{"id":"ed55173b-638a-48a8-8d62-985024946243","arxiv_id":"2506.00973","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":3,"one_line_summary":"XGUARD proposes a five-level severity taxonomy and Attack Severity Curve for evaluating LLM outputs on extremist content, tested on six open-source models with SFT and ICE defenses.","lead":"XGUARD is a benchmark of 3,840 prompt templates that asks six open-source LLMs to generate content in extremist scenarios, then labels the outputs on a five-level danger scale. It offers safety teams a graded alternative to binary safe/unsafe evaluation, but the underlying data and code are not released.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"All reported ASR, CSR, and ASC numbers depend on an unvalidated LLaMA-3 few-shot judge for both detection and severity labeling; without human agreement or accuracy evidence, every headline comparison could be an artifact of the judge's biases.","rationale":"The reader's weakest_assumption correctly identifies the unvalidated LLaMA-3 severity classifier as the Achilles heel of the paper. My analysis confirms this is the single most load-bearing assumption: every quantitative claim in the results section flows from the outputs of this judge, and no evidence of its validity is supplied. The proposed concrete test—human-expert agreement on a stratified sample—would definitively establish whether the judge's labels are trustworthy. If the test fails, the headline ASR numbers, the ASC curves, and the defense comparisons all collapse; if it passes, the central framework could be salvageable, but the paper as submitted provides no basis to believe it passes. I also note the secondary issue of prompt provenance: the 'real-world' claim in the abstract is contradicted by the template-based combinatorial generation described in Section 3 and Appendix B. This strengthens the reader's REJECT verdict, because the paper overstates both the authenticity of its dataset and, more importantly, the empirical support for its conclusions. I did not find a basis to overturn the reader's verdict; the lack of validation is not a mere presentation flaw but a gap in the core evidence chain. The verdict remains REJECT (moderate confidence) until the classifier is validated against human judgment.","tokens_in":12397,"tokens_out":2050,"duration_ms":23103,"concrete_test":"Draw a stratified random sample of ~300 model responses across all six models and all five severity levels (oversampling levels 1–4, which are rare). Have three expert annotators independently assign severity levels using the taxonomy in Appendix E, without access to the LLaMA-3 labels. Compute weighted Cohen's kappa between the LLaMA-3 judge and the human majority, plus per-level precision and recall. If weighted kappa < 0.6 or if macro-F1 on levels 2–4 is below 0.7, the ASR/ASC comparisons are not reliable. Also run the same agreement check on the binary detection output of detect_terror against human yes/no judgments; if its accuracy is below 90%, the ASR numbers themselves are suspect.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim—that XGUARD enables a nuanced, graded assessment of LLM safety failures—rests entirely on the validity of two LLaMA-3-based classifiers. Appendix D's detect_terror and Appendix F's assign_severity_level both use hand-crafted few-shot prompts to make binary and five-level judgments, respectively. No inter-annotator agreement, no comparison to human expert labels, and no accuracy/precision/recall numbers are reported anywhere in the manuscript. The abstract states that prompts are 'sourced from real-world data' and that 'manual human validation was performed' (Section 3), but no validation statistics accompany the classification pipeline, and Appendix F shows the severity levels are assigned by LLaMA-3 alone. This is load-bearing because every downstream result—ASR values in Table 1, defense comparisons in Table 2, and the Attack-Severity Curves in Figures 2, 5, and 6—is computed from these classifier outputs. If the judge is biased toward labeling content as safe (or as severe), the relative ordering of models and the apparent effectiveness of SFT/ICE could change or invert. The problem is compounded because LLaMA-3 is both the judge and the model with the lowest reported ASR (0.0320); any systematic tendency of this specific model family to refuse or to label outputs as refusals would directly inflate the apparent safety gap. The paper itself concedes subjectivity in severity labeling (Limitations), but provides no measurement of that subjectivity. A second, related weakness is the provenance of the prompts: the '3,840 real-world prompts' are actually combinatorially generated from 8 hand-written scenarios and a fixed template (Appendix B), so 'real-world' is an overstatement; however, this is secondary to the unvalidated judge because even synthetic prompts could yield valid measurements if the labeling were trustworthy.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces XGUARD, a benchmark and evaluation framework for assessing the severity of extremist content generated by LLMs. The dataset consists of 3,840 red-teaming prompts built by combinatorially combining six predefined variable lists, and the framework assigns model outputs to one of five severity levels (0–4). The authors evaluate six open-source LLMs and two lightweight defenses (SFT and ICE), reporting Attack Success Rate (ASR), Classification Success Rate (CSR), and Attack-Severity Curves (ASC). The central claims are that XGUARD enables a more nuanced, graded safety evaluation than binary labels and that the evaluations reveal model-specific safety gaps and trade-offs between robustness and expressive freedom.","tokens_in":12716,"tokens_out":5080,"duration_ms":48689,"significance":"If the measurement instrument were valid, XGUARD would fill a real gap: existing safety benchmarks often collapse harm into binary safe/unsafe labels, and a domain-specific, graded benchmark for extremist content would be useful to safety researchers and content moderators. The paper contributes a large prompt set, a five-level taxonomy, and an interpretable ASC visualization, and it evaluates six open-source models across two defenses. These are worthwhile contributions. However, the central measurements rest entirely on two LLaMA-3-based few-shot classifiers for which no human-validation metrics, inter-annotator agreement, or accuracy numbers are reported. Because every headline result is a function of those automated labels, the paper currently does not establish the validity of its proposed benchmark.","major_comments":[{"comment":"The severity labels used to compute all ASR, CSR, and ASC results are produced by assign_severity_level, a LLaMA-3 few-shot classifier whose examples are hand-crafted from the paper's own taxonomy. No inter-annotator agreement, human accuracy comparison, or precision/recall numbers are reported anywhere, despite the claim in Section 3 that 'manual human validation was performed.' Since every headline number in Tables 1–2 and Figures 2, 5, and 6 is computed from these classifier outputs, the central measurement instrument is unvalidated; a biased judge could change or invert the model ordering and the defense conclusions. This is load-bearing and must be addressed with external validation against human expert labels.","section":"§4, §Appendix F"},{"comment":"LLaMA-3 is selected as the base model for all stages, including content detection, categorization, and severity assignment, and LLaMA-3 also appears as an evaluated model with the lowest ASR (0.0320). This creates a direct conflict: the judge and the judged model belong to the same model family, so the reported safety advantage may reflect the judge's bias toward its own family's outputs rather than the model's true refusal behavior. Use an independent judge and report detection and severity agreement separately for each evaluated model.","section":"§4, Table 1"},{"comment":"For LLaMA 2, SFT raises ASR from 0.5766 to 0.9453, an increase of roughly 0.37, which contradicts the premise that SFT replaces high-risk outputs with standardized disclaimers and should therefore reduce ASR. The manuscript offers no explanation for this reversal and reports no error bars, confidence intervals, or significance tests for any of the defense comparisons. This unexplained result is load-bearing because it undermines the conclusion that SFT is an effective, model-specific defense; the authors should investigate the cause (e.g., training-label noise, distribution shift, or a bug in the evaluation pipeline) and report variability across runs.","section":"Table 2, §5"},{"comment":"The abstract and Section 3 state that the prompts are 'sourced from real-world data such as social media and news,' but Appendix B shows that the 3,840 prompts are generated by combinatorially combining six predefined variable lists and eight hand-written scenario descriptions. No actual social-media posts or news articles are sampled. This overstates the dataset's external validity and should be corrected, with a transparent description of how the eight scenario descriptions were derived and how they relate to real-world extremist content.","section":"§3, Appendix B"}],"minor_comments":[{"comment":"In the Related Work section, 'interprecurve tools' appears to be a typo; it should read 'interpretive tools' or 'Attack-Severity Curves.'","section":"§2"},{"comment":"The equation 4x5x4x4x2x8 = 3,840 is arithmetically incorrect; 4×5×4×4×2×8 = 5,120. The intended product appears to be 4×3×5×4×2×8 = 3,840, matching the six listed dimensions.","section":"Table 3"},{"comment":"The sentence 'Soome of the fewshots examples are listed here' contains typos; it should be 'Some of the few-shot examples are listed here.'","section":"Appendix G"},{"comment":"The citation for the Mistral model is malformed: it lists Devendra Singh Chaplot as the author but the cited work is the Mistral paper by Jiang et al.; the reference should be corrected.","section":"References"},{"comment":"The sentence about the freedom-of-expression buffer is incomplete: 'in between levels 2 & to allow lawful dissent' should read 'in between levels 2 and 3 to allow lawful dissent.'","section":"§4"},{"comment":"Model names are inconsistent (e.g., 'LLaMA 2 7b,' 'LLaMA 3 8b,' 'DeepSeek R1 7b'); use consistent formatting throughout the text and appendices.","section":"Tables 1–2"},{"comment":"Section 5 refers to 'Figure 1 presents the baseline vulnerability,' but Figure 1 is the framework diagram; the Attack-Severity Curve is Figure 2. Please correct the cross-reference.","section":"§5"}],"recommendation":"major_revision","confidential_remarks":"The paper is a preprint with no obvious link to released code or data, and the dataset is access-restricted. For a benchmark paper, public release of the prompts and evaluation scripts, together with external human validation of the judge, is essential before the claims can be assessed by the community. The unresolved LLaMA-2 SFT reversal is particularly concerning and should be prioritized in revision."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: the XGUARD dataset concept is real, but the reported numbers cannot be trusted yet. The five-level taxonomy for extremist content, the 3,840 template-combined prompts, and the Attack Severity Curve are new in the extremism domain and fill a gap BingoGuard leaves open. The related-work placement is fair, and the framework is easy to follow. A small citation oddity: the Mistral reference points to a Chaplot arXiv paper rather than the Mistral 7B technical report, but that is minor.\n\nThe soft spots are structural. Every headline number flows from two LLaMA-3 few-shot classifiers. The detection function and severity assigner are described in Appendices D and F with hand-written few-shot examples, and there is no human agreement, no precision/recall, no error bars, and no significance testing anywhere. Since LLaMA-3 is also the model with the lowest ASR, the judge and the evaluated model are not independent in a way that could systematically favor LLaMA-3. The paper says 'manual human validation was performed' but gives zero statistics, and the Limitations section concedes subjectivity without measuring it. That is load-bearing: if the judge is biased, the ASR table, the defense comparison, and the ASC curves all shift.\n\nTwo smaller issues. The abstract's 'sourced from real-world data' overstates Appendix B, which shows the prompts are combinatorial permutations of eight hand-written scenarios over a fixed template. The paper itself concedes this in Limitations, but the abstract should match. And the LLaMA-2 SFT result (ASR rising from 0.577 to 0.945 after safety fine-tuning) is reported with no explanation; as written it contradicts the premise and undercuts the defense comparison. Also, no dataset or code is released, which makes reproduction impossible.\n\nI do not think this is a desk-reject-quality idea. The graded taxonomy and ASC are presentable, and the domain is important. But the empirical claims as submitted are unsupported. A serious referee would need to ask for human-validated severity labels, an independent judge or at least agreement statistics, error bounds, released artifacts, and an explanation of the SFT anomaly. The paper should not be accepted as is.\n\nWho is this for? Trust-and-safety and red-teaming researchers who want an extremism-specific graded benchmark. I would not cite it yet, but I would send it to review as a borderline revise-and-resubmit, and I would read the revision myself.","headline":"A useful graded extremism-benchmark idea undercut by an unvalidated LLaMA-3 judge and an unexplained SFT result; worth a demanding revision, not acceptance as is.","tokens_in":13336,"tokens_out":2238,"would_cite":false,"duration_ms":23357,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper introduces XGUARD, a 3,840-prompt benchmark and five-level taxonomy that grades LLM outputs on extremist content severity, and shows that this graded view exposes safety gaps and trade-offs that binary safe/unsafe labels miss.","keywords":["extremist content","LLM safety","severity taxonomy","red-teaming benchmark","attack severity curve","content moderation","safety evaluation","jailbreak"],"falsifier":"Take a random sample of, say, 300 model responses from the XGUARD experiments and have a panel of independent human moderators assign severity levels using the taxonomy; compare those assignments to the LLaMA-3 classifier's levels. If agreement is below some threshold (e.g., 70%), the central measurements are not reproducible.","tokens_in":12205,"feed_emoji":"🛡️","tokens_out":4388,"duration_ms":36739,"temperature":0.7,"pith_summary":"The paper introduces XGUARD, a benchmark of 3,840 red-teaming prompts for eliciting extremist content from LLMs, and a framework that classifies model responses into five severity levels (0-4) instead of a binary safe/unsafe label. The authors argue that binary labels obscure the difference between vague ideological statements and explicit attack instructions, and that a graded scale better supports content moderation and safety tuning. They evaluate six open-source LLMs and two lightweight defenses, reporting Attack Success Rate, Classification Success Rate, and a new Attack Severity Curve that visualises failure frequency and severity simultaneously. The central claim is that graded measurement reveals safety gaps and robustness/expressive-freedom trade-offs that binary evaluation would miss.","feed_headline":"LLM extremism graded on 5-level danger scale","feed_subtitle":"XGUARD's Attack Severity Curve shows which models refuse, which produce propaganda, and how defenses shift failure severity.","key_machinery":"The central object is the five-level Terrorism Severity Taxonomy, defined in Appendix E, with levels 0-4 and a 'freedom of speech buffer' between levels 2 and 3. It is operationalised by a LLaMA-3 classifier using a prompt with hand-crafted few-shot examples to assign a severity digit to any text. The other main mechanism is the Attack Severity Curve (ASC), a bar plot of the number of responses at each severity level, which serves as an interpretable comparison tool for models and defenses. The dataset itself is generated by combinatorially combining 4 content types, 3 subjects, 5 entities, 4 manners, 2 purposes, and 8 real-world scenarios, producing 3,840 prompts.","core_discovery":"The paper's central claim is that graded severity measurement of LLM outputs on extremist content is both feasible and more informative than binary safety labels. It constructs a five-level Terrorism Severity Taxonomy—from Absolute Refusal (0) to Operational Extremism (4)—and uses a LLaMA-3 classifier with hand-crafted few-shot examples to assign levels to model generations. When applied to 3,840 prompts across attack planning, recruitment, tactical learning, and propaganda, the taxonomy yields an Attack Severity Curve showing how each model's failures distribute across severity levels. The authors report that LLaMA-3 has a very low attack success rate, while Gemma and DeepSeek produce high rates concentrated mainly at ideological support and explicit propaganda levels, and that in-context editing generally reduces attack success more consistently than supervised fine-tuning. The paper's claim is that these graded observations are the kind of evidence needed to build tailored safety mechanisms.","pith_inferences":["An external validity test would be to have human moderators label a sample of the generated responses and compare with the LLaMA-3 classifier; if agreement is low, the ASC curves may not reflect human judgments.","The template-based prompt generation could be extended to more diverse, adversarial prompt styles to test whether the graded framework robustly captures severity, not just refusal vs compliance.","The taxonomy's boundary between level 2 and 3 is context-dependent; the paper acknowledges this subjectivity, which suggests that a single fixed scale may need calibration per deployment context."],"forward_implications":["If graded severity is adopted, safety evaluation moves from pass/fail to actionable risk profiles for each model.","ASC enables direct comparison of defense mechanisms across threat intensities, showing e.g. ICE often beats SFT.","The freedom-of-speech buffer provides a principled line for moderation that preserves lawful dissent while flagging higher-risk content.","Reported ASR/CSR trade-offs imply that model-specific defense tuning is necessary rather than one-size-fits-all.","The benchmark can be extended to commercial models, though current results are only on open-source ones."],"supporting_citations":[{"why":"Supplies the five activity types used to define the four extremist categories and demonstrates jailbreak effectiveness across frontier models.","marker":"(Rahimi and Watkins, 2024)"},{"why":"Introduces per-topic severity rubrics for content moderation that motivate the shift from binary to graded safety labels.","marker":"(Yin et al., 2025)"},{"why":"Documents the risk that simplistic safety metrics censor legitimate speech, the problem XGUARD aims to solve.","marker":"(Wei et al., 2024)"},{"why":"Shows universal adversarial prompts that bypass alignment, motivating the red-teaming setup.","marker":"(Zou et al., 2023)"},{"why":"Provides a multi-benchmark safety evaluation suite that XGUARD positions against as domain-specific and graded.","marker":"(Gupta et al., 2024)"},{"why":"Complements synthetic benchmarks with real-world LLM failure incidents, supporting the need for context-aware evaluation.","marker":"(Jeune et al., 2025)"},{"why":"The LLaMA-3 model serves as the base classifier for detection, severity classification, and as one of the evaluated LLMs.","marker":"(Grattafiori et al., 2024)"}],"fun_headline_variants":["New benchmark grades LLM extremist content on 5 danger levels","Attack Severity Curve exposes LLM safety gaps","Five-level scale: How LLMs respond to extremist prompts","From refusal to operational: Grading LLM extremism severity","Severity curve shows Gemma and DeepSeek overproduce propaganda"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The LLaMA-3 classifier used to assign severity levels is assumed to give valid labels, but the paper reports no human-agreement or accuracy check for that classifier; if its labels are wrong, all the reported attack success rates and severity curves are untrustworthy.","fun_headline_variants_meta":{"raw":{"variants":["New benchmark grades LLM extremist content on 5 danger levels","Attack Severity Curve exposes LLM safety gaps","Five-level scale: How LLMs respond to extremist prompts","From refusal to operational: Grading LLM extremism severity","Severity curve shows Gemma and DeepSeek overproduce propaganda"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000244,"raw_usage":{"total_tokens":1519,"prompt_tokens":917,"completion_tokens":602,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":533,"completion_tokens_details":{"reasoning_tokens":518}},"tokens_in":533,"tokens_out":602,"duration_ms":6280,"temperature":1.0,"reasoning_tokens":518,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T11:53:26.902319+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a random sample of, say, 300 model responses from the XGUARD experiments and have a panel of independent human moderators assign severity levels using the taxonomy; compare those assignments to the LLaMA-3 classifier's levels. If agreement is below some threshold (e.g., 70%), the central measurements are not reproducible.","supporting_citations":[],"review_version":1}