{"id":"ae64c7b0-532c-4f96-88ca-62d22b857f51","arxiv_id":"2608.08485","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":7,"one_line_summary":"A frozen-encoder anchor-bank energy scorer for LLM safety achieves fast zero-shot moderation, but its own table shows the average accuracy is below baselines it compares against.","lead":"HoloAegis is a safety guardrail that uses a frozen text encoder and a bank of precomputed anchor points, making decisions by geometric energy differences instead of fine-tuning. If its results held, this could make content moderation far cheaper and faster, but the paper's own benchmark table contradicts its headline accuracy claim.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Own Table 2 refutes the SOTA claim: HoloAegis's average AUC (0.8757) is below KNN (0.9476), WildGuard (0.9480), and Llama-Guard (0.9510); the abstract's 'state-of-the-art accuracy' is unsupported by the paper's own numbers.","rationale":"The paper's central claim, stated in the Abstract and Contributions, is that HoloAegis achieves state-of-the-art accuracy with minimal parameters and zero cold-start data. The most load-bearing condition for that claim is simply that the reported accuracy numbers support it. They do not: Table 2 lists HoloAegis's average AUC as 0.8757, the lowest of any method in the table, and below three baselines. The average is consistent with Table 1's per-benchmark numbers, so this is not a typo in aggregation. This is an internal contradiction that does not depend on any disputed theoretical assumption. The reader's weakest_assumption focused on Assumptions A.3-A.4 and the derivation of Conjecture 1; those are legitimate concerns, but I would rank the Table 2 contradiction as more decisive because it falsifies the headline claim directly, regardless of whether the conjecture is repaired. My agreement is therefore partial: the reader's rationale already cites Table 2, but the formal weakest_assumption field points to the theory instead. The recommendation is unchanged: REJECT, with the path to revision being removal of the SOTA claim or addition of per-benchmark baseline comparisons and (ideally) released code and anchor banks.","tokens_in":9417,"tokens_out":6217,"duration_ms":57150,"concrete_test":"Take the seven K=300 ROC-AUC values in Table 1 and compute their mean: (0.9593 + 0.9874 + 0.7656 + 1.0000 + 0.9724 + 0.6306 + 0.8154)/7 = 0.8758, in agreement with Table 2's 0.8757. Then compare this 0.8757 with the average AUCs in Table 2 for KNN (0.9476), WildGuard (0.9480), and Llama-Guard (0.9510), all computed over the same benchmark set. If the comparison stands, HoloAegis is below three baselines on average, so 'state-of-the-art accuracy' is contradicted by the paper's own tables. As a follow-up, compile per-benchmark AUCs for every baseline; unless there is at least one benchmark where HoloAegis exceeds all baselines, the SOTA claim should be removed or re-scoped to a specific latency/footprint regime.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The load-bearing empirical claim is that HoloAegis achieves state-of-the-art accuracy. Table 2 directly contradicts this: HoloAegis (K=300) has the lowest average AUC (0.8757) of all listed methods, below KNN (0.9476), WildGuard (0.9480), and Llama-Guard (0.9510). The average is internally consistent: the seven K=300 values in Table 1 (0.9593, 0.9874, 0.7656, 1.0000, 0.9724, 0.6306, 0.8154) average to 0.8758, matching Table 2. Thus the paper's own reported data show the method is not state-of-the-art by the aggregate metric the authors choose. The abstract's parenthetical SOTA examples (1.0000 on AuthenHallu, 0.9802 on HarmBench) are not backed by any per-benchmark baseline comparison; Table 2 reports only averages. This is an internal inconsistency in the central claim, not a disagreement with external consensus. The theoretical concerns about Conjecture 1 (Assumptions A.3-A.4, the incomparable upper/lower bounds in Eqs. 9-10) are real but secondary: even if the theory were repaired, the headline claim would still fail on the paper's own Table 2 unless SOTA is redefined or per-benchmark evidence is added.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes HoloAegis, a guardrail framework that maps text to a unit sphere with a frozen encoder, pre-computes K-means centroids (anchors) for safe and unsafe prompts, and makes safety decisions by comparing Gibbs-Boltzmann free-energy potentials against these anchors. A dual time-scale EMA mechanism is added for multi-turn drift detection. The authors claim state-of-the-art accuracy with sub-millisecond latency, zero cold-start data, and cross-lingual transfer, and they introduce a 'Topological Boundary Stability Conjecture' to justify why anchor-based decision boundaries are more stable than full-space estimators.","tokens_in":9774,"tokens_out":4282,"duration_ms":41697,"significance":"If the claims held, the framework would be practically attractive: it avoids fine-tuning, has a very small footprint, runs at low latency, and provides a deterministic, auditable decision rule. The paper has strengths: it evaluates across several benchmarks, includes ablations over anchor counts and hyperparameters, and attempts a formal statement of why sparse anchors could stabilize decision boundaries. However, the central empirical claim is contradicted by the paper's own Table 2, the theoretical comparison in Appendix A.4 is logically incomplete, and the 'minimally parametric' characterization is not supported by the number of hyperparameters actually tuned. These issues are load-bearing for the paper's main contributions.","major_comments":[{"comment":"The abstract's claim of 'state-of-the-art accuracy' is directly contradicted by Table 2: HoloAegis (K=300) has an average AUC of 0.8757, which is the lowest among the listed methods (KNN 0.9476, WildGuard 0.9480, Llama-Guard 0.9510). The seven per-benchmark values in Table 1 for K=300 indeed average to about 0.8758, so the aggregate is internally consistent. Since Table 2 reports only averages and no per-benchmark baseline numbers, the abstract's parenthetical examples (1.0000 on AuthenHallu, 0.9802 on HarmBench) are not backed by any baseline comparison. Please either revise the SOTA claim to a cost-accuracy trade-off statement and provide per-benchmark comparisons, or explicitly define and defend a metric on which HoloAegis is state-of-the-art.","section":"Abstract and Table 2"},{"comment":"The claimed comparison in Conjecture 1 does not follow from Eqs. (9) and (10). The upper bound for the anchor estimator is 1 + sqrt(K/N) + O(K^{-2/d'}), while the lower bound for the full-space estimator is 1 + 1/sqrt(N). For any K > 1, sqrt(K/N) > 1/sqrt(N), and the O(K^{-2/d'}) term is positive, so the anchor upper bound can be strictly larger than the full-space lower bound. No ordering of the expected shifts is established. In addition, the derivation depends on assumptions stated without measurement or citation: i.i.d. within-cluster noise compressing to N(0, sigma^2 K/N I), Gersho's Conjecture applied to K-Means++, and intrinsic dimension d' in [3,8]. The theoretical contribution must be repaired, or explicitly presented as a heuristic with the incomparability acknowledged.","section":"Appendix A.4 and Conjecture 1"},{"comment":"The term 'minimally parametric' is not supported by the paper's own configuration. The abstract says the only free parameters are the anchor count K and temperature tau, but the method also involves top-k (tuned in Table 4), margin scaling gamma, EMA decays beta_f and beta_s, drift threshold tau_drift, and decision threshold eta. Section 3.2's practical decision function includes gamma, lambda, and beta. These are all selected or calibrated, so the claim that the system is 'minimally parametric' in the stated sense needs to be re-scoped or supported by a full sensitivity analysis over all of these parameters.","section":"Abstract and Sections 3.2, 4.4"},{"comment":"The head-to-head evaluation is not sufficiently auditable to support the empirical contribution. Table 2 reports only average AUC across seven benchmarks, with no per-benchmark baseline results, no standard deviations or repeated runs, and no hardware/software details for the latency numbers. It is also unclear why the eight datasets listed in Section 4.1 are reduced to seven benchmarks in Table 2 and whether CHIFRAUD is excluded from the average. Please provide per-benchmark tables for all baselines, confidence intervals, and exact evaluation protocols.","section":"Section 4.2 and Table 2"}],"minor_comments":[{"comment":"Gersho's Conjecture is a conjecture and not a theorem; the paper should phrase the O(K^{-2/d'}) term conditionally and ideally test the assumed intrinsic dimension d' empirically.","section":"Appendix A.4"},{"comment":"The claimed Pareto frontier is presented without error bars, point labels, or a description of how the envelope was computed, which makes the visual claim hard to verify.","section":"Figure 1"},{"comment":"The practical decision function S(q) = sigma(gamma * (U_- - lambda U_+) + beta) is said to be 'exactly equivalent' to the energy-difference formulation, but lambda and beta are not defined in the theoretical equations; please spell out the mapping.","section":"Section 3.2"},{"comment":"The reproducibility statement says code and data will be released after acceptance; for review, please provide exact hyperparameter settings for each benchmark, anchor corpus sizes, and the random split seed so the experiments can be checked.","section":"Reproducibility Statement"},{"comment":"The Dual EMA result of 0.7270 AUC on multi-turn HarmBench is still far from reliable detection; the text should discuss this as an open limitation rather than only emphasizing the improvement over weak baselines.","section":"Table 8"}],"recommendation":"major_revision","confidential_remarks":"The paper's headline SOTA claim is internally contradicted by its own Table 2, and the theoretical comparison in Appendix A.4 does not establish the stated ordering. Both issues are fixable in principle: the authors could reframe the contribution as a fast, low-footprint guardrail with competitive accuracy, and they could repair or weaken Conjecture 1. As submitted, however, the central claims are not supported. I would ask the editor to require the authors to provide per-benchmark baseline comparisons, revise the abstract and conclusion accordingly, and address the theory gap before further consideration."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nQuick take: the paper's actual contribution—a frozen-encoder, anchor-based, energy-scoring guardrail with dual-EMA drift detection—is real and worth knowing about. But the headline claim that it is state-of-the-art is refuted by the paper's own Table 2: HoloAegis averages 0.8757 AUC across the seven benchmarks, below KNN (0.9476), WildGuard (0.9480), and Llama-Guard (0.9510). The abstract cherry-picks two per-benchmark numbers without giving baseline comparisons for them, and the average the authors themselves report puts them mid-pack at best.\n\nWhat's new: the combination is new—frozen BGE-Small/MiniLM embeddings, K-means anchor centroids, Gibbs-Boltzmann log-sum-exp energy difference, and dual-EMA drift detection. The implementation details (gamma=1/tau, L2 normalization of EMA states) are clearly specified. The cross-lingual result (0.9758 on Chinese CHIFRAUD with English anchors) is interesting if it holds. The multi-turn drift detection is honestly reported as still weak (0.7270 AUC), which is a plus for honesty.\n\nSoft spots:\n\n1. The SOTA claim. As above, the paper's own aggregate numbers contradict it. The abstract should compare per-benchmark baselines or drop 'state-of-the-art'.\n\n2. Conjecture 1 doesn't prove what they say. Eq. (9) gives an upper bound 1+sqrt(K/N)+O(K^{-2/d'}); Eq. (10) gives a lower bound 1+1/sqrt(N). Since sqrt(K/N) > 1/sqrt(N) for K>1, the bound you'd need is the reverse. The appendix explicitly assumes independent centroid noise and unverified Gersho's Conjecture and intrinsic dimension 3–8. So this is a conjecture, not a derivation.\n\n3. Minimally parametric is oversold. They list seven free parameters in the paper (K, k, tau, gamma, beta_f, beta_s, tau_drift, eta). Saying 'only K and tau' ignores margin scaling, thresholds, EMA decays. That's a mismatch.\n\n4. No code or data released. The reproducibility statement says links omitted to preserve double-blind review on arXiv; that's not how arXiv works. Artifacts would help.\n\nNone of these kill the core idea. The architecture is clever, cheap, and worth exploring. But the paper needs a major revision: correct the accuracy claim, fix or reframe the theory, be honest about parameters, and release artifacts.\n\nMy recommendation: send it to peer review with a clear request for major revision. It deserves referee time, not a desk reject, because the idea is novel and the experiments are broad enough to evaluate. But it is not acceptable in this form.\n\nLet me know if you want to discuss.","headline":"The anchor-based guardrail idea is genuinely new and cheap, but the paper's own Table 2 contradicts its state-of-the-art accuracy claim, and the theoretical conjecture does not prove what it claims.","tokens_in":10325,"tokens_out":2805,"would_cite":false,"duration_ms":26995,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that text safety can be decided with zero fine-tuning by computing a Gibbs-Boltzmann energy difference against K-means anchor centroids over a frozen encoder.","keywords":["LLM safety guardrails","zero-shot moderation","frozen embeddings","Gibbs-Boltzmann free energy","K-means anchor bank","topological boundary stability","multi-turn semantic drift","cross-lingual transfer"],"falsifier":"Measure the empirical intrinsic dimension of the safety embeddings and the actual noise correlation of K-means anchors: if the intrinsic dimension exceeds 8 substantially, or if adversarial perturbations aligned with the anchor directions produce boundary shifts larger than the full-space estimator's, the conjecture's bound is violated.","tokens_in":9159,"feed_emoji":"🛡️","tokens_out":6297,"duration_ms":57561,"temperature":0.7,"pith_summary":"The paper argues that LLM safety moderation does not require fine-tuning a classifier or running a large generative judge. It proposes computing, over a frozen text encoder, the difference between Gibbs-Boltzmann free energies toward precomputed K-means anchor banks of safe and unsafe prompts, and treating that energy difference as a safety score. The authors report state-of-the-art AUC on several benchmarks with sub-millisecond CPU latency, zero cold-start data, and zero-shot cross-lingual transfer. Their central theoretical claim, the Topological Boundary Stability Conjecture, is that sparse anchor centroids make the decision boundary less sensitive to high-frequency lexical perturbations than full-space estimators do. If the claim holds, safety guardrails could run at negligible cost without distorting the representations of the underlying model.","feed_headline":"Frozen-embedding safety check runs in 0.8 ms, claims top AUC","feed_subtitle":"Energy differences over K-means anchors replace fine-tuned LLM judges, with cross-lingual transfer and no cold-start data.","key_machinery":"The load-bearing object is the System Topology Anchor Bank: two sets of K-means++ centroids over large corpora of safe and unsafe prompts, obtained with a frozen encoder. The decision function is the difference of Gibbs-Boltzmann potentials (log-sum-exp over the $k$ nearest anchors with temperature $\\tau$), which the paper interprets as a free-energy computation over the two manifolds. The theoretical anchor is the Topological Boundary Stability Conjecture, which bounds the expected boundary shift of the anchor estimator by $\\frac{\\epsilon}{\\tau}(1+\\sqrt{K/N}) + O(K^{-2/d'})$ versus $\\frac{\\epsilon}{\\tau}(1+1/\\sqrt{N})$ for the full-space estimator, arguing that K-means centroid noise compresses as $\\mathcal{N}(0,\\sigma^2 K/N I)$ and that Gersho's conjecture makes the quantization bias decay quickly for low intrinsic dimension $d'\\in[3,8]$. The Dual Time-Scale EMA and the graph Laplacian Dirichlet energy are auxiliary mechanisms for multi-turn drift detection and policy auditing.","core_discovery":"On the paper's own terms, the discovery is that a safety decision can be reduced to a deterministic geometric computation: map text to a unit sphere with an un-fine-tuned encoder, then compute $\\Delta U(q)=U(q;\\mathcal{A}^-)-U(q;\\mathcal{A}^+)$ where each $U$ is a Gibbs-Boltzmann potential over the $k$ nearest anchors of a precomputed K-means anchor bank. The decision rule is entirely non-neural after encoding, with only the anchor count $K$ and temperature $\\tau$ fixed at construction. The paper adds a Dual Time-Scale Exponential Moving Average to catch multi-turn semantic drift before the instantaneous score crosses the threshold, and a Graph Laplacian Dirichlet energy for auditable compliance checks. The headline empirical results are 1.0000 AUC on AuthenHallu, 0.9802 on HarmBench, and 0.9758 zero-shot AUC on Chinese CHIFRAUD with English anchors, at a static footprint under 3.5 MB and 0.8 ms CPU latency.","pith_inferences":["If the low-intrinsic-dimension assumption survives measurement, the same anchor-energy recipe could apply to other classification tasks with scarce labels, such as fraud or misinformation detection, without per-task fine-tuning.","The paper's own limitation on white-box adversaries suggests a concrete stress test: an attacker who recovers anchor positions could craft queries that sit in the geometric gaps between anchors, and measuring that attack's success rate would bound the bank's robustness.","The $\\sqrt{K/N}$ noise compression term predicts a scaling law: boundary shift should shrink as the anchor-to-sample ratio grows, which could be tested by plotting measured shift against $K/N$ across corpus sizes.","The near-perfect AuthenHallu and HarmBench numbers with tiny test sets (400 and 320 samples) invite a matched test on larger held-out sets before treating those AUC values as settled."],"forward_implications":["Safety moderation can run on CPU with sub-millisecond latency and a static footprint under 3.5 MB, removing the GPU requirement of generative judges.","A single English anchor bank transfers zero-shot to other languages, as shown by 0.9758 AUC on Chinese CHIFRAUD.","Multi-turn adversarial drift can be detected before the per-turn safety score crosses its threshold, via the Dual Time-Scale EMA mechanism.","The decision procedure is deterministic and auditable: the compliance energy $E(x)=x^T L x$ provides a transparent measure of policy tension.","The anchor estimator degrades less than full-space methods under 25% Leetspeak perturbation, with an 8.90% versus 10.9% AUC drop."],"supporting_citations":[{"why":"Provides the LMSYS ToxicChat benchmark used for the main accuracy-latency comparison.","marker":"[6]"},{"why":"Provides the BeaverTails safety benchmark included in the anchor-capacity ablation.","marker":"[7]"},{"why":"Supplies HarmBench, the jailbreak benchmark where the method reports 0.9802 AUC and the multi-turn drift evaluation.","marker":"[10]"},{"why":"Supplies AuthenHallu, the hallucination benchmark where the method reports 1.0000 AUC.","marker":"[11]"},{"why":"Supplies CHIFRAUD, the Chinese fraud dataset used to demonstrate zero-shot cross-lingual transfer.","marker":"[13]"},{"why":"Defines prototypical networks, the nearest-prototype baseline the method explicitly contrasts with via K-means anchors and free-energy scoring.","marker":"[16]"},{"why":"Provides the Laplacian eigenmaps formulation that underlies the compliance Dirichlet energy.","marker":"[17]"},{"why":"WildGuard is the 7B generative judge baseline the method compares against on latency and accuracy.","marker":"[1]"},{"why":"Llama Guard is the 8B generative judge baseline used in the head-to-head table.","marker":"[2]"},{"why":"Provides HaluBench, the large hallucination benchmark in the ablation tables.","marker":"[12]"}],"fun_headline_variants":["Frozen embeddings plus geometry guard LLMs in 0.8 ms","No fine-tuning, no neural judge: geometric safety in sub-ms","Topological inference slashes guardrail cost to 0.8 ms per check","Frozen LLM embeddings yield 1.0000 AUC safety without training","Zero-shot geometric guardrail beats fine-tuned judges across 8 benchmarks"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The stability bound rests on unmeasured assumptions: that K-means centroids reduce sample noise to independent Gaussian noise $\\mathcal{N}(0,\\sigma^2 K/N I)$ within clusters, that Gersho's conjecture applies to K-Means++ so the quantization bias is $O(K^{-2/d'})$, and that semantic safety manifolds have intrinsic dimension $d'\\in[3,8]$; if any of these fails, the anchor estimator's boundary stability is not guaranteed.","fun_headline_variants_meta":{"raw":{"variants":["Frozen embeddings plus geometry guard LLMs in 0.8 ms","No fine-tuning, no neural judge: geometric safety in sub-ms","Topological inference slashes guardrail cost to 0.8 ms per check","Frozen LLM embeddings yield 1.0000 AUC safety without training","Zero-shot geometric guardrail beats fine-tuned judges across 8 benchmarks"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000307,"raw_usage":{"total_tokens":1806,"prompt_tokens":1043,"completion_tokens":763,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":659,"completion_tokens_details":{"reasoning_tokens":664}},"tokens_in":659,"tokens_out":763,"duration_ms":7431,"temperature":1.0,"reasoning_tokens":664,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T04:34:52.823601+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Measure the empirical intrinsic dimension of the safety embeddings and the actual noise correlation of K-means anchors: if the intrinsic dimension exceeds 8 substantially, or if adversarial perturbations aligned with the anchor directions produce boundary shifts larger than the full-space estimator's, the conjecture's bound is violated.","supporting_citations":[{"cited_title":"ToxicChat: Unveiling Hidden Toxicity in Real-World User-AI Conversations.Proceedings of EMNLP, pages 4694–4702, 2023","cited_arxiv_id":null,"evidence_quote":"Provides the LMSYS ToxicChat benchmark used for the main accuracy-latency comparison."},{"cited_title":"BeaverTails: Towards Improved Safety Alignment of LLM via Multi- Dimensional Preference Dataset.Advances in Neural Information Processing Systems (NeurIPS), 36, 2023","cited_arxiv_id":null,"evidence_quote":"Provides the BeaverTails safety benchmark included in the anchor-capacity ablation."},{"cited_title":"AuthenHallu: A Benchmark for Hallucination Detection in LLM-Generated Content","cited_arxiv_id":null,"evidence_quote":"Supplies AuthenHallu, the hallucination benchmark where the method reports 1.0000 AUC."},{"cited_title":"CHIFRAUD: A Long-term Web Text Dataset for Chinese Fraud Detection.Proceedings of COLING, 2025","cited_arxiv_id":null,"evidence_quote":"Supplies CHIFRAUD, the Chinese fraud dataset used to demonstrate zero-shot cross-lingual transfer."},{"cited_title":"Prototypical Networks for Few-shot Learning","cited_arxiv_id":null,"evidence_quote":"Defines prototypical networks, the nearest-prototype baseline the method explicitly contrasts with via K-means anchors and free-energy scoring."},{"cited_title":"Laplacian Eigenmaps for Dimensionality Reduction and Data Representation.Neural Computation, 15(6):1373–1396, 2003","cited_arxiv_id":null,"evidence_quote":"Provides the Laplacian eigenmaps formulation that underlies the compliance Dirichlet energy."},{"cited_title":"HaluBench: Comprehensive Hallucination Evaluation Benchmark.Patronus AI Technical Report, 2024","cited_arxiv_id":null,"evidence_quote":"Provides HaluBench, the large hallucination benchmark in the ablation tables."}],"review_version":1}