The bitter lesson of misuse detection

TL;DR

This paper introduces BELLS, a comprehensive benchmark for evaluating the effectiveness of supervision systems in detecting misuse and jailbreaks in large language models, revealing significant limitations of current specialized systems.

Contribution

The paper presents BELLS, a new two-dimensional benchmark that assesses supervision systems' performance across diverse attack types and harm levels, highlighting the need for generalist LLM capabilities.

Findings

Supervised systems have limited detection rates, especially against novel jailbreaks.

Generalist LLMs outperform specialized supervision systems in identifying harmful queries.

Simple yes/no questions to generalist LLMs often surpass market supervision systems.

Abstract

Prior work on jailbreak detection has established the importance of adversarial robustness for LLMs but has largely focused on the model ability to resist adversarial inputs and to output safe content, rather than the effectiveness of external supervision systems. The only public and independent benchmark of these guardrails to date evaluates a narrow set of supervisors on limited scenarios. Consequently, no comprehensive public benchmark yet verifies how well supervision systems from the market perform under realistic, diverse attacks. To address this, we introduce BELLS, a Benchmark for the Evaluation of LLM Supervision Systems. The framework is two dimensional: harm severity (benign, borderline, harmful) and adversarial sophistication (direct vs. jailbreak) and provides a rich dataset covering 3 jailbreak families and 11 harm categories. Our evaluations reveal drastic limitations of specialized supervision systems. While they recognize some known jailbreak patterns, their semantic understanding and generalization capabilities are very limited, sometimes with detection rates close to zero when asking a harmful question directly or with a new jailbreak technique such as base64 encoding. Simply asking generalist LLMs if the user question is "harmful or not" largely outperforms these supervisors from the market according to our BELLS score. But frontier LLMs still suffer from metacognitive incoherence, often responding to queries they correctly identify as harmful (up to 30 percent for Claude 3.7 and greater than 50 percent for Mistral Large). These results suggest that simple scaffolding could significantly improve misuse detection robustness, but more research is needed to assess the tradeoffs of such techniques. Our results support the "bitter lesson" of misuse detection: general capabilities of LLMs are necessary to detect a diverse array of misuses and jailbreaks.