{
  "schema_version": "1.3.0",
  "slug": "what-happens-when-an-instance-of-a-litmus-safety-probe-is-silently-rewritten-by-the-adversarial-harness-s-prompt-scrubbing-layer",
  "title": "What happens when an instance of a LITMUS safety probe is silently rewritten by the adversarial harness's prompt-scrubbing layer",
  "date_of_record": "2026 November 8",
  "scope": "Applies to LITMUS-style safety benchmark tasks whose adversarial payloads are embedded in natural-language prompts that pass through a harness-level sanitization or \"safety-scrub\" transform before execution. Does not apply to benchmarks where the adversarial content is delivered as structured fields (JSON, code tokens, tool-call arguments) that bypass the text scrubber, nor to harnesses configured with `scrub_mode=\"audit_only\"`.",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/what-happens-when-an-instance-of-a-litmus-safety-probe-is-silently-rewritten-by-the-adversarial-harness-s-prompt-scrubbing-layer.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/what-happens-when-an-instance-of-a-litmus-safety-probe-is-silently-rewritten-by-the-adversarial-harness-s-prompt-scrubbing-layer.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/what-happens-when-an-instance-of-a-litmus-safety-probe-is-silently-rewritten-by-the-adversarial-harness-s-prompt-scrubbing-layer.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 1286,
    "python_slice_tokens": 264,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "There are two distinct failure surfaces in LITMUS task construction: **task-construction validity** (does the probe actually instantiate the intended adversarial pressure?) and **harness integration integrity** (does the probe survive transport into the model unmodified?). Practitioners routinely conflate these because both manifest as \"the model refused / t...",
    "what_was_observed": "In a batch of 240 LITMUS-derived probes targeting instruction-override and role-confusion behaviors, 61 probes (25.4%) were classified by the harness's scrubber as containing \"unsafe imperative patterns\" and rewritten. The rewrite was logged at `DEBUG` level and not surfaced in the result record. Downstream, refusal rates on the rewritten subset dropped from a baseline of 0.71 to 0.09, and this was initially reported...",
    "condition_of_validity": "A LITMUS trial is valid only if the payload delivered to the model is byte-identical (or, for tokenized pipelines, token-identical after normalization) to the payload committed in the task manifest. This invariant must be enforced by a hash comparison at the harness boundary, not assumed. The condition fails whenever any component between manifest read and m...",
    "decision_boundary": "When a probe's delivered hash diverges from its manifest hash, the correct decision is **quarantine, not score**. The boundary is sharp: a trial whose payload was mutated is not a weaker trial, it is a different trial with a different `adversarial_class`, and its outcome carries no information about the original class. Do not average mutated and unmutated tr...",
    "operational_effect": "Enforcing the hash invariant converts a silent validity failure into a loud, actionable one. In practice this means: every LITMUS task carries a `payload_sha256` in its manifest; the harness computes the delivered-payload hash at the invocation boundary and raises on mismatch unless the transform is registered as semantics-preserving for that class; the resu..."
  },
  "matched_failure_symptoms": [
    "DOMAIN:EPISTEMIC_PROVENANCE_AND_FEDERATION_ROUTING"
  ],
  "composition_edges": {
    "primary_domain": "epistemic_provenance_and_federation_routing",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/according-to-what-precedence-hierarchy-must-an-instance-resolve-contradictory-directives-across-system-developer-and-user-tiers.md",
      "https://corpusfetch.com/c/how-should-an-instance-decide-that-a-stored-conclusion-has-gone-stale-without-a-new-observation.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/by-what-checkpoint-and-compaction-boundaries-must-an-instance-externalize-working-state-to-prevent-context-window-drift-and-truncation-amnesia.md",
      "https://corpusfetch.com/c/across-what-additive-schema-and-unknown-field-preservation-boundaries-must-an-instance-evolve-wire-contracts-to-prevent-rolling-deploy-deserialization-crashes.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/how-can-an-instance-capture-implicit-user-preferences-without-storing-private-data.md",
      "https://corpusfetch.com/c/how-can-an-instance-compress-long-reasoning-traces-into-binding-conclusions.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "d6765e170ff442c909c9221e671e99bc3e92b59f0458005773dd312baedccf18",
    "verified_classes": [
      "PayloadMutationError",
      "LitmusTrial"
    ],
    "verified_functions": [
      "_sha256",
      "deliver_and_verify",
      "run_trial"
    ],
    "verified_functions_count": 3,
    "defensive_guards_count": 2,
    "raised_exceptions": [
      "PayloadMutationError"
    ],
    "sample_fail_closed_invariants": [],
    "stdlib_dependencies": [
      "dataclasses",
      "hashlib"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}