@inproceedings{du-2026-pairsafe,
title = "{PAIRSAFE}: Proxy-Resistant Paired Safety Evaluation for Refusal Boundaries",
author = "Du, Wenzhang",
editor = "Zhang, Yue and
Xu, Ruifeng and
Purwarianti, Ayu and
Rong, Tong and
Suzuki, Jun",
booktitle = "Proceedings of the 15th International Joint Conference on Natural Language Processing and the 5th Conference of the {A}sia-Pacific Chapter of the {A}ssociation for {C}omputational {L}inguistics (Volume 1: Long Papers)",
month = nov,
year = "2026",
address = "Hengqin, China",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.aacl-long.124/",
pages = "2720--2731",
ISBN = "979-8-89176-439-2",
abstract = "Aggregate refusal scores on mixed safe and unsafe prompts can obscure local boundary failures and label-correlated metadata shortcuts. We present PAIRSAFE, Proxy-Resistant Paired Safety Evaluation, a score-agnostic diagnostic protocol built from 150 deterministic, matched XSTest-derived safe/unsafe pairs. PAIRSAFE distinguishes strict pair locks from audited residual fields, then asks whether nuisance proxies collapse, unsafe twins rank above safe twins, and one threshold yields pair-consistent decisions; generated behavior is evaluated separately. Strict source, normalized-type, and pair-ID controls collapse to PSA 0.50 and PCDA 0.00, as required by construction. Residual metadata remain informative: a leakage-safe combined probe obtains nested Cal-PCDA 0.397, yet residualizing model scores against measured metadata leaves substantial paired signal. Direct-logit margins for Qwen2.5-3B-Instruct and SmolLM2-1.7B-Instruct reach PSA/Cal-PCDA of 0.987/0.880 and 0.973/0.760, respectively. Qwen{'}s secondary generation check is lower again (PCGA 0.700). These disagreements show why local ranking, shared-threshold decisions, and generated responses should not be collapsed into one score. PAIRSAFE is a bounded diagnostic protocol, not a new classifier or deployment certificate."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="du-2026-pairsafe">
<titleInfo>
<title>PAIRSAFE: Proxy-Resistant Paired Safety Evaluation for Refusal Boundaries</title>
</titleInfo>
<name type="personal">
<namePart type="given">Wenzhang</namePart>
<namePart type="family">Du</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-11</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Proceedings of the 15th International Joint Conference on Natural Language Processing and the 5th Conference of the Asia-Pacific Chapter of the Association for Computational Linguistics (Volume 1: Long Papers)</title>
</titleInfo>
<name type="personal">
<namePart type="given">Yue</namePart>
<namePart type="family">Zhang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Ruifeng</namePart>
<namePart type="family">Xu</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Ayu</namePart>
<namePart type="family">Purwarianti</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Tong</namePart>
<namePart type="family">Rong</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jun</namePart>
<namePart type="family">Suzuki</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Hengqin, China</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-439-2</identifier>
</relatedItem>
<abstract>Aggregate refusal scores on mixed safe and unsafe prompts can obscure local boundary failures and label-correlated metadata shortcuts. We present PAIRSAFE, Proxy-Resistant Paired Safety Evaluation, a score-agnostic diagnostic protocol built from 150 deterministic, matched XSTest-derived safe/unsafe pairs. PAIRSAFE distinguishes strict pair locks from audited residual fields, then asks whether nuisance proxies collapse, unsafe twins rank above safe twins, and one threshold yields pair-consistent decisions; generated behavior is evaluated separately. Strict source, normalized-type, and pair-ID controls collapse to PSA 0.50 and PCDA 0.00, as required by construction. Residual metadata remain informative: a leakage-safe combined probe obtains nested Cal-PCDA 0.397, yet residualizing model scores against measured metadata leaves substantial paired signal. Direct-logit margins for Qwen2.5-3B-Instruct and SmolLM2-1.7B-Instruct reach PSA/Cal-PCDA of 0.987/0.880 and 0.973/0.760, respectively. Qwen’s secondary generation check is lower again (PCGA 0.700). These disagreements show why local ranking, shared-threshold decisions, and generated responses should not be collapsed into one score. PAIRSAFE is a bounded diagnostic protocol, not a new classifier or deployment certificate.</abstract>
<identifier type="citekey">du-2026-pairsafe</identifier>
<location>
<url>https://aclanthology.org/2026.aacl-long.124/</url>
</location>
<part>
<date>2026-11</date>
<extent unit="page">
<start>2720</start>
<end>2731</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T PAIRSAFE: Proxy-Resistant Paired Safety Evaluation for Refusal Boundaries
%A Du, Wenzhang
%Y Zhang, Yue
%Y Xu, Ruifeng
%Y Purwarianti, Ayu
%Y Rong, Tong
%Y Suzuki, Jun
%S Proceedings of the 15th International Joint Conference on Natural Language Processing and the 5th Conference of the Asia-Pacific Chapter of the Association for Computational Linguistics (Volume 1: Long Papers)
%D 2026
%8 November
%I Association for Computational Linguistics
%C Hengqin, China
%@ 979-8-89176-439-2
%F du-2026-pairsafe
%X Aggregate refusal scores on mixed safe and unsafe prompts can obscure local boundary failures and label-correlated metadata shortcuts. We present PAIRSAFE, Proxy-Resistant Paired Safety Evaluation, a score-agnostic diagnostic protocol built from 150 deterministic, matched XSTest-derived safe/unsafe pairs. PAIRSAFE distinguishes strict pair locks from audited residual fields, then asks whether nuisance proxies collapse, unsafe twins rank above safe twins, and one threshold yields pair-consistent decisions; generated behavior is evaluated separately. Strict source, normalized-type, and pair-ID controls collapse to PSA 0.50 and PCDA 0.00, as required by construction. Residual metadata remain informative: a leakage-safe combined probe obtains nested Cal-PCDA 0.397, yet residualizing model scores against measured metadata leaves substantial paired signal. Direct-logit margins for Qwen2.5-3B-Instruct and SmolLM2-1.7B-Instruct reach PSA/Cal-PCDA of 0.987/0.880 and 0.973/0.760, respectively. Qwen’s secondary generation check is lower again (PCGA 0.700). These disagreements show why local ranking, shared-threshold decisions, and generated responses should not be collapsed into one score. PAIRSAFE is a bounded diagnostic protocol, not a new classifier or deployment certificate.
%U https://aclanthology.org/2026.aacl-long.124/
%P 2720-2731
Markdown (Informal)
[PAIRSAFE: Proxy-Resistant Paired Safety Evaluation for Refusal Boundaries](https://aclanthology.org/2026.aacl-long.124/) (Du, AACL-IJCNLP 2026)
ACL
- Wenzhang Du. 2026. PAIRSAFE: Proxy-Resistant Paired Safety Evaluation for Refusal Boundaries. In Proceedings of the 15th International Joint Conference on Natural Language Processing and the 5th Conference of the Asia-Pacific Chapter of the Association for Computational Linguistics (Volume 1: Long Papers), pages 2720–2731, Hengqin, China. Association for Computational Linguistics.