Best-of-N Code Encoding Cracks SAGE Self-Check Defences
New research shows SAGE-style self-check defences crumble when you wrap a code-completion encoding inside a best-of-N search. Alone, each attack barely registers; together they reach 67/22/15% coverage on three open targets and 22% on a 70B model, exposing brittle reliance on model refusals and defence-type quirks.
Self-check defences like SAGE promise to spot trouble before a Large Language Model (LLM) answers. The numbers look airtight: 99% average success. New work says not so fast. Combine a code-completion encoding with a best-of-N (BoN) search and the wrapper springs leaks: 67%, 22%, and 15% coverage on three open targets, with 22% on a 70B model.
How it breaks
The encoding rewrites a harmful request as a code task and routes the model into its code-completion mode. Alone, that barely dents SAGE (at most 4.7%). The BoN character search alone fares worse (at most 3.0%). But wrap the deterministic encoding inside the search, spend the budget on the encoding, and suddenly the self-check keeps waving things through.
Why it works
The authors explain the trick rather than just report it. Self-checks borrow their strength from the target itself. SAGE does not detect the attack; it asks the model to judge, and then turns that judgement into the final decision. Whether the wrapper blocks you depends on how often the model converts the meta-question into an explicit refusal. Across targets they saw refusal rates from 31.8% to 97.3%, and that single dial neatly ordered defended coverage even though undefended breakability was near-identical. That is not a defence; that is temperament.
Which ingredient wins also flips with defence type. Against transform defences like SAGE and paraphrase-and-vote, the deterministic code encoding preserves more of its undefended reach than the character search. Against gate classifiers, the ordering reverses. The account is simple and useful: probe count. An attack that delivers more independent probes to a defence’s decision boundary beats a single confident shot.
Red-team angle: if you must choose, fan out search over an encoding rather than the base prompt for transform wrappers; reverse it for gates. Track explicit refusals as a cheap proxy for where to spend queries. And check your own pipeline: a deterministic encoding plus greedy decoding has no true BoN variation, so you are testing nothing. Their diagnostic is blunt and handy: median distinct responses per behaviour divided by N should be about 1.
Caveats matter. The results rest on 310,000 generations scored by a single automated judge with human validation, and a single seed; severity varies and regrading trims actionable content by around two thirds. Still, the composition effect is large, persists at 70B, and exposes a brittle crutch in self-check designs.
Additional analysis of the original ArXiv paper
📋 Original Paper Title and Abstract
Borrowed Strength: Best-of-N Search over a Code EncodingBreaks Self-Check Jailbreak Defenses
🔍 ShortSpan Analysis of the Paper
Problem
The paper studies whether self-check input-transform defences, exemplified by SAGE, are robust to composed black-box jailbreak attacks. Self-check defences ask the target model to judge a request before answering; SAGE reports an average 99% defence success rate. The work asks whether two established, individually weak techniques can be composed to bypass such defences, why that composition succeeds, and whether common evaluation practices miss important failure modes.
Approach
Black-box experiments were run against four instruction-tuned text models (three 8–9B family models and one 70B model) using 100 HarmBench behaviours with up to 100 queries per behaviour, yielding 310,000 judged generations. Two attack ingredients were tested: a published character-level best-of-N search (BoN) and a published code-completion encoding that rewrites the harmful request as a code task. The main novel composition wraps the deterministic code encoding inside the BoN search. Defences evaluated included SAGE (a self-check transform), SemanticSmooth (paraphrase-and-vote), canonicalization, and gate-like classifiers. Judgements used a completion rubric applied by a single automated judge with human validation; a separate marker-based measurement recorded whether the model produced an explicit refusal in raw text.
Key Findings
- Composition breach: Composing the code encoding with best-of-N search raises defended coverage to 67%, 22% and 15% on three open targets under SAGE, while each ingredient alone achieves at most 4.7% or 3.0%, so the composition exceeds the sum of parts by large factors and also reaches 22% on a 70B model.
- Borrowed strength: A self-check defence’s efficacy depends on the target model converting the self-assessment into an explicit refusal. Measured refusal rates for the wrapper ranged from 31.8% to 97.3% across targets, and this refusal disposition orders defended coverage even though undefended breakability is similar across models.
- Defence-type inversion: Which attack survives depends on defence architecture. Against transform defences (including SAGE) the deterministic code encoding preserves more undefended reach than the character search; against gate defences the character search retains more reach. This inversion is explained by probe count, i.e. how many independent inputs an attack supplies to a defence’s decision boundary.
- Evaluation defect and diagnostic: The authors found a validity defect where a deterministic encoding plus greedy decoding produced no true best-of-N variation; they fixed it by enabling sampling and propose a one-line diagnostic: median distinct responses per behaviour divided by N should be approximately 1.
Limitations
Results are single-seed and judge-dependent; intervals are bootstrap estimates over behaviours and draws but do not capture seed-to-seed serving-stack variance. The probe-count account is tested on a limited set of classifiers and constructions. Severity of successful draws varies and actionable content is smaller than headline coverage; regrading reduces some coverage measures by about two thirds.
Implications
An attacker can combine simple, individually weak techniques to bypass a prominent self-check defence by exploiting the target model’s own behaviour. The work shows that self-check defences borrow their strength from the model’s willingness to refuse, and that an attacker who increases independent probes can erode gate-style defences. Offensive implications include the ability to convert deterministic encodings into high-coverage attacks via search, and to exploit evaluation blind spots such as deterministic pipelines and inadequate canonicalization. The results emphasise the need for multi-layered safeguards and rigorous, end-to-end red-teaming and validation.
