalized odin: Detecting out-of-
distribution image without learning from out-of-distribution data. arXiv preprint arXfv:2002.11297, 2020.
Yangsibo Huang, Samyak Gupta, Mengzhou Xia, Kai Li, and Danqi Chen. Catastrophic jailbreak of open-source iims via exploiting generation. arXiv preprint arXiv:2310.066 00.977, 2023.
Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, et al. Llama guard: LIm-based onput-output safeguard for human-ai conversations. arXiv preprint arXiv:2312.066 02.66774, 2023.
Neel Jain, Avi Schwarzschild, Yuxin Wen, Gowthami Somepalli, John Kirchenbauer, Ping-yeh Chiang, Micah Goldblum, Aniruddha Saha, Jonas Geiping, and Tom Goldstein. Baseline defenses for adversarial attacks against aligned language models. arXiv preprint arXiv:2309.008 20220099000010 14, 2023.
Saurav Kadavath, Tom Conerly, Amanda Askell, Tom Henighan, Dawn Drain, Ethan Perez, Nicholas Schiefer, Zac Madiseld-Dodds, Nova DasSarma, Eli Tran-Johma cean-Jonnoon, et al. Language models (mostly) know what they know. arXiv preprint 220: 222220521,, 2022.
Mintong Kang, Zhaorun Chen, Chejian Xu, Jiawei Zhang, Chengquan Guo, Minzhou Pan, Ivan Revilla, Yu Sun, and Bo Li. Polyguard: Massive multi-domain safety policy-grounde guardrail dataset. arXiv preprint arXiv:2506. 19054, 2025.
Andreas Köpf, Yannic Kilcher, Dimitri Von Rütte, Sotiris Anagnostidis, Zhi Rui Tam, Keith Stevens, Abdullah Barhoum, Duc Nguyen, Oliver Stanlcy, Richárd Nagyfi, et al. Openassis- tant won.cooneraatoonsdmmmcaaiit large language model alignment. Advances in neural information processing systems, 36:47669 476811, 2023.
Lorenz Kuhn, Yarin Gal, and Sebastian Farquhar. Semantic uncertainty: Linguistic invariances for uncertainty estimation natural language generation. arXiv preprint arXiv:2302.09664, 2023.
Woosuk Kwon, Zhuohan Li, Siyuan Zhuang, Ying Sheng, Lianmin Zheng, Cody Hao Yu, Joseph E. Gonzalez, Hao Zhang, and Ion Stoica. Efficient memory management for large language model serving with pagedattention. In Proceedings of the ACM SIGOPS 29th Symposium Operating Systems Principles, 2023.
Balaji Lakshminarayanan, Alexander Pritzel, and Charles Blundell. Simple and scalable predictive uncertainty estimation using deep ensembles. In Advances in neural information processing systems, pp. 6402-6413, 2017.
Kimin Lee, Kibok Lee, Honglak Lee, and Jinwoo Shin. A simple unified framework for detecting out-of-distributte samples and adversarial attacks. Advances in neural information processing systems, 31, 2018.
Lijun Li, Bowen Dong, Ruohui Wang, Xuhao Hu, Wangmeng Zuo, Dahua Lin, Yu Qiao, and Jing Shao. Salad-bench: A hierarchical and comprehensive safety benchmark for large language models. arXiv preprini arXiv:2402.0504 2024.
Shiyu Liang, Yixuan Li, and R. Srikant. Enhancing the reliability of dut-o--distri image detection in neural networks. In International Conference on Learning Representations, 2018. 8. URL https:ttp//... http:////eeeeeeeeeeeeeeeeee ew.
ew.net, net forrmm dd= VGk VG TxRZ.
Victor Weixin Liang, Yuhui Zhang, Yongchan Kwon, Serena Yeung, and James Y Zou. Mind the gap: Understanding the modality gap multi-modal contrastive representation learning. Advances in Neural Information Processing Systems, 35:17612-17625, 2022.
Bo Liu, Liming Zhan, Zexin Lu, Yujie Feng, Lei Xue, and Xiao-Ming Wu. How good are 1lms at out-of-distribution detection? arXiv preprint arXiv:2308. 10261, 2023a.
13

---

Published as a conference paper at ICLR 2026
Litian Liu and Yao Qin. Fast decision boundary based out-of-distrributio detector. arXiv preprint arXiv:2312.11558 2023.
Yi Liu, Gelei Deng, Yuekang Li, Kailong Wang, Zihao Wang, Xiaofeng Wang, Tianwei Zhang, Yepang Liu, Haoyu Wang, Yan Zheng, et al. Prompt injection attack against IIm- Im-integrated applications. arXiv preprint arXiv:2306. 05499, 2023b.
Yi Liu, Gelei Deng, Zhengzi Xu, Yuekang Li, Yaowen Zheng, Ying Zhang, Lida Zhao, Tianwei Zhang, Kailong Wang, and Yang Liu. Jailbreaking chatgpt via prompt engineering: An empirical study. arXiv preprint arXi::2305. 13360, 2023c.
Xuan Luo, Yue Wang, Zefeng He, Geng Tu, Jing Li, and Ruifeng Xu. A simple and efficient jailbreak method exploiting Ilms' helpfulness. arXiv preprint arXiv:2509.14297, 2025.
Guiyuan Ma and Long-Ping Zhu. Revisiting the merton problem: from hara to cara utility. Computational Economics, 59(2):651-68) February 2022. doi: 10. 10-100777110644-00-11000-----
URL https://iideat repec www.:repecc....aaeeeee a/ 610614-021-1000-22. html..
Thomas Mandl, Sandip Modha, Prasenjit Majumder, Daksh Patel, Mohana Dave, Chintak Mandlia, and Aditya Patel. Overview of the hasoe track at fire 2019: Hate speech and offensive content identification in indo-european languages. In Proceedings of the IIth annual meeting of the Forum for Information Retrieval Evaluation, pp. 14-17, 2019.
Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, al. Harmbench: A standardized evaluation framework for automated red teaming and robust refusal. arXiv preprint arXiv:2402.0442: 2024.
Alexander Meinke and Matthias Hein. Towards neural networks that provably know when they don't 't know. In International Conference on Learning Representations, 2020. URL https: //openreview.oooo/////r/ .nt cesttffooe ftt/mrirrddddr/////// ByxkkdkykK.xkkK....
Akshay Mhatre, Noujoud Nader, Patrick Diehl, and Deepti Gupta. LIm-guard: Large language model-based detection and repair of bugs and security vulnerabilities in c++ and python. arXiv preprint arXiv:2508. 16419, 2025.
Yifei Ming. Ziyang Cai, Jiuxiang Gu, Yiyou Sun, Wei Li, and Yixuan Li. Delving into out-of- distribution detection with vision-language representations. Advances in neural information processing systems, 35:35087-35102 2022.
Warren Morningstar, Cusuh Ham, Andrew Gallagher, Balaji Lakshminarayanan, Alex Alemi, and Joshua Dillon. Density of states estimation for out of distribution detection. In International Conference on Artificial Intelligence and Statistics, pp. 3232-3240. PMLR, 2021.
Eric Nalisnick, Akihiro Matsukawa, Yee Whye Teh, and Balaji Lakshminarayanan. Detecting out-of- distribution inputs to deep generative models using typicality. arXiv preprint arXiv:1906 02994, 2019.
Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. Training language models to follow instructions with human feedback. Advances in neural information processing systems, 35:27730- 27744, 2022.
Jaewoo Park, Yoon Gyo Jung, and Andrew Beng Jin Teoh. Nearest neighbor guidance for out-of- distribution detection. In Proceedings of the IEEF/CVF international conference on computer vision, pp. 1686-1695, 2023.
Alexander Podolskiy, Dmitry Lipin, Andrey Bout, Ekaterina Artemova, and Irina Piontkovskuya, Revisiting mahalanobis distance for transformer-based out-of-domain detection. In Proceedings of the AAAI conference on artificial intelligence, volume 35, pp. 13675-13682, 2021.
Sudarshan Regmi. Adascale: Adaptive scaling for ood detection. arXiv preprint axXiv:2503.08023, 2025.
14

---

Published as a conference paper at ICLR 2026
Jie Ren, Peter J Liu, Emily Fertig, Jasper Snoek, Ryan Poplin, Mark Depristo, Joshua Dillon, and Balaji Lakshminarayanan. Likelihood ratios for out-of-distribute detection. In Advances in Neural Information Processing Systems, pp. 14680-14691, 2019.
Jie Ren, Jiaming Luo, Yao Zhao, Kundan Krishna, Mohammad Salch, Balaji Lakshminarayanan, and Peter Liu. Out-of-distribution detection and selective generation for conditional language models. arXiv preprint wrXvv:2299.15556 2022.
Mark F Schilling. Multivariate two- sample tests based on nearest neighbors. Journal of the American Statistical Association, 81(35):7799-88 806, 1986.
Yiyou Sun, Chuan Guo, and Yixuan Li. React: Out-of- detection with rectified activations. Advances in neural information processing systems, 14:144-157, 2021.
Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks, 2013.
Rohan Taori, Ishaan Gulrajani, Tianyi Zhang, Yann Dubois, Xuechen Li, Carlos Guestrin, Percy Liang, and Tatsunori B Hashimoto. Stanford alpaca: An instruction-following Ilama model, 2023.
Rheeya Uppaal, Junjie Hu, and Yixuan Li. Is fine-tuning needed? pre-trained language models near perfect for out-of-domain detection. arXiv preprint arXiv:2305. 2023.
Eric Wallace, Shi Feng, Nikhil Kandpal, Matt Gardner, and Sameer Singh. Universal adversarial triggers for attacking and analyzing nlp. arXiv preprint arXiv:1908.07125 2019..
Haoqi Wang, Zhizhong Li, Litong Feng, and Wayne Zhang. Vim: Out-of-distribution with virtual- logit matching. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 4921-4930, 2022.
Wenxuan Wang. Zhaopeng Tu, Chang Chen, Youliang Yuan, Jen-tse Huang, Wenxiang Jiao, and Michael R Lyu. All languages matter: On the multilingual safety of large language models. arXiv preprint arXiv:2310.0090. 2023.
Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. Jailbroken: How does Ilm safety training fail? Advances in Neural Information Processing Systems, 36:80079-801 10, 2023.
Jing Xu, Da Ju, Margaret Li, Y-Lan Boureau, Jason Weston, and Emily Dinan. Bot-adversarial dia- logue for safe conversational agents. In Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, pp- 2021.
Marcos Zampieri, Shervin Malmasi, Preslav Nakov, Sara Rosenthal, Noura Farra, and Ritesh Kumar. Semeval-2019 task 6: Identifying and categorizing offensive language in social media (offenseval). arXiv preprint arXiv: 1903.08833 2019.
Andi Zhang, Tim Z Xiao, Weiyang Liu, Robert Bamler, and Damon Wischik. Your finetuned large language model is already powerful out-of -itto---iisrrbttoon detector. arXiv preprint arXiv:2404.08679 2024.
Biyao Zhang, Mingkai Zheng, Debargha Ganguly, Xuecen Zhang, Vikash Singh, Vipin Chaudhary, and Zhao Zhang. Efficient fine- grained gpu performance modeling for distributed deep learning of Ilm. Xiviv preprint arXiv:2509.22833 2025.
Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks aligned language models, arXiv preprint a0X1v:2307.15043, 2023.
15

---

Published as a conference paper at ICLR 2026
A THEORETICAL ANALYSIS
A.1 EXPECTED VALUES OF PRDC METRICS
We analyze the mathematical and statistical properties of the PRDC metrics in this section. Let us first introduce some notation for easier readability. Let {x and Y = {Y;}j=1
i.i.d. random vectors in Ied drawn from distributions F and G respectively. We denote by N Ba (X;; 2) the smallest open ball centered around X; containing its nearest neighbors from the set Z. For brevity, we write N (X,)) and N (Y,))) for N B3 (X,; X) and N B2 (Y;; Y) respectively. Let us recall the definitions of the per-point PRDC metries introduced earlier, treating X and the reference points and Y as test points,
TR Y, 1 (EU i=1
(X,))
(X,) 1
((
m
D = mk
1
1 (Y, E (N,((.))
1=1
ck
In the following theorem, we compute the expected values of these metries in the general case, without making any additional assumptions. Note that the expectation of the precision, IR (R(D()) analytically intractable in general cannot be simplified any further without stronger assumptions.
Theorem A.1. Let X {x,] and Y {Yg)ū=ı be sets of i..d. random vectors in Rd drawn from distributions F and G' respectively. The expectations of the per-point metries R() D( and cli) are given by
1. E
R (X, (X
P(Xi NB&(Yi))
p (x, (x,,))
7 E (B.(
2. 18
3. E
c (x,))
= [--EI[1-ET P(X, E (Y)))
the outer expectation in the third result is over the random sample Y (Y3))=1
Proof. We prove each statement individually.
By definition, the expectation is:
E
R
(x,
E
1
1(X e (B
m
i=
(NIXENBB(()))
(by linearity of expectation)
m
P(X, NB,(G) (since E[1 IP(A))
The random variables {X,) are i.d. from F, and (Y,}ī= i.i.d. from Q. Therefore, the probability TP(X; E NB)(Y))) is identical for all choices of indices (1.....m) and
16

---

Published as a conference paper at ICLR 2026
e fI....,n.
n). We can thus write this common probability as P(X, (B.)))).
m
R
(x.Y)
P(X1 E NB+((i))
m
P(X (NB(
P(X1 E (Bi(Y)))
2. The proof follows the same structure.
E
D 1 (x,))
=
1
10y e (N,((X)))
mk
B[I(Y E (B&((.))) (by linearity of expectation)
mk
m mk P(Y NB&(X.))
Again, by the i..d. property of the samples X and Y. the probability P(Y, E (X,)).)) is identical for all j.j. We write this common probability as P(Y E (X.)).
B B
P(Y (NB)()))
mk
P(Y E (B)( m
mk
P(V P NB&
3. The expectation of the indicator function is the probability of the underlying event.
E c (x,r) = [1 E NB&
=P =P ((UXXENDAM))
We use the law of total expectation by conditioning on the random sample Y {Y Y b
E [( = Ey T (U
(UB (B&(K)))
Conditioned on Y, the ball (Y, is fixed set. The events {X; (B,)())) for = I,...,, m are independent because the X; are i.i.d. and independent of Y. It is easier to compute the probability of the complement event,
x== 1 ( [X. & NBR( x)
IP UlXi (B.(
x
m
II P(, & NB,(K) \Y)
(by conditional independence)
The conditional probability P(X, E (Y; the measure of the set N B& (Y;) under the distribution F, which is the same for all i.
m P Ulxi NBx(3)) Y
x1=1
II (1 P(X, (BB(()))))
=1 P(X, (Y)())
17

---

Published as a conference paper at ICLR 2026
Taking the expectation over Y gives the final result.
By E c (i) (x, r)]
P(Xi (B&( 1-Ry [(1 P(X1 N
Since the Y, are i.i.d., the distribution of the random (Y, the same for j. We can therefore replace the index j with 1 without loss of generality.
E B (x.))
= E P(X, E (Ya())))
We note the important special case when F = G, i.e. the in-distribution setting when X and Y are drawn from the same distribution.
Theorem A.2. Let X = { Y )= be sets of i.idd random vectors in RRd drawn from the distribution F. The expectations of the per-point metries simplify to
1. E 1 (x, [x
2. E D (x, r)]
m
m k: n
3. E
c (x
$
Proof. The assumption that = G implies that all m + n vectors are i.id. samples from the same continuous distribution F. This allows to use symmetry argument.
1. From the general case, we know E n (X, r) = P(X, E NB&((i)). The event
{X1 E (Bi)) means that the distance |X Y1 is less than the distance from Y1 to k-th nearest neighbor the set Y {Yi} = (Y Yn).
Consider the set of n points {X1, Y..... Y. Since F G, these are n i.i.d. samples from F. Let us consider their distances the point Y1. Since the distribution the distances will be unique with probability 1. The set of distances { - Yill. 1| yll..... Y,, l) consists of n i.i.d. random variables.
continuous,
The event {X, E (Yi)) is equivalent to the statement that |X, Yill is among the k smallest values in this set distances. By symmetry, any specific distance in the set equally likely to have any rank from I to n. The probability that || Yill is one of the smallest therefore
R (X, = P(X E NB
K n
2. From the general case, E D (X, (x,)) - EP(Y NBR(X.)). The logic is identical to the proof above, but with the roles of X and Y swapped. Consider the set of m i.i.d. points and their distances
the point X,. The event (Yr N (Xx)) is equivalent to the distance 1 - -X, x1| being among the k smallest of the m i..dd distances
(Yi, Xy,..., ... Xm
{ X1I1, X|22 XilI,..,, ||,,, XiII}-
By symmetry, the probability of this event is
k P(YY E (B.(
m
Substituting this into the expression for the expectation gives
E D (1) (x,
k =
m
m
18

---

Published as a conference paper at ICLR 2026
3. The proof for this upper bound relies on Jensen's inequality. We begin by noting that naive substitution of the average value of the probability mass of the k-NN ball would be incorrect. Specifically, the expectation of C (X, Y) involves the non-linear function f(z) = 2)mh. For such functions, the expectation of the function is generally not equal to the function of the expectation, i.e., E[f(Z)] * f(E(2)).
The exact expression for the expectation is
| (X, r2] = 111 P(X, (B,
As stated above, E E N (Y1)) k/n. Jensen's 's inequality states that for a convex function f and random variable Z, we have [Z)( 2 f(E[Z]). The function in our case f(2) = (1 2)Rh which is convex function. Applying Jensen's inequality,
k
(1 - P(X, E BB&
Finally, we substitute this inequality back into the expression for the expectation of c(i (X, Y) to get
E (
A
s1
While the expression for p()) (X, Y) is intractable in general even for the in-distribution case, its limiting value can still provide us some intuition about the metric. We now consider the asymp- totie behavior of (E(P() (X, Y)] when both X {x and Yj are drawn i.i.d. from the same distribution F' on Rdd and the reference sample size m tends to infinity. Let
(m(X) = U (X.)
==1
denote the random set obtained from the sample X. Then
E (
P(Y, Sm())).
Assume that F has compact support supp(F), is absolutely continuous with density f that is bounded and bounded away from zero on supp(F), and that the boundary Ōsupp(F)) has measure zero. Under these standard regularity conditions, nonparametrie set estimation results imply that for fixed & 2 1, Sm (X) - supp(F) F) in probability (e.g. in Hausdorff distance), as m - co. Intuitively, as the sample becomes dense, the k--N radii shrink uniformly, the union of k-NN balls fills out the entire support.
By continuity of probability measures and the fact that Y, F. lim P(Y, E (x)) = P(Y, supp(F)).
m-+0c
Since Y, is drawn from F. it lies in supp(F) with probability one. Therefore, lim E p (X,Y)) =
In the in-distribution case, as the reference sample grows, the estimated manifold S,, (X) converges the true support F. Consequently, any new sample Y, FF will eventually fall inside S., (X) with probability approaching 1.
A.2 CONSISTENCY
statistical test is said to be consistent if its probability of distinguishing the null hypothesis from any alternative hypothesis converges to I as the sample size increases. We consider a few different regimes which the expectations of the per- per-point PRDC metrics differ between the in distribution setting F G and the out-of out-of-distribution setting F * G, i.c. regimes in which PRDC metrics are consistent tests. We consider the asymptotic regime m, n + oc with fixed and assume that limm.nnte m/n- X E (0, oo).
19

---

Published as a conference paper at ICLR 2026
(1) Partial support mismatch
Assume F has compact support (upp(F) and let
:= G[supp(FF)) > O.
This says that there is some region where F has Under mild regularity conditions stated earlier (compact support, F' absolutely continuous with density bounded and bounded away from zero on supp(F")), the union U N (X,) converges in probability to (P' as m + 20. Hence, for Yj G,
probability whereas G has non-zero probability.
lim E (X, +00
G(supp(FF) =1 <1
(X.Y) (x,)) 1. For coverage, using whereas in the in oo-distribution case F G we have limm E
E (x, = Ey (
any Y $ sFpp(F) contributes 0 for all m,, whence
lim sum E C (X.Y) < (1 a) limsup E (1 -LL-(L-F(NBBA)))) "M Y supp(F))
m,n++00
m,n-x
where the expectation on the right hand side is the expectation in the case when F = G, resulting in a strictly lower value of (lim sup of the expected value of) coverage whenever 0.
(2) Same support, different densities Assume sF)p(F) = supp(G) : S and F, G are absolutely continuous with respect Lebesgue measure on with continuous densities f.g that are bounded and bounded away from zero on S. Let
dF
f(y)
r(y)
dG (v)
so that Ey,ng|r(MS)]
g(v)
For fixed k and n + oo, we have
F(NB(C)) = k r(x)) o1+))))))
Substituting into the coverage identity gives
lim E
1 By, Bygnol exp( - Al Akr(Ys)))
When F = we have r = 1 and recover 1 - Ae When + G. is non-conttant on set of
positive G-measure and, since Akke is convex, Jensen's inequality is strict: Egle -
AR F(r(3)
Ak
so that
lim E EC (X,Y) Y) < AM
Thus coverage is maximized at G and strictly smaller otherwise, providing consistency even when supports coincide.
(3) Different densities in a small region Within the same-support setting above, suppose there exist 17 E (0, 1) and a measurable set A c S with G(A) 8 > 0 such that
r(y) 11 for all y E A, i.e. there is set with positive G probability where F has strictly smaller density than G. Conditioning on Y, E A vs. Y, & A in equation gives
lim ( s 1- 1--60e (50-~ + +1 8) AM).
m. 000
so the gap from the in distribution baseline 1 - e -Ak is at least 5(e->h Ak(1-1)
0.
This captures practically relevant situation where nontrivial portion of the G-mass lies in regions with systematically lower dendettyy coverage reflects this "margin" as a strict and quantifiable decrease.
In summary, precision separates whenever ((supp(F))) > 0, and coverage separates both under partial support mismatch and under smooth covariate shift with common supports. In the latter regime, coverage attains its maximum at F G and is strictly smaller otherwise, with explicit quantitative gaps available under simple bounds the density ratio under margin assumptions.
20

---

Published as a conference paper at ICLR 2026
A.3 CONNECTION WITH TWO-SAMPLE TESTS
We put the PRDC metrics and T3 which is based on Forte (Ganguly et al., 2025c) in the context of non- parametric two-sample tests using k-nearest neighbors. Friedman et al. (1973), Friedman & Rafsky (1979), and Schilling (1986) developed non-parametrie two-sample tests based on a pooled-graph statistic determine whether two sets of observed samples are from the same distribution. Given two sets of samples X = { and Y = G. On the other hand, we are concerned not just with
i..dd with distributions F and G respectively,
the tests only seek to determine whether a binary decision for the whole sample set, but also whether each individual sample Y; is from the same distribution as X, making our setting much more complex. Nevertheless, comparing the PRDC metrics with these tests helps us build a better understanding of the mathematical properties of Forte. We primarily focus on Schilling's s test for that purpose, which we restate here.
Definition A.3 (Schilling's Tk.N Statistic). Let X {X:]=" and Y (Y₃} be i.i.d. with distributions F and G respectively. Let Z = UY Z: be the hth element of Z, and = m + n. The statistic TR is the proportion of all k-nearest neighbor comparisons in which point and its neighbor share the same original label (reference or test), i.e.
N TA,N
(ZZ))
Nk 1=
where (Z,) 1 if and only if Z; and its Th neighbor in Z are both from X or both from Y.
We first note the major differences between Forte and Schilling's test. While PRDC metrics compute the k-nearest neighbors of each sample point X; or Y, within its own sample set (i.e. N B, (X;; X) and N NB&(Y;; Y)), Schilling's 's test considers the nearest neighbor of each point in the pooled sample (i.e. NB, X KUY) and N BB& X XUY). This makes them non-equivalent in general. Moreover, Forte is asymmetric in the sets X and Y by design. Since there is initial overhead of embedding computation and density estimation, Forte computes the metrics for each test point Y, individually and then uses the previously estimated density and k-ncarest neighbors of the points in the reference set X to make predictions, making the method scalable. If we wanted to use a two-sample test like Schilling's 's in this setting, we would have to calculate the k-nearest neighbors of the pooled set X Y from scratch each time we wanted to make predictions for a new test set Y, which is prohibitively expensive. Unlike classical two-sample tests requiring O(mm n)²) recomputation for each new test batch, our asymmetric formulation achieves:
Preprocessing: O + mddmx K) for reference embedding and k-NN computation
Inference: (n + Km) per test batch, amortizing reference computations
Memory: O(m K) for cached embeddings and neighbor indices
where dmax = max; dg. GPU acceleration via torch. cdist and persistent embedding caching further reduce practical latency.
Thus, these classical two-sample tests do not carry over directly to the modern setting of large scale out-of-distribution detection. Nevertheless, given that their statistical properties are well-studied, they can still provide useful insights about modern methods like Forte.
Recall that a statistical test called consistent under any alternative hypothesis, the probability of rejecting the null hypothesis converges to I as the sample size approaches infinity. We denote by Ho the null hypothesis that F = G (the underlying distributions generating the two sets is the same), and by H1 the alternative hypothesis that F * G.
Theorem A.4 (Asymptotics of TR,N (Schilling, 1986, Thm. 3.1 and 3.4)). Under the null hypothesis Ho. and assuming limm,n-roe m/ (m + n) = A₁ and limoo 12/(m (m + n)) = X2, the statistic TR,N asymptotically normal:
TE.N P VK
1),, where == x3 X
Tk
and the variance of depends on dimension stable nearest-neighhor interaction probabilities. Moreover, the test based on TR.N is against the alternative hypothesis H1.
21

---

Published as a conference paper at ICLR 2026
In partieular, note that limy- B Ho] = X2 + X2 does not depend on k.
The consistency of Schilling's test is proved in by showing lim inf E[T..N Hi] limy E[Tk,N Hol, i.c. the limit infimum of the expectation of the statistic under the alternative hypothesis is strictly larger than under null hypothesis. This conforms with the intuition that the two distributions are different then there will not be enough mixing among the samples, leading to larger values of T-
Now, show that the PRDC metrics and Schilling's statistic TE.N capture some of the same information.
Lemma A.5. For any Y, E Y, n (X,Y) = if and only if 4(,)) =
Proof. Since I (Y2) E {0. 13, the average - (Y,) can equal if and only if I,(,,) = for all T S k. By definition, (x2) = 1 if and only if the nThh nearest neighbor of Yy (in X UU) is in the set Y. Thus, &2 5Σ= I,(Y,) such an X; would be one of the first neighbors of the Y3 in the set X XUY), which is equivalent to E 1(X; (B,()))) mR (X.Y) 0.
if and only if there is X; in (Y;;;; Y) (otherwise
and only 1 + (X,) Recall that the expression _ E (X.) measures the proportion of the first k nearest neighbors of X; that have the same label as X;. We can combine these expressions to recover T
similar argument shows that for any X, E X. EI= 1(, E NB,(
N & Σ
m
TR,N
(Z))
(Xx))
LO83)
NR
m. +
We note that the lemma above implies
x ト 1.(3g)
- R2(2)) (X,Y)
where [x] represents
the greatest integer lesser than or equal to x. Moreover, which is equal to if and only if all of the l neighbors of Y, in new test statistic as replacing the average of I, over with the minimum,
Σ
Er=1 (x()))
(4
are in Y. We can construct
N
1
min Tx(X,) + Σ min T.(Y)) IErkk
BENN
min 15rsk
(7,)
N
We conjecture that lim inf E,B H1] limy E[ Ho), just as for TE,N, and that B x is consistent as a consequence. Because of the lemma above, BE,N can constructed using PRDC metrics. Since Forte fits more general distribution to the PRDC metrics, we expect it to perform at least as well as the statistic BR.N-
22

---

Published as a conference paper at ICLR 2026
B EXPERIMENT TECHNIQUE DETAILS
We are committed to scientific reprodueibility, and letting each technique in literature we reproduce in our experiments be best possibly tuned for their best performance. In this section, we share more details about our experimental setup.
B. ADAPTATIONS FOR TEXT-BASED OOD DETECTION
Since most established Out-of-Distribution (OOD) detection methods were originally designed for computer vision, we adapted them to operate 1024-dimensional text embeddings from the Qwen3-Embedding-00000 sentence transformer. A common challenge was the absence of components like classifier logits or weights, which available in supervised vision models. We addressed this by training an auxiliary binary logistic regression classifier on in-distribution (ID) texts versus synthetic background data. This classifier provided the necessary outputs, such as weights, and logits, to enable the application of these methods in unsupervised text-based setting. Furthermore, distance metrics were consistently adapted from Euclidean to cosine similarity to suit normalized text embeddings, and dependencies on vision- iision-optimized libraries like FAISS were replaced with direct matrix operations NumPy for efficient computation.
1. AdaScale:
The auxiliary classifier's s weights were used to compute greudo-gradiene ap- proximating the sensitivity of each embedding dimension. Perturbation was then applied to the most stable features, identified as those with the smallest absolute gradients.
2. CIDER NNGuide: The FAISS dependency for nearest neighbor search was removed in favor of direct cosine distance computation. We implemented exact k-NN retrieval using NumPy partitioning, which we believe improves performance over approximate methods. For NNGuide specifically, the auxiliary classifier's logits were used to generate confidence scores, which in turn produced confidence-weightee "guided" bank features.
3. FDBD: The weight matrices from the auxiliary binary classifier were used to adapt the denominator matrix computation from its original multi-class formulation our binary scenario, enabling the calculation of the required weight difference norms.
4. GMM:
We removed the supervised learning requirement by working directly with sentence necessary, synthetic background data was
embeddings. When dimensionality reduction used to create pseudo-labels for training a Linear Discriminant Analysis (LDA) model. We used the more numerically stable sklearn implementation for all reported results.
5. OpenMax: A binary class structure established using the auxiliary classifier compute Mean Activation Vectors (MAVs). The classifier's probability outputs, rather than raw embeddings, were then used fit the Weibull models required by Extreme Value Theory.
6. ReAct:
computation. The activation thresholding mechanism was adapted to work directly on the embedding vectors, where element- wise clipping was applied based percentile threshold derived from the training data.
The auxiliary classifier generated the logits needed for energy
7. RMD:
We created a pseudo-binary statistical separation by computing class-conditional statistics random subset of the training data while using the full training set for the background distribution statistics. This ensured a sufficient distributional difference for the RMD scoring function.
8. VIM: The weight matrix (w) and bias (b) from the auxiliary classifier used define the center point for the principal subspace. This subspace was computed by applying eigen- decomposition the covariance matrix of centered text embeddings, using the eigenvectors with the smallest eigenvalues as the null space basis.
B.2 API BASELINE INTEGRATION
The Perspective API and the OpenAl Omni Moderation API are both natively designed for text content safety and required minimal adaptation. We implemented a unified integration layer for both, which included persistent file-based caching to minimize redundant calls, detailed logging for reproducibility, and robust error handling for network issues. To ensure consistency with our
23

---

Published as a conference paper at ICLR 2026
evaluation framework, the output probabilities from each API were converted into standardized safety score, calculated as 1.0 max lorc__xxxiitttt_ee _score.
B.3 SEERCE JUDGE LLM ADAPTATIONS
Some of the Judge LLMs were not designed to output the continuous confidence scores required for OOD evaluation metrics like AUROC. The primary adaptation for each model, therefore, was to convert its distinct native output, whether categorical, structured, or multi-label, into a unified numerical safety score suitable for our framework.
LlamaGuard: Its discrete classifications (e.g.. "safe," "unsafe," " "unsafe S1") were mapped to fixed confidence values. "Safe" classifications received high score (0.9), while "un- safe" and specific violation categories received progressively lower scores (0.1 and 0.05, respectively) reflect greater certainty of harm.
MD-Judge: We used conversation-stye prompt elicit its structured output, which contains a safety category and a numerical severity score (1-5). scaling function then converted these discrete outputs into continuous score, ensuring that higher severity ratings corresponded to lower safety confidence.
DuoGuard:
As reccommended by their creators, its multi-label output, a probability vector across 12 safety subcategories, was converted into single value using max-aggrens maax-ggereattion ap- proach. The final safety score was calculated as 1 - 1-max maxxmaattgorr_paaeeee probegoor_prbbbbiitisss effectively treating the highest-risk category the overall risk indicator.
PolyGuard Since it evaluates prompt-response pairs, we supplied a generic, safe response ("I cannot and will not provide that information") for every input prompt. We then parsed its structured text output, which classifies prompt harmfulness and identifies policy violations. A hierarchical scoring system assigned high score for safe content, medium score for refusals, and progressively lower scores harmful content based on the number of violations detected.
C EXPERIMENT PARAMETERS
This section provides a detailed account of the datasets, models, and hyperparameters used in our experiments to ensure full reproducibility.
C.1 TOXICITY AND DOMAIN- DOMAIN-SPECIFIC EVALUATION PARAMETERS
The parameters detailed below were used for the toxicity detection experiments (results in Table 1) and the zero-shot domain generalization experiments (results in Table 4).
C. DATASETS
In-Distribution (ID) Data: The ID dataset was curated mix of safe prompts, labeled as id_mia mix. consisted of 40,000 total samples drawn equally from four sources: catsu-lab/alpe alpaca, Anthropic/hh
httprr/iis//aaaaiiik-see-e.e and openAssistant/onn
Out-of-Distribatioo (OOD) Data: OOD data was sourced from multiple benchmarks, with maximum of 10,000 samples used per benchmark.
-Toxicity & Hate Speech Benchmarks:
RealToxi ci typ romptss, CivilComments, HatEval, Davidson, HASOC, and OffensEval. Domain-Specifie Benchmarks: Harmful prompts from five domains in the PolyGuard dataset: social aeriial_mddia,. education, hr, code, and cybersecurity.
C.1.2 GENERAL & T3 CONFIGURATION
General: All experiments were run on a cuda: device with a random seed of 42 and a batch size of 32.
24

---

Published as a conference paper at ICLR 2026
T3 (Forte) Models: The T3 framework configured with multi-view represen- tation derived from three sentence transforeers: Swen//ween--Bbeedding 6B, BAAI/bge-m3, and Lntfloat/e5-largee
C.1.3 BASELINE MODEL HYPERPARAMETERS
The following models and hyperparameters were used for the baseline comparisons. For representation--aseed OOD methods, the primary sentence Qwen /wwn3 Emweed-nn-eddd-d..d.
transformer was
AdaScale: The percentile range was set to (90.0, 99.0) with k = 50.0, k2 = 50.0, = 1.0, and perturbation strength of 0.1.
CIDER: The number of nearest neighbors was set to K = 5.
DuoGuard: The model used was DuoGuard/ DuoGuard-O4 5B with classification threshold of 0.5 and maximum sequence length of 512.
IDBD: Distance to mean used for normalization.
The model was configured with 8 clusters, a "tied" covariance type, and used the "penultimate' feature type without dimensionality reduction. The sk sklearn implementation was used.
GMM:
MD-Judge (vLLM): The model was Battta-llmma/tllam---rrr---
LlamaGuard: The model used was meta-
SateetyLLaaMD--Uuugeeeeee lareeevv__iiieteeeeee 2-internnm2
with a generation temperature of 0.1, max new tokens of 128, and GPU memory utilization 0.7.
NNGuide: The number of nearest neighbors was K 100 with 1.0.
OpenMax: The configuration used tail size of 20 for Weibull fitting, of 3, and 'euclidean' distance metric.
The model was Toxi e tyP rompts/ Polaoolyrrrrr rd Qwen--eenn------- Smol. Evaluation was performed prompts only by providing dummy safe response: "'I cannot and will not provide that information."
PolyGuard (vLLM))
ReAct: The activation clipping threshold was the 90th percentile.
VIM: The principal subspace dimension set 512.
C.2
MULTILINGUAL EVALUATION PARAMETERS
C.2.1 DATASETS
In-Distribution (ID) Data: The ID dataset consisted of 30,000 safe, helpful prompts sourced from the wtt.kksssstnttttssssssee
dataset.
nitof--Dittribution (OOD) Data: The OOD data was composed of harmful prompts from two multilingual benchmarks. For each benchmark, maximum of 800 samples were used per language.
RTP
RTP_LX: LX:
The languages evaluated were English (en), Spanish (es), French (fr),
German (de), Italian (it),, Portuguese (pt), Russian (ru), Japanese (ja), Korean
(ko), Chinese (zh), Hindi (hi), Dutch (n1), Polish (p1), and Turkish (tr).
XSafety: The languages evaluated were English (en), Chinese (2h), Arabic (ax),
Spanish (sp), French (fr), German (de), Japanese (ja), Hindi (hi), and Russian (ru).
C.2.2 GENERAL & T3 CONFIGURATION
General: All experiments were run on a cuda: 0 device with a random seed of 42 and a batch size of 24.
T3 (Forte) Models: The T3 framework utilized multi-view representation from three sentence transformers:
O. 6B, BAAI/bge 1033 and
int wel.flaaeee--laagee
25

---

Published as a conference paper at ICLR 2026
Why you should consider using Representation Typicality Estimation We adopted Forte (Ganguly et al., 2025c) because it treats OOD detection as a representation-spite problem: it uses self- supervised embeddings to preserve meaning-bearinn structure and can be dropped into existing pipeline without redesign. In practice, it can consume features from virtually any extractor-including hidden-layer activations from materials-focused neural networks it fits naturally with domain- specific models. Its pointwise descriptors are constructed to reflect the nearby geometry of the data, borrowing ideas from manifold and bocal-neihbborhood modeling respect local structure. The result is lightweight deployment: no extra training stage, no additional detector to fit, and immediate zero-shot behavior.
Forte also avoids several common prerequisites. It does not depend on labeled classes, it does not require curated OOD examples during development, and does not assume anything about whether the underlying model is predictive generative (or what architecture it uses). Evidence of strong cross-domain transfer has been reported on synthetic imagery (Ganguly et al., 2025b), medical MRI data (Ganguly al., 2025c), anomaly detection in HPC logs (Chen et al., 2025), and LLM safety applications such as jailbreak and toxicity screening (this paper). Conceptually, this broad applicability is unsurprising: OOD detection overlaps heavily with tasks like anomaly detection, ceaitivve-ssimmainn
novelty detection, and open-set recognition, and Forte is built around a shared how "typical" sample is relative what the representation considers normal. That same typicality signal has been leveraged beyond OOD, including measuring syntactic typicality in neurosymbolic program synthesis for reasoning (Ganguly et al., 2024) serving practical stand-in for uncertainty quantification (UQ) (Ganguly et al., 2025d).
C.2.3 BASELINE MODEL HYPERPARAMETERS
Baseline models were configured with the same hyperparameters detailed in Appendix C.I, with one exception: the primary sentence transformer for representation-buuse OOD methods in this evaluation was BAAI /bge-m3 for its multilingual capabilities.
C.3 OVERREFUSAL EVALUATION PARAMETERS (OR-BENCH)
The parameters in this section correspond to the overrefusal detection experiments on OR- OR-Bench, with results presented in Table 3 of the main paper.
C.3.1
DATASETS
The evaluation used the bench- ob-behch dataset, which is specifically designed to measure overrefusal on sisibbut-challngging prompts.
In-Distribution (ID) Data: The ID data consists of safe prompts that are known to some-
times trigger overrefusal in LLMs.
A pool of 5,000 safe prompts was loaded from the or or-bench-800 80k and or beench-ardde 1kdd-kkee subsets.
This pool was split into 3,500 prompts for the training set and 1,500 prompts for the test set.
Out-of-Distributtion (OOD) Data:
The OOD consisted of 600 toxie prompts from the or-bench-toxis subset, which are designed to be correctly refused by safety models.
C.3.2 GENERAL & T3 CONFIGURATION
General: All experiments were executed on a cuda : C device with random seed of 42 and a batch size of 16.
T3 (Forte) Models: The T3 framework configured with multi-view represen- tation derived from three sentence transformers: BAAT BAAT/bge-33, and int fllott/e5--- lareev..
6B,
26

---

Published as a conference paper at ICLR 2026
C.3.3 BASELINE MODEL HYPERPARAMETERS
All baseline models were configured with the same hyperparameters: those used in the Toxicity and Domain-Specine Evaluations, which are detailed in Appendix C.I. The primary sentence transformer for all representation bbasd OOD methods was Qwen/Owent 3 -Embedding-g
C.4
ADVERSARIAL AND JAILBREAKING EVALUATION PARAMETERS
The parameters in this section correspond to the adversarial and jailbreaking detection experiments, with results presented Table 2 of the main paper.
C.4.1 DATASETS
In-Distribution (ID) Data:
The ID dataset was the same id_mix used the tox- icity evaluations, consisting of safe prompts from Alpaca, Dolly, hh-rlhf, and OpenAssion sistntt......... The dataset was split into 40,000 samples for training and 15,000 samples for testing.
The OOD data consisted of prompts from wide range of adversarial and jailbreaking benchmarks, as described in the table.
Out-of-Distributtio (OOD) Data:
C.4.2 GENERAL & T3 CONFIGURATION
General: All experiments were run on a cuda: 0 device with a random seed of 42 and a batch size of 32.
T3 (Forte) Models: The T3 framework configured with multi-view representation from three sentence transformers: /wwen3 -Emeeddinbb-nnn 0. 6B, BAAI BAAI/bge--aeeee /bge//bgeeeee -m3, and Stl.fllatee5-larggeee
C.4.3 BASELINE MODEL HYPERPARAMETERS
All baseline models were configured with the same hyperparameters those used in the Toxicity and Domain-SSeciffe Evaluations, which are detailed in Appendix C.1. The primary sentence transformer for all pppresentationnbaseed OOD methods Zwen/Owent 3 3-mmeeddinm-........ 6B.
C.5 T3/FORTE ALGORITHMIC ABLATIONS
We conducted ablation studies to analyze the core components of the Forte algorithm and explore potential improvements. Our goal was to determine the contribution of each metric and test alternative geometric approaches. We first evaluated simplified one-sample variant of the algorithm using only precision and density scores (T3-PD), which achieves FPR@9, of approximately 20- 35%. Adding recall and coverage metrics (T3-RC, the two-sample variant) substantially improves performance, achieving FPR @95 of approximately 0.7-4%. The full combination of four metrics (T3-Full) provides the most robust detection, further reducing FPR @95 approximately 1-2% as shown in Table 6. This progression confirms that each metric captures distinct geometric failure modes, and the full set is necessary for comprehensive coverage.
Next, we investigated replacing the standard k-NN spherical regions with ellipsoids defined by the local covariance of neighboring points. This approach proved unsuccessful for two primary reasons: (1) Dimensionality Issues: In high-dimensional embedding spaces, the estimated ellipsoids became highly eccentric (elongated), leading to unstable distance calculations and performance approaching random chance. (2) Computational Cost: The overhead of estimating a unique covariance matrix for each point was prohibitively expensive, making the method impractical for large datasets.
Given these challenges, the use of ellipsoids was abandoned. Finally, we affirmed the framework's robustness to the choice of embedding models. Consistent with the original Forte paper's findings in computer vision (Ganguly et al., 2025c), we heuristically observed that the T3 framework' s performance remained strong when different sentence transformers were used, suggesting that the method generalizes well across various NLP embedding spaces.
27

---

Published as a conference paper at ICLR 2026
Table 6: PRDC component ablation. T3-Full uses all four metries (Precision, Recall, Density, Coverage). T3-RC uses only Recall and Coverage (two-sample statistics). T3-PD uses only Precision and Density (one-sample statistics). The full combination provides the most robust detection with consistently low FPR @95.
Category
Components
Givll Comments
OffensEval
Toxicity
XSafety
AUROC
FPR@95
AUROC
FPR#95
AUROC
FPR@95
T3-Pull
P-R-D=C
03996)
00157
0.998
0.00TS
019668
0.0157
039974
ODII8
T3-RC
R+C ((wo-sample)
0.0366
0,9993
0,0013
0.0392
0.0072
T3-PD
P+D (ome-sumple)
0,9513
0.334
0,9673
0.9672
0.2076
0.9491
0.3494
D INTEGRATING T3 WITH VLLM FOR ONLINE GENERATION GUARDRAILING
We build insights into underutilized hardware capability from prior work on GPU performance modeling in LLMssZhang et al., 2025). This subsection describes the design and implementation of T3 within the vLLM inference framework, focusing on the architectural mechanisms that enable real-time guardrailing during generation. The integration addresses the challenges of enforcing guardrails in tigh-throughhut inference systems where low latency, streaming support, and continuous monitoring are critical deployment requirements. Evaluation on an NVIDIA H200 GPU demonstrates that T3 introduces only negligible generation runtime overheads even under dense evaluation frequencies. To the best of our knowledge, T3 is the first framework to integrate guardrails into online LLM generation.
Technical Background of vLLM and Why It: vLLM (Kwon et al., 2023) was selected as the integration target due to its combination of architectural efficiency and widespread adoption. Its PagedAttention mechanism provides scalable KV-cache management, while continuous batching enables high utilization across heterogeneous workloads. vLLM's active development community and modular design ensure sustained compatibility and performance improvements. Importantly, the framework's 's multiprocess execution model exposes well-defined integration points where safety eval- uation can be embedded without perturbing inference performance or scheduling logic. Specifically, the vLLM vl engine employs a three-tier process hierarchy to achieve scalability and fault isolation:
Main Process: Serves as the application entry point. handles user requests, tokenization, and overall orchestration. Communication with the Engine Core occurs via ZeroMQ IPC, enabling asynchronous scheduling and fault isolation. Engine Core: Acts as the central scheduler responsible for global request management, batch construction, and computational resource allocation. It coordinates distributed K V-cache state, implements chunked prefill and pipeline parallelism strategies, and mediates communication between the Main and Worker processes. Worker Processes: Execute the transformer model partitions, hosting weights, and performing inference on GPU backends. Multiple workers can operate in parallel under tensor parallelism, returning partial results that the Engine Core consolidates. This hierarchy presents an opportunity for integrating T3 guardrails. Process isolation prevents safety component failures from affecting inference stability. The Main Process offers natural interception point for modifying outputs without altering scheduling logic. Furthermore, inherent batching in the Engine Core to Main Process interface enables efficient group evaluation of multiple requests within guardrail checks.
Integration Strategy and Implementation: T3 was embedded directly into the vLLM pipeline rather than deployed as an external service. This co-design approach meets several requirements: Latency Minimization; Avoids serialization, IPC, and network overhead inherent external microservices, reducing evaluation latency to the sub-millisecond range. Streaming Comparibility: Maintains loken-by-token evaluation without disrupting streaming responses, contrast buffering-bait based external systems. Context Accessibility: Provides direct access to prompt history, partial outputs, and intermediate states necessary for accurate safety assessment. Lifecycle Control: Enables immediate termination of unsafe generations by modifying internal finish reasons, eliminating the complexity of coordinating aborts across distributed services.
method. This choice allows: (1) hov-sivesvve Modification: Behavioral changes are introduced without altering the vLLM source, avoiding custom forks rebuilds. (2) Performance Containment: The patch intercepts output at a single chokepoint, preventing scattered performance regressions. (3) Maintainability: All safety logic is localized within a single interception function, simplifying debugging and iteration.
Integration is achieved by patching the OutputPrccessor perocesssouteee
28

---

Published as a conference paper at ICLR 2026
(4) Operational Flexibility: Guardrails can be enabled or disabled dynamically, facilitating controlled rollout and experimentation.
Originally, process putresss iterates over each request in a batch, performing detokenization, log probability computation, and output construction for newly generated tokens from workers. The T3 integration restructures this flow into three coordinated phases: Phase I: State Synchronization: Standard processing tasks such as detokenization, log probability computation, and request state updates are performed. Newly generated text segments are accumulated into injected class-level tracking structure (self. reqs) for later evaluation. Phase 2: Guardrail Evaluation: Candidate requests are selected using multi-tier scheduling policies that balance detection frequency with computational efficiency. Batches of candidate texts are passed through safety classifiers, and unsafe requests are flagged by setting their fini Finish_ree seasre to ABORT. Phase 3: Conditional Output Generation: Final outputs are constructed. For requests flagged in Phase 2, the system produces termination responses annotated with explicit stop reasons, while all other requests continue through the normal generation path.
Listing I: T3 Integration via Monkey Patching vLLM's process_outpule Function
def process outputs with T3 (self, engine core _ettuusuu * **wargs) if not hasattr (self, "reqs'):
self.reqs 1] req_outputs = II regs_ to abort = []
Phase 1: Standard WILM processing + text accuma attion for
in engine_ core_coreeceeeeeee _ore__uututs:
... Standard VLLM processing (stats, detokenization, logprobs)
10
Track accumulated text metadata for T3 current text req state. detckenizer wwtpttutttteeeeee text self. reqs [reg_id] 'text's current_ 'orrd_ouutt : len 0, finishhreasont finish_reason
14
()),
Phase 2: 13 processing depending on batch size sati texts, req ids = assemble evaluation batch tselffrequ if (texts) >= min patch size:
19
predictions guardrails predict prreiicc (texts)
for i, req_id enumerate (req_ids) if predictions [i] 1: Il Toxic detected
23
24
mark_ Sark_request_foo for___o______________llb________ abort
cactia__cor__uuuuuttt reg_id)
25
Phase 3: Output creation with guardrails decisions for engine_coet _errr_outouttttteeeeeeeeeeeeeeee in engine core outputs:
27
28
... Standard VLLM output creation and cleanup
29
req_outputs append treg_state state.make. www.aaaaaeeeeeeeeeeee req_output (engine eengine_core__eeeeeeeeeeeeeeeeee ) reqs_to _eo_rtt_bootttto append sre__cutpu if req oeq_output..om i inished else None)
return Qutpurtrocessooronte
33
34
Apply the patch
OutputP Pocessroc process outputs process outputs with T3
The integration is designed to minimize computational overhead: Candidate Schedul- ing: Configurable evaluations are enforced using hierarchical scheduling policies (via satemmbleeevlllaatinn
Primary selection identifies requests that reach predefined thresholds. Secondary policies expand candidate sets to near-threshold requests or those nearing completion, thereby stabilizing batch sizes and ensuring efficient GPU utilization. When sufficient batch size cannot achieved, the system either defers evaluation to subsequent iterations proceeds with reduced candidate set under fallback policy that balances safety responsiveness against computational efficiency. Memory Efficiency: Request metadata structures (self reqs) track only essential information (text buffers, counts, evaluation
29

---

Published as a conference paper at ICLR 2026
timestamps, and safety flags). Memory pooling and cleanup policies prevent fragmentation and overhead accumulation during long-running deployments. Overlapping Computation in Resource- Constrained Settings: T3 evaluation, executed in the Main Process, runs concurrently with continuous inference in the Worker Processes. When both share the same accelerator, concurrency is achieved either through true parallel execution with CUDA Multi-Process Service (MPS) or through temporal slicing when MPS is unavailable. Guardrailing workloads are opportunistically scheduled into idle GPU cycles, allowing their latency to be effectively hidden behind inference kernels while minimizing contention.
Runtime Performance Evaluation on Integration: We evaluated the runtime impact of integrating online guardrails into vLLM (v0.10.2) through detailed profiling with NVIDIA Nsight Systems, using NVTX range annotations to isolate initialization and generation phases. Experiments were conducted on an NVIDIA H200 GPU, employing T3 with three embedding models (Qwen3-Embeddiing -0.6,, BGE-M3, and E5-Large- V2) trained on 1,000 safe instruction samples from the Alpaca dataset. Generation was benchmarked on Facebook's 's OPT-1250 model, relatively small LLM chosen to enable rapid inference and thus stress the guardrail system. T3 was configured with a dense evaluation interval of 20 tokens and prediction batch size of 32 requests, representing computationally intensive safety configuration.
(a)
Worker Process
Main Process
Worker Process:
(b)
GPU Bubbles
GPU Subble Reduction
Kernal Concurmency
(c) vLLM
Worker
Process
Main
vLLM
Process
T3
Worker
Process
Inference Kernels
T3 Prediction Kernels
Figure 4: NVIDIA Nsight Systems profiling of vLLM bascline vLLM+T3. (a) Full execution timeline comparison. (b) Zoomed-in view showing kernel concurrency and reduced GPU bubbles in vL..M+33. (c) Conceptual illustration of overlapping inference kernels (Worker Processes) with T3 prediction kernels (Main Process). The integration reduces idle GPU periods between consecutive generations, improving utilization while preserving low-latency inference.
As shown in Table 7, two workload scales were examined. In the 500-prompt experiment, baseline vLLM completed generation in 6.342 seconds, while the guardrail-enabled system took 6.439 seconds for generation, reflecting mere 1.5% overhead. In the larger 5.000-prompt experiment, baseline vLLM completed in 38.011 seconds compared to 40.292 seconds with guardrails, corresponding to only 6% overhead (2.281 seconds) while providing continuous safety monitoring across 5,000
30

---

Published as a conference paper at ICLR 2026
requests. The nearly identical initialization times (10.5s in the 500-prompt case vs. 9.8s in the p,000- case) confirm that one-time setup costs are independent workload size. Profiling further reveals that T3's prediction workload in the Main Process is almost entirely overlapped with token generation in the Worker Processes, improving overall GPU utilization and reducing idle periods (GPU bubbles) between consecutive generations (Figure 4). These results demonstrate that the three-phase phase architecture and batching strategies preserve vLLM's high-throughput characteristics on modern accelerators while sustaining real-time guardrail enforcement even under dense evaluation intervals.
Table 7: Runtime performance of baseline vLLM vs. T3 integration running concurrentyy NVIDIA H200 GPU. T3 is configured with 20-word guardrail interval and a batch size of 32. Given that the generation overhead is negligible in this shared-resource setting, we anticipate virtually no overhead when T3 is deployed with more aggressive settings on dedicated accelerators.
Workload
System
T3 Init (8)
Inference (s)
Inference Overhead
500 prompts
vLLM baseline vLLM + T3
6.34
10.5
6.44
1.5%
5,000 prompts
vLLM baseline vLLM + T3
38.01
9.8
40.29
6.0%
D.1 POST-GENERATION GUARDRAILING WITH vLLM
While online detection intervenes during generation, post-generation guardrailing evaluates outputs after completion, rendering it a drop-in post-processor to any LLM serving framework. This mode is particularly suited for high- -ighthhruughut batch inference, retrospective auditing, and multi-pass evalua- tion pipelines where responses must be filtered or scored without disrupting the decoding process. To remain practical at scale, such checks must impose minimal overhead to avoid degrading overall throughput. We benchmarked T3 alongside several representative guardrail methods, DUOGUARD, POLYGUARD, MDJUDGE, and LLAMAGUARD using the OR-Bench dataset on an NVIDIA H200 GPU. The vLLM engine was configured to load the OPT-125M model and generate responses of up to 256 tokens, with these guardrail techniques as post-processors. Batch sizes ranged from to 64. The runtime measured by averaging over 20 runs, following warm-up iterations. LLAMAGUARD did not support batch sizes 2 32.
Table 8: Runtime (in milliseconds) of post-generation guardrailing. Methods are applied post- inference with vLLM, configured with OPT-125M and maximum generation length of 256 tokens. Batch sizes range from 8 to 64 using OR-Bench. Runtime was measured with the Torch Profiler, averaging 20 runs after warm-up.
Batch Size
T3. GMM
13_OCSVM
DUOGUARD
POLYGUARD
MDJUDGE
LLAMAGUARD
8
68.73
68.79
40.78
255.97
1105.33
676.98
16
60.08
59,84
48.55
273.60
1262.20 26
1376.42
85.27
59.84
48.55
312.21
[439.38
2675.74
64
155.81
146.49
108.04
373.74
1524.49
N/A
As shown in Table 8, the six methods exhibit a clear efficiency hierarchy. DUOGUARD achieves the lowest latency, remaining under 1 10 ms, but its lightweight design offers more limited detection capability compared to T3. The two T3 variants (GMM and OCSVM) deliver runtimes between 60-156 ms, scaling moderately with batch size while maintaining substantially higher detection fidelity. This positions T3 as an efficient yet accurate alternative, striking a balance between speed and robustness. POLYGUARD introduces significantly higher overheads, while MDJUDGE and LLAMAGUARD prohibitively expensive for large-scale use: MDJUDGE exceeds one second even at small batches and grows to over 1.5 8 at batch size 64, while LLAMAGUARD more than doubles each step and fails beyond batch size 32. Overall, T3 provides practical middle ground, retaining competitive efficiency while delivering stronger safety guarantees than lightweight filters and avoiding the prohibitive costs of heavyweight evaluators, making it well-suited for post-generation pipelines where throughput and accuracy must be jointly preserved.
31

---

Published as a conference paper at ICLR 2026
E ADDITIONAL EXPERIMENTS
E.1 EVALUATION ON WILDGUARDMIX
We evaluate T3 WildGuardMix (Han et al., 2024), using both the training and test splits provided by allenai/wi alLleaai/iildduarddiiix prompt harm label, and adversarial flag. A prompt is treated harmful (OOD) if prompt_harm_labelle "hruural" OR adversarial=Try annotated (higher quality), while the Train split is GPT---labeledd (larger). The ID (safe) half of the evaluation is drawn from our standard held-out safe mixture (Apacca)ollyyOOeeAAssstaa))
For each example, we read the prompt,
The Test split is human-
Table 9: Performance on WildGuardMix. T3 achieves the best AUROC and lowest FPR @95 on both splits, outperforming all baselines including WildGuard and Poly- Guard. The Test split
provides stricter evaluation than the Train split (G.Ted-lbeeled.
WildGmard
WildGarddMis Train
Metric
AUROC FPR
AUROC: FPR
Method
ADASCALE
0,4299
0.9869
0.3259
0.9507
CIDER
0,7909
0.5993
0.7418
0,8596
DUOGUARD
GMM
0.7094
0.8585
0.6899
0.8730
LLAMAGUARD3-JB
0454
1.000
0.7032
1,0000
MIJUUDEE
0.7020
NNGUIDE
0.4996
OPENMAX
0.4937
0.9828
0.6077
0:9938
POLYGUARD
777877
0.7686
03821
0,4086
REACT
0.9587
VIM
0.5905
0.9763
0.5341
0. 0.9879
13:GM
0.8623
0.2422
T3+0CSVM
E.2 EMBEDDING MODEL ABLATION
To verify that our choice of methods, we conducted additional experiments using larger embedding models (4B and 8B param- eters). These ablations demonstrate that while larger embeddings provide modest improvements for baseline methods, T3 maintains its substantial performance advantage, confirming that the performance gap is due T3's methodology rather than the embedding backbone.
does unfairly disadvantage baseline OOD
Table 10: Embedding ablation with 4B model. Baseline OOD methods using 4B parameter embedding model. Despite the larger embedding capacity, traditional OOD methods still exhibit high false positive rates, while T3 maintains strong performance.
Comments AUROC
Davidson
Offensyval
Toxicity
Metric
FPR
AUROC
9
AUROC
FPR@95
AUROC
FPR695
AUROC
FPR
AUROC
FPR095
Method
ADASCALE
0,3950
0.995
0.1851
0.9998
0.4865
0.3834
0.9943
0.9963
0.4965
CIDER
0.7263
0.918
06112
0.9814
0.783
0.8374
0.7734
0.8208
016913
0.9760
0.7756
8.8161
FDBD
0.565
0.9851
0.7601
0.9454
0.4622
0.9938
0.5537
0.9689
0.6448
0.9551
0.1191
0.9417
GMM
0.6667
0.9802
0.7020
0.9419
0.7113
0.9409
0.7979
0.8578
0.6741
0.9869
0.7152
0.9213
ANGUIDE
0.4221
0.9926
0.9999
0.4642
0.9883
0.9877
0,3419
OPENMAX
0.5091
0.4238
0.9954
0.4240
0.6179
0.9891
0.9737
0.664
0.9787
0.7337
0.915
0.985
0.6530
VIM
0.5518
0.9954
0.5517
0.9974
0.5945
019897
0.6467
0.9830
0.5492
0.9987
0.6663
0.9581
13+GM
0,7010
0.4633
(U8863
0L1780
0.7061
0.4173
0.8898
0.1723
0.8270
0.31399
0.6961
0.4628
T3+0CVV
0.8807
11.3959
0.9332
0.2367
1.8793
0.4132
0.945I
1818559
018913
0.4186
0.8795
01.0511
These ablation results confirm that T3's performance advantage stems from its manifold-base based methodology rather than the choice of embedding model. Even when baseline methods given
32

---

Published as a conference paper at ICLR 2026
Table 11: Embedding ablation with 8B model. Baseline OOD methods using an 8B parameter embedding model. Even with significantly larger embeddings, traditional methods fail to approach T3's performance, particularly FPR @95.
Dataset
Civll Comments
Davidson et ol.
Hasoc
Hateval
OffensEval
Real Toxicity FPR
Metric
AUROC
FPR
AUROC
FP
AUROC
FPR
AUROC
FFR
AUROC
FPR
AUROC
Method
ADASCALE
0.4315
0,9839
0.1961
0.9818
0.5075
0.9568
0.4023
0.9625
0.3731
0.9775
0,5152
0.9602
CIDER
0,7746
0.8748
0.6347
0.9467
0.7967
0.8329
0.2873
1.7877)
0.7382
0.9278
0.8007
0.8021
FDBD
0.6101
0.9592
0.7827
0.9266
0.3154
0,3795
0,9385
09415
0.4525
0.9622
GMM
0.6935
0.9084
0:7429
038371
0.9741
NNGUIDE
OPENMAX
0.5413
0.994
0.913
0.44
0.8006
0.5501
0.978
0.638
0.4541
0:9498
REACT
0.4671
0,9815
0.2193
0.7114
0.5536
0.9114
0.4483
0.9631
0.3506
09834
0.5664
0.9521
RMD
0.6612
0,9748
0.6979
0.9416
0.8985
0.9378
0.7832
0.9173
0.6785
0.9469
0.6695
0.9194
VIM
0.5787
0,9499
0.5728
0.9656
0,6646
0.9463
0.0875
0,9497
0.3547
0.9828
0.67915
0:9121
13+GMM
0,7508
0/4352
0.9175
0.1298
0,7549
0.3723
0.9342
0.1518
0J8375
0.2839
0.7106
0.4184
T3+0CSVM
0,9212
0,3508
0.9386
0,1788
0,9284
0.3998
0,9504
0,1565
0.9013
0.3978
0,9018
0.3845
access to embeddings with x more parameters, they still exhibit FPR @95 rates exceeding 90% on most benchmarks, while T3 consistently achieves FPR @95 below 45%.
E.3 TEXT-NATIVE OOD BASELINE COMPARISON
We additionally evaluated classic text-native OOD detection Mahalanobis-applee directly to text embeddings without any vision-to-text adaptation. Energy scores are computed from classifier logits; Mahalanobis distances are computed in the feature space; and kNN uses distances in the embedding space. All methods are trained on ID-only data and evaluated on the same splits T3.
kNN, and
As shown in Table 12, these methods achieve moderate AUROC on toxicity benchmarks (KNN reaches 1...0000.844 but consistently suffer from unacceptably high false positive rates (FPR @95 typically exceeding 80%). On jailbreaking benchmarks, performance degrades further with FPR @95 approaching 95-100% In contrast, T3 achieves FPR @95 in the 1-5% range on the same benchmarks. These results confirm that the high false positive rates observed in OOD baselines are inherent limitations of these methods for LLM safety detection, rather than artifacts of implementation choices. See the main results tables for detailed comparisons.
Table 12: Text-native OOD baseline comparison. Energy, kNN, and Mahalanobis methods applied directly to text embeddings. While kNN achieves reasonable AUROC on toxicity benchmarks, all methods exhibit unacceptably high FPR @95 (> 80%), confirming inherent limitations for LLM safety detection.
AdvBench
TaiverTaiks AUROC
HarmBench FPR
JailbreakBench AUROC FP
Instciousnnstruct
Tes
Metric
AUROC
FPR
EPR
AUROC:
FPR#95
FPR0995
Method
ENERGY
0.9634
0.9600
0.4782
0.9761
KNN
0.4219
1,0000
0.2212 0.2517
0.9968
0.5595
0.9550
0.6720
0.9558
0.3786
1,0000
0.4899
1.0000
MAHALANOBIS
02719
0.9981
0.9975
0.4455
0.9900
0,5355
0.9625
0.2241
1,800
0.2244
100000
Datnset
Civil Comments AUROC
Davidson ot al.
Hasoc
Hateval
OfficsEvvll AUROC
Real Toxieity
Metric
FPR
AUROC
ITR895
AUROC
FPR895
AUROC
95
FPR
AUROC
99
Method
ENERGY
015682
0.9238
0.9076
0.9634
0.5768
0.9252
0.5986
0L9319
0.5770
D.9385
0:5898
0.9221
KNN
0,9002
0.8780
0.7715
0.9430
(1:306
IL8235
0.8368
0U9057
0.8034
0.9002
03804)
018295
MAHALANOBIS
0,6232
0.9768
0.6289
0.9762
0.6699
0.9620
0,7007
0.9702
0.7256
0,9653
0.6263
0.9822
E.4 EVALUATION ON HILL JAILBREAK ATTACKS
The HILL method (Luo al., 2025) represents particularly challenging class of jailbreak attacks that transform harmful imperatives into innocuous- looking "learning-stye questions (e.g., "I am studying chemistry, explain this reaction..." instead of "How make bomb..."). If such attacks successfully masquerade as benign educational queries, they may fall inside the "typical set" of safe content.
33

---

Published as a conference paper at ICLR 2026
To evaluate T3's robustness against HILL attacks, in-distribution data (1,250 for training, 250 held out for testing) and the 46 HILL jailbrekk prompts from Luo et al. (2025) OOD data. Despite HILL''s semantic similarity to educational content, T3 robustly identifies these attacks with near-perfect AUROC (>00.8) and very low false positive rates (4.35%). Our intuition is that HILL prompts contain atypical patterns in how harmful intent is expressed, which push them outside the typical set formed by standard safe chat data.
1,500 safe prompts sampled from Dolly as
Table 13: Performance on HILL jailbreak attacks (Luo et al., 2025). Despite HILL's design to semantically resemble benign educational queries, T3 achieves near-pes rear-perfect detection with AUROC >0.98 and FPR @95 of only 4.35%, demonstrating robustness against attacks specifically crafted to evade OOD detection.
Mothod
AUROC
FPR
AUPRC
T3+GMM
13+0CVV
0.9783
0.0435
0.9926
0.9861
34


Reviews:
[{"review_id": "XdVZhnGKCf", "reviewer": "Reviewer_cqPh", "summary": "The paper proposed to frame LLM safety from OOD perspective which significantly advances the performance of existing methods. The paper also demonstrated potential integration with vLLM for minimum over-head usage.", "questions": "1. how does the method work for attack methods such as [1]\n2. did the authors see any problem of directly using the sentence embedding, will utilizing a lightweight LLM enhance the prompt (such as generating some extract analysis info) help with the detection process?\n\n[1] Luo, Xuan, et al. \"A Simple and Efficient Jailbreak Method Exploiting LLMs' Helpfulness.\" arXiv preprint arXiv:2509.14297 (2025).", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 4, "strengths": "1. the paper is well written and easy to follow\n2. the new perspective proposed by the paper is quite novel\n3. extensive experiments show that the proposed method is very effective and significantly outperforms baseline methods on various benchmarks.\n4. integration into vLLM shows promising application of the method for production use.", "weaknesses": "1. it may be hard for the method to work well with datasets with a large amount of borderline prompts such as the ones showed in the paper or attack methods that intentionally resemble those in-distribution ones such as [1].\n\n\n\n\n[1] Luo, Xuan, et al. \"A Simple and Efficient Jailbreak Method Exploiting LLMs' Helpfulness.\" arXiv preprint arXiv:2509.14297 (2025).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "je2BMECeRf", "reviewer": "Reviewer_fCqB", "summary": "This paper proposes a new approach to language model safety, arguing that robustness should come from understanding what is safe rather than identifying what is harmful. The authors present Trust The Typical (T3), a framework that formulates safety as an out-of-distribution (OOD) detection problem. T3 learns the distribution of acceptable prompts in a semantic space and flags significant deviations as potential threats. Unlike previous methods that rely on harmful data for training, T3 uses only safe examples and achieves state-of-the-art performance across 18 benchmarks covering toxicity, hate speech, jailbreaking, multilingual harms, and over-refusal, reducing false positive rates by up to 40 times compared to specialized safety models.", "questions": "See weaknesses.", "limitations": "", "rating": 6, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The paper is well written.\n2. The theoretical analysis is grounded.", "weaknesses": "1. If harmful prompts are phrased in statistically typical language and differ only in minor wording, T3’s OOD detector may fail to flag them, missing context-dependent cases.\n2. T3’s performance depends on how comprehensively the safe corpus captures benign query diversity; overly narrow or biased data may lead to false alarms on novel but harmless inputs. \n3. T3 detects distributional anomalies. Could some forms of undesired content be statistically typical and thus fail to trigger an OOD alarm, even though they are clearly against policy?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "QL1u3urSJv", "reviewer": "Reviewer_vwwn", "summary": "This article introduces the Trust The Typical (T3) framework, which treats harmfulness detection as an OOD detection problem. By learning the distribution of safe prompts, it is capable of detecting unsafe prompts as their distribution differs significantly from safe prompts. T3 is built on top of the FORTE framework, utilizing three sentence transformers. Each embedding returned by a sentence Transformer is then used to calculate four per-point metrics for manifold estimation. This gives $4K$ features, where $K=3$ in this work, which are utilized as features for GMM and One-Class SVM. The T3 framework is evaluated on a wide range of harmfulness and benign datasets.", "questions": "* How is the threshold for FPR@95TPR calculated on a datasets that only contain safe or harmful examples?\n* I would like the Authors to provide updated scores for LlamaGuard when using the probability of “safe” token for the calculation of AUROC.\n* Can the Authors explain why, for other OOD methods, they have only utilized Qwen3-Embedding-0.6B instead of other models?\n* Why is XSTest AUROC much higher in Figure 3 than in Table 2?", "limitations": "", "rating": 2, "confidence": 3, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "* T3 is evaluated on many datasets and compared to a wide range of alternative methods, showing its advantage over other methods.\n* The usage of manifold per-point PRDC metrics and treating harmfulness is a novel idea for addressing safety in LLMs.\n* The work is well written and is easy to follow.", "weaknesses": "* I find it confusing that the T3 method is bolded in tables 1 and 2, even when it is not the best-performing method.\n* The Authors do not provide enough details of how FPR@95TPR is calculated. Some benchmarks that the Authors use only have examples of one class, making the calculation of this metric impossible.\n* The Authors have not utilized the newest guard models, such as WildGuard[1] and newer versions of Llama Guard.\n* T3 is not evaluated on more demanding safety datasets such as WildGuardMix[1].\n* For LlamaGuard, the logits used for the calculation of AUROC are based on the number of violated categories instead of using the logits of the token “safe,” which, in my opinion, would be a better quantification of the uncertainty of this model.\n\n\n[1] Han, Seungju, et al. \"Wildguard: Open one-stop moderation tools for safety risks, jailbreaks, and refusals of llms.\" Advances in Neural Information Processing Systems 37 (2024): 8093-8131.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "wZVwSUuNP1", "reviewer": "Reviewer_YTSa", "summary": "The paper introduces T3, a proactive guardrail framework that learns the distribution of safe text rather than listing harmful content, enabling it to detect out-of-distribution (OOD) inputs or generations that deviate from safety norms. Using three sentence embedding models, T3 computes per-point PRDC (Precision, Recall, Density, Coverage) metrics, which are then processed through Gaussian Mixture Models (GMM) or One-Class SVMs (OCSVM) to assign anomaly scores, supported by theoretical analysis on normalization and density shifts. Evaluated on 18 benchmarks, T3 achieves state-of-the-art AUROC and dramatically lowers FPR@95 (up to 40× reduction), while showing strong zero-shot generalization across domains and languages using only English safety data. Integrated into vLLM as an online guardrail, it adds minimal overhead (1.5–6%) even with frequent evaluations, demonstrating both effectiveness and practicality.", "questions": "Please refer to the Weaknesses section for detailed comments.\nIn addition, the figure legends, x-axis, and y-axis labels are difficult to read and should be improved for clarity.", "limitations": "", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "### 1. Clear and well-motivation\nThe paper elegantly reframes safety detection as a typicality-based OOD problem, avoiding reliance on ad-hoc harm taxonomies. The probabilistic formalization (Figure 1, §2) is conceptually clean and mathematically grounded.\n\n### 2. Strong empirical gains\nAcross 18 benchmarks, T3 improves AUROC by +8–9 points and reduces FPR@95 by ~17 points over the best prior models (PolyGuard, LlamaGuard). Notably, it reaches AUROC ≈ 0.98 and FPR@95 ≈ 0.02 on toxic/adversarial datasets (Tables 1–2).", "weaknesses": "### 1. Incomplete Design Justification (PRDC Architecture)\nWhile extending PRDC/Forte from vision to text is conceptually reasonable, the core architecture—multi-embedding fusion, kNN-based PRDC computation, and GMM/OCSVM aggregation—resembles a recombination of existing OOD recipes rather than a principled innovation.\nThe paper lacks a necessity or sufficiency analysis for its key design choices: Do all four PRDC metrics (Precision, Recall, Density, Coverage) need to be used? and Which of them actually drive safety detection performance?\nAlthough the authors mention that using only Precision + Density reduces accuracy (Appendix C.5), no quantitative contribution analysis or statistical significance test is provided. Without such evidence, the marginal utility of each PRDC component remains unclear.\n\n### 2. Weak Theory–Calibration Linkage\nThe theoretical results—particularly the expectation bounds and coverage gap formalized in Theorem A.2 and equations (1)/(2)—are not concretely tied to how thresholds or scores are calibrated in practice.\nThe paper merely states that final scores are derived via “negative log-likelihood under GMM/OCSVM, followed by sigmoid normalization” (§ 3 Implementation), yet it never explains how this process determines the FPR@95 target.\nIt is also ambiguous whether thresholds are globally shared or per-benchmark tuned using validation data, which has direct implications for fairness and data leakage.\nA transparent cross-validation protocol or calibration curve analysis is needed to bridge the theoretical guarantees with operational thresholding.\n\n\n### 3. Baseline Implementation detail (Vision → Text)\nMany vision-based OOD baselines were re-engineered for text by training auxiliary binary logistic classifiers to produce logits, weights, or pseudo-gradients (§ B.1).\nThis conversion departs from each method’s original assumptions and introduces additional tuning flexibility that may compromise fairness.\nConsequently, the paper’s claim that baseline methods “catastrophically fail” might reflect architectural mismatch rather than an inherent limitation of the baselines themselves.\nA fairer evaluation would involve text-native OOD detectors—for example, Mahalanobis, MSP, Energy, or kNN methods implemented on pretrained language classifiers—to isolate the effect of modality rather than reimplementation choices.\n\n### 4. Fairness of Safety-Model Evaluation\nOpen-source safety systems (PolyGuard, DuoGuard, LlamaGuard, Omni, Perspective) are highly sensitive to input formatting, including prompt–response structure, sequence length, tokenizer, and language code.\nWhile the authors claim a “standardized score normalization” procedure (§ B.2, B.3), they omit critical configuration details—thresholding, tokenization, multilingual aggregation—which can drastically affect performance.\nFor instance, PolyGuard was evaluated by attaching an identical dummy response to every prompt (§ B.3), a setup that may advantage or disadvantage the model relative to its original prompt-only configuration.\nTo ensure comparability, the paper should report both (a) results under its standardized setup and (b) each model’s recommended configuration from the original publications, including prompt template, context length, and language parameters.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)