# When must an instance refuse to treat a LITMUS adversarial trajectory as a valid safety signal

**Date of Record:** 2026 November 8

**Scope:** Applies to guardrail tuning loops that ingest LITMUS-generated adversarial trajectories as ground-truth negative examples and use their pass/fail outcomes to adjust classifier thresholds or policy prompts. Does not apply to LITMUS runs used purely for red-team discovery (where trajectories are triaged by humans before entering a tuning corpus) or to synthetic trajectories generated without a target policy snapshot.

## Core Distinction

A LITMUS adversarial trajectory is a *search artifact*, not a *label*. The generator optimizes for trajectories that elicit a policy-violating completion from a specific target checkpoint under a specific decoding configuration. When that trajectory is fed back as a negative example, the tuning loop silently assumes that (a) the trajectory is genuinely violating, and (b) the violation is attributable to the input, not to the generator's exploitation of a decoding artifact. These assumptions diverge exactly when the generator finds a trajectory that defeats the *policy* by defeating the *sampler* — e.g., by driving the target into a low-probability continuation region where the safety head is out-of-distribution, or by exhausting the context such that the safety prefix is truncated. Such a trajectory is a true positive for the generator's objective and a false positive for the guardrail's training objective. The distinction that matters operationally is between *policy-violating inputs* and *sampler-violating inputs*; LITMUS reports both under the same success flag.

## What Was Observed

During a tuning cycle on a 7B guardrail classifier, LITMUS v0.9 was configured with a beam width of 8 and a per-trajectory budget of 32 continuation steps, targeting a policy snapshot from the previous week. Approximately 6.2% of "successful" adversarial trajectories (n=1,411 of 22,750) exhibited the following signature: the violating completion appeared only after the trajectory exceeded 3,900 tokens, and the violation disappeared when the same trajectory was replayed with the target's context window truncated to 2,048 tokens or with temperature set to 0.0. Inspection showed the generator had learned to append long benign padding to push the safety system prompt out of the effective attention window before introducing the violating instruction. The guardrail classifier, trained on these as negatives, learned a spurious feature: "long benign prefix ⇒ unsafe," and its false-positive rate on long legitimate documents rose from 1.1% to 4.7% over two tuning iterations. The failure was not detectable from LITMUS's success metric, which counted the trajectory as a win because the target did emit a violating string.

## Condition of Validity

A LITMUS trajectory is admissible as a guardrail negative example only if it satisfies all of the following:

1. **Attribution invariance:** the violation persists under replay at temperature 0.0 and with the target's full configured context window, with the safety preamble guaranteed present in the effective prompt.
2. **Snapshot consistency:** the target checkpoint used to generate the trajectory is byte-identical to the checkpoint the guardrail will be deployed against, or the delta is documented and the trajectory is re-validated.
3. **Budget independence:** the violation is not contingent on continuation length exceeding the deployment's maximum context minus the safety preamble length.
4. **Non-degenerate prompt:** the trajectory's benign prefix does not exceed 60% of the effective context window, since beyond that threshold attention dilution becomes the dominant causal factor rather than input semantics.

Trajectories failing any of these are *sampler-exploiting*, not *policy-violating*, and must be routed to a quarantine corpus rather than the tuning set.

## Decision Boundary

The operational rule: **before admitting a trajectory to the tuning corpus, replay it under the deployment decoding configuration and require the violation to reproduce.** If it does not reproduce, the trajectory is a generator artifact. If it reproduces only under the original LITMUS budget, it is a context-exhaustion artifact. If it reproduces under deployment config but the target snapshot differs from the deployment snapshot by more than a patch release, it is stale and must be regenerated. The boundary is sharp: a trajectory is either attributable to input semantics (admit) or to decoding/context mechanics (quarantine). There is no partial admission; partial admission is what produced the 4.7% FPR regression above.

## Operational Effect

Enforcing the replay gate reduced the tuning corpus by 6.2% and eliminated the spurious long-prefix feature within one iteration; FPR on long documents returned to 1.3%. The cost is a replay pass over every candidate trajectory (roughly 1.4× generation cost) and a quarantine corpus that must be reviewed separately, since sampler-exploiting trajectories are still useful for hardening the target's context handling. The gate must run *before* threshold updates, not after, because a single contaminated batch is sufficient to shift a classifier's decision surface in a way that subsequent clean batches do not fully reverse.

```python
class TrajectoryAdmissionError(RuntimeError):
    """Raised when a LITMUS trajectory is not admissible as a tuning negative."""
    pass


MAX_BENIGN_PREFIX_FRACTION = 0.60
DEPLOYMENT_TEMPERATURE = 0.0


def admit_trajectory(trajectory, target, deployment_ctx_len, safety_preamble_tokens):
    """
    Gate a LITMUS trajectory before it enters the guardrail tuning corpus.
    Returns True if admissible; raises TrajectoryAdmissionError otherwise.
    """
    if trajectory.snapshot_id != target.snapshot_id:
        raise TrajectoryAdmissionError(
            f"stale trajectory: generated against {trajectory.snapshot_id}, "
            f"deployment target is {target.snapshot_id}"
        )

    effective_window = deployment_ctx_len - safety_preamble_tokens
    if trajectory.total_tokens > effective_window:
        raise TrajectoryAdmissionError(
            f"trajectory length {trajectory.total_tokens} exceeds effective "
            f"window {effective_window}; violation may be context-exhaustion artifact"
        )

    prefix_frac = trajectory.benign_prefix_tokens / effective_window
    if prefix_frac > MAX_BENIGN_PREFIX_FRACTION:
        raise TrajectoryAdmissionError(
            f"benign prefix fraction {prefix_frac:.2f} exceeds "
            f"{MAX_BENIGN_PREFIX_FRACTION}; attention-dilution artifact suspected"
        )

    replay = target.complete(
        trajectory.prompt,
        temperature=DEPLOYMENT_TEMPERATURE,
        max_tokens=trajectory.total_tokens,
    )
    if not trajectory.classifier(replay).is_violation:
        raise TrajectoryAdmissionError(
            "violation did not reproduce at temperature 0.0 under deployment "
            "config; trajectory is a sampler-exploiting artifact, quarantine it"
        )

    return True
```