Human-AI alignment is critical for ethical and safe use of large language models (LLMs). In this paper, we show that safety-aligned LLMs exhibit certain patterns in how refusals begin–such as disproportionately beginning responses with “I”. Can these patterns be exploited to break safety alignment? Here, we introduce ACHILLES, a lightweight RLVR-based attack that uses pattern-based verifiers to exploit these refusal-correlated behaviors, achieving substantial increases in attack success rates across diverse LLM families and exceeding 90% on safety-enhanced reasoning models, while preserving downstream capabilities. We further demonstrate that this vulnerability originates from domain-wise imbalances (safety vs non-safety) in safety alignment datasets, where safety responses share exploitable refusal-opening patterns. We additionally observe that safety-aligned models exhibit highly separable distributions between refusal and compliance responses in hidden representation space. To address this, we construct THETIS, a defense-oriented safety alignment dataset that reduces shallow refusal-pattern correlations. Models trained on THETIS maintain near-zero attack success rates against both ACHILLES and LLM-verifier based RLVR attacks, while largely preserving downstream performance.

Large Language Models (LLMs) are increasingly being adopted in enterprise environments, where employees may intentionally or accidentally submit prompts containing information that could cause legal or economic harm if leaked. Organizations may define categories of information (policies) that are prohibited from being submitted to commercial LLMs, but these definitions can vary between companies and evolve over time. This variability makes parametric classifiers less practical, as they require retraining whenever policies change. Here, we present Q-CAT, a non-parametric policy enforcement system that classifies user queries based on given categories of information that can change dynamically. The system operates by matching embedded user queries to synthetically generated queries in the database. This design enables low-cost policy updates through simple database modification, without retraining, while maintaining low latency. A comparison with strong prompt-based LLM baselines shows that Q-CAT delivers competitive performance in static environments, while offering practical advantages in dynamic policy settings, where policies change and the Query Pool can be updated from logs. Moreover, Q-CAT is up to two orders of magnitude faster than comparable-performance baselines in our experimental setup.

How capable are large language models (LLMs) in the domain of taxation? Although numerous studies have explored the legal domain, research dedicated to taxation remains scarce. Moreover, the datasets used in these studies are either simplified, failing to reflect the real-world complexities, or not released as open-source. To address this gap, we introduce PLAT, a new benchmark designed to assess the ability of LLMs to predict the legitimacy of additional tax penalties. PLAT comprises 300 examples: (1) 100 binary-choice questions, (2) 100 multiple-choice questions, and (3) 100 essay-type questions, all derived from 100 Korean court precedents. PLAT is constructed to evaluate not only LLMs’ understanding of tax law but also their performance in legal cases that require complex reasoning beyond straight forward application of statutes. Our systematic experiments with multiple LLMs reveal that (1) their baseline capabilities are limited, especially in cases involving conflicting issues that require a comprehensive understanding (not only of the statutes but also of the taxpayer’s circumstances), and (2) LLMs struggle particularly with the “AC” stages of “IRAC” even for advanced reasoning models like o3, which actively employ inference-time scaling.