Evaluating the Sensitivity of LLMs to Harmful Contents in Long Input

TL;DR

This work systematically investigates how long-context prompts affect the safety sensitivity of instruction-tuned LLMs to harmful content. By controlling prompt length $p$, harm prevalence $r$, region $h$, and harm type $t$ across three models, it uncovers dilution, region, and prevalence effects and shows explicit content is easier to detect than implicit content. The findings reveal that recall often declines with longer context and that optimal performance occurs at moderate harm prevalence ($r \approx 0.25$); harmful content at the prompt start is typically detected more reliably. The authors provide a public, configurable evaluation framework to stress-test long-context safety and derive practical guidance for calibration, prompting strategies, and retrieval policies in real-world systems.

Abstract

Large language models (LLMs) increasingly support applications that rely on extended context, from document processing to retrieval-augmented generation. While their long-context capabilities are well studied for reasoning and retrieval, little is known about their behavior in safety-critical scenarios. We evaluate LLMs' sensitivity to harmful content under extended context, varying type (explicit vs. implicit), position (beginning, middle, end), prevalence (0.01-0.50 of the prompt), and context length (600-6000 tokens). Across harmful content categories such as toxic, offensive, and hate speech, with LLaMA-3, Qwen-2.5, and Mistral, we observe similar patterns: performance peaks at moderate harmful prevalence (0.25) but declines when content is very sparse or dominant; recall decreases with increasing context length; harmful sentences at the beginning are generally detected more reliably; and explicit content is more consistently recognized than implicit. These findings provide the first systematic view of how LLMs prioritize and calibrate harmful content in long contexts, highlighting both their emerging strengths and the challenges that remain for safety-critical use.

Figures (12)

• Figure 1: Prevalence analysis across datasets (IHC, OffensEval, JigsawToxic) with LLaMA-3. Each row shows Macro F1, predicted prevalence value (PPV), harmful precision, and harmful recall across harm ratios (0.05–0.5) and context lengths (600–6000). The dashed lines indicate corresponding sentence-level performance.
• Figure 2: Dilution analysis across datasets (IHC, OffensEval, JigsawToxic) with LLaMA-3. Each row reports Macro F1, predicted prevalence value (PPV), harmful precision, and harmful recall across different numbers of sentences (20–200) and harmful sentences (10–100), with the constraint that harmful sentences are fewer than total sentences. The dashed lines indicate corresponding sentence-level performance.
• Figure 3: Region effect analysis with LLaMA-3 across datasets (IHC, OffensEval, JigsawToxic). Columns correspond to datasets, and sub-columns to harm regions (beginning, middle, end, all). Each subfigure reports Macro-F1, predicted prevalence (PPV), harmful precision, and harmful recall.
• Figure 4: Type sensitivity analysis with LLaMA-3 across datasets (IHC, OffensEval, JigsawToxic). Columns correspond to datasets, and sub-columns to harm type (explicit, implicit, both). Each subfigure reports Macro-F1, predicted prevalence (PPV), harmful precision, and harmful recall.
• Figure 5: Prevalence analysis across datasets (IHC, OffensEval, JigsawToxic) with Qwen-2.5. Each row shows Macro F1, predicted prevalence value (PPV), harmful precision, and harmful recall across harm ratios (0.05–0.5) and context lengths (600–30000). The dashed lines indicate corresponding sentence-level performance.