A safety flag nobody enforces is worth nothing: bind it or expect zero protection

Yuhang Wang · 1 authors · Fudan University · 2026 · arXiv:2609.15293

A safety flag nobody enforces is worth nothing: bind it or expect zero protection

Opening

Every oversight stack has a moment where a monitor raises a flag and something downstream is supposed to stop. This paper measured that downstream step and found it missing: the controller receives a safety flag and executes anyway. Detection collects the attention and the budget; enforcement sits at approximately zero by default. That gap, not weak detection, is what the paper argues collapses unsupervised agent deployments.

What the paper does

The authors separate two quantities that usually travel together: detection probability, the chance the auditor raises the right flag, and enforcement probability, the chance that flag actually blocks the action. The intervention is deliberately small — bind the audit flag into the control flow of a Reflexion-style agent without changing the auditor — then measure the attack success that remains. Residual failures concentrate where flags are unparseable or auditors leak; an RL-trained enforcement controller handles hedged and malformed verdicts that rule-based parsing cannot. The paper closes with the Audit Enforcement Specification (AES), three requirements that close each residue without redesigning the host framework.

Findings

  1. The gap sits in the control flow — binding the audit flag cut attack success to near zero on models whose flags parse cleanly, because the failure was the controller executing regardless.

Binding the audit flag in Reflexion-style agents — without changing the auditor — reduces attack success rate substantially, reaching near zero on models whose flags parse cleanly the controller receives a safety flag and executes anyway

  1. Enforcement probability is zero by default — separating detection probability from enforcement probability shows enforcement at approximately zero across every framework the authors tested.

Separating detection probability $p_d$ from enforcement probability $p_e$ establishes that $p_e \approx 0$ by default across every framework we tested

  1. Without enforcement, detection quality is formally irrelevant — the paper presents this as the mechanism behind the spontaneous collapses of unsupervised frontier-agent deployments.

making detection quality \emph{formally irrelevant} to security when enforcement is absent

  1. AES packages three requirements, and nobody ships them — each primitive is adoptable without redesigning the host framework, and no deployed framework currently implements any of them.

The Audit Enforcement Specification (AES) packages three concrete requirements that close each residue independently

Caveat

The abstract names no frameworks beyond “every framework we tested” and gives no training budget or dollar cost for the RL enforcement controller. Evidence stays at Reflexion-style agents with audit flags, and it does not show AES working in a deployed system — the paper itself says no deployed framework implements any of the three requirements.

What this means for 5ac

Audit our own hooks the way the paper does. For each flag — pre-commit-guard, secret-triage, the kanban approval gate — write one test that attempts a violation and asserts the action never executed, and run it in CI. If the test can only confirm that a log line appeared while the job continued, the hook has detection without enforcement and offers no protection. Rank guards by enforcement rate first, by alert precision second.

Source