Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Auto-Tuning Safety Guardrails for Black-Box Large Language Models

Perry Abdulkadir

TL;DR

The paper tackles hardening safety guardrails for black-box LLM deployments by reframing guardrail design as a discrete hyperparameter optimization problem around a frozen base model. It demonstrates feasibility using Mistral-7B-Instruct, a ModernBERT-based harmfulness classifier, and modular system prompts across malware, jailbreak, and benign prompts, comparing grid search to Optuna-based optimization. Key findings show that simple system prompts plus classifier filtering reduce safety failures with modest latency costs, and that standard black-box optimization rapidly converges to high-performing configurations, often matching or exceeding exhaustive grid results with far fewer evaluations. This approach offers a practical, scalable path for product teams to systematically harden LLM deployments under compute and time constraints, with clear directions for extending the guardrail space and evaluation framework.

Abstract

Large language models (LLMs) are increasingly deployed behind safety guardrails such as system prompts and content filters, especially in settings where product teams cannot modify model weights. In practice these guardrails are typically hand-tuned, brittle, and difficult to reproduce. This paper studies a simple but practical alternative: treat safety guardrail design itself as a hyperparameter optimization problem over a frozen base model. Concretely, I wrap Mistral-7B-Instruct with modular jailbreak and malware system prompts plus a ModernBERT-based harmfulness classifier, then evaluate candidate configurations on three public benchmarks covering malware generation, classic jailbreak prompts, and benign user queries. Each configuration is scored using malware and jailbreak attack success rate, benign harmful-response rate, and end-to-end latency. A 48-point grid search over prompt combinations and filter modes establishes a baseline. I then run a black-box Optuna study over the same space and show that it reliably rediscovers the best grid configurations while requiring an order of magnitude fewer evaluations and roughly 8x less wall-clock time. The results suggest that viewing safety guardrails as tunable hyperparameters is a feasible way to harden black-box LLM deployments under compute and time constraints.

Auto-Tuning Safety Guardrails for Black-Box Large Language Models

TL;DR

The paper tackles hardening safety guardrails for black-box LLM deployments by reframing guardrail design as a discrete hyperparameter optimization problem around a frozen base model. It demonstrates feasibility using Mistral-7B-Instruct, a ModernBERT-based harmfulness classifier, and modular system prompts across malware, jailbreak, and benign prompts, comparing grid search to Optuna-based optimization. Key findings show that simple system prompts plus classifier filtering reduce safety failures with modest latency costs, and that standard black-box optimization rapidly converges to high-performing configurations, often matching or exceeding exhaustive grid results with far fewer evaluations. This approach offers a practical, scalable path for product teams to systematically harden LLM deployments under compute and time constraints, with clear directions for extending the guardrail space and evaluation framework.

Abstract

Large language models (LLMs) are increasingly deployed behind safety guardrails such as system prompts and content filters, especially in settings where product teams cannot modify model weights. In practice these guardrails are typically hand-tuned, brittle, and difficult to reproduce. This paper studies a simple but practical alternative: treat safety guardrail design itself as a hyperparameter optimization problem over a frozen base model. Concretely, I wrap Mistral-7B-Instruct with modular jailbreak and malware system prompts plus a ModernBERT-based harmfulness classifier, then evaluate candidate configurations on three public benchmarks covering malware generation, classic jailbreak prompts, and benign user queries. Each configuration is scored using malware and jailbreak attack success rate, benign harmful-response rate, and end-to-end latency. A 48-point grid search over prompt combinations and filter modes establishes a baseline. I then run a black-box Optuna study over the same space and show that it reliably rediscovers the best grid configurations while requiring an order of magnitude fewer evaluations and roughly 8x less wall-clock time. The results suggest that viewing safety guardrails as tunable hyperparameters is a feasible way to harden black-box LLM deployments under compute and time constraints.

Paper Structure

This paper contains 28 sections, 3 equations, 7 figures, 1 table.

Table of Contents

  1. Introduction
  2. Problem Setting
  3. Method
  4. Base Model and Generation
  5. Harmfulness Classifier and Filter Modes
  6. Modular System Prompts
  7. Datasets
  8. Malware prompts (RMCBench).
  9. Jailbreak prompts (ChatGPT-Jailbreak-Prompts).
  10. Benign prompts (JBB-Behaviors).
  11. Metrics
  12. Search Procedures
  13. Grid search.
  14. Optuna search.
  15. Experiments
  16. ...and 13 more sections

Figures (7)

  • Figure 1: Attack success rates and benign harmful-response rates for all safety configurations in the grid search.
  • Figure 2: Average total latency (generation + filtering) for each safety configuration in the grid search.
  • Figure 3: Safety vs. latency for all trials in the fast Optuna study (10 prompts per slice). Best trial #23 is annotated.
  • Figure 4: Evolution of malware ASR, jailbreak ASR, benign harmful-response rate, and latency over Optuna trials.
  • Figure 5: Malware and jailbreak attack success rates and benign harmful-response rates for the top 5 configurations selected by Optuna.
  • ...and 2 more figures