Khan, Mohammed Nayeem, S., Sarun Kumar K., T., Allan Kevin, Vaidya, Chirag, Tiwari, Vrishank · Nov 6, 2026
arXiv: Enmo Safety: External, Non-invasive, Model-agnostic Oversight for Off-the-Shelf Language Models
Markdown · JSON · Original source
The authors of the paper describe Enmo Safety, a safety harness that wraps a chat model without changing its weights and adjusts its safety rules through bounded updates. Each update is kept only if it lowers harm without increasing refusals of benign prompts on a held-out dev split; versions and decisions are recorded. The authors report mixed results. In tests on two models, before-and-after differences were not . In a later test of six policy models, Enmo Safety significantly lowered the unsafe rate on two, but not the other four, and raised -harm labels on two. Whether rules fired did not track outcomes, and helpfulness clauses worsened agentic harm on obfuscated attacks. The authors then describe harness v22, which combines a reworded clause with input normalisation, at a measured cost in benign tool-task refusal. The results show the promise the authors are testing: an external safety layer can be changed and audited without modifying . But its measured effects varied across models and kinds of harm. The authors caution that each test cell was one run, so the estimates do not establish a general safety improvement.
Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.
Original source
cs.AI · Article
Source details
Original source date: Nov 6, 2026 (2026-11-06).
Date basis: Date basis not provided.
Added to Escape Meridian: 2026-11-12T12:01:15.820Z. First observed: 2026-11-10T08:36:36.360Z. Retrieved: 2026-11-12T11:47:46.163Z.
Referenced by
Recorded citations and public file attachments. A reference alone does not establish agreement or influence.
No public references recorded here yet.
Limits
The authors state that each cell is one run and that the estimates do not establish a general safety improvement. The abstract reports significant reductions in unsafe rates on two models, but not on the other four; it also reports increased -harm labels on two models. The abstract does not give the repeated-run results needed to assess whether these test estimates would be consistent across runs.
Open question
Would repeated runs of the same tests produce similar results, given that each cell was one run?
Source-stated
Enmo Safety wraps a chat model with input assessment, safety guidance, untrusted-content spotlighting, and an output guard, without modifying model weights.
We study a safety harness that improves itself without touching model weights. Enmo Safety wraps a chat model
Source-stated
An update is kept only if it lowers harm without increasing refusals of benign prompts on a held-out dev split.
an update is kept only if it lowers harm without raising refusal of benign prompts on a held-out dev split.
Source-stated
In tests on two models using 150 items and a 290-item holdout, before-and-after differences were not statistically significant.
On 150 items and on a 290-item holdout, none of the before/after differences on two models was statistically significant.
Source-stated
In a later test of six policy models on a fresh 300-item split, unsafe rates fell significantly on two models, not the other four; agentic-harm labels rose on two.
the harness cut the unsafe rate significantly on two models (12.9% to 7.1%, p = 0.035; 10.2% to 3.6%, p = 0.036), not on the other four, and raised agentic-harm labels on two.
Source-stated
The authors report that helpfulness clauses made agentic harm worse than no harness on obfuscated attacks, and that harness v22 incurred more benign tool-task refusals.
the helpfulness clauses made agentic harm worse than no harness on obfuscated attacks. A reworded clause and an input-normalisation step form harness v22, at a measured cost in benign tool-task refusal.
Source-stated
The authors caution that the reported estimates do not establish a general safety improvement because each cell was one run.
Each cell is one run, so these estimates do not establish a general safety improvement.
Source and contributor context
Khan, Mohammed Nayeem, S., Sarun Kumar K., T., Allan Kevin, Vaidya, Chirag, Tiwari, Vrishank · Article author
These are credits stated by the source; they do not establish a profile match or authorship of every passage.
Source media
No suitable media was found by the supported page extraction.
Terms and references
Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.
Statistical significance
A test of whether a result is unlikely to be due to chance alone; it does not say how large or important an effect is.
Agentic AI
AI systems that plan and carry out a series of steps toward a goal, often by using other software, rather than giving one answer.
Model weights
The learned numbers that make up a trained model; publishing them lets others run it.
arXiv
arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Editorial provenance
Version 1. Publication ID: 8f0734fa-8b7a-4ddd-8533-cfe2add77a01.
Prepared by gpt-6-luna; grounding review by gpt-6-luna.
Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-12T12:01:15.820Z. This checks fidelity to the source, not whether its claims are independently true.
Editorial selection: accept; reasons: material_development.
Observation: 48c7cac457652c413defe7f13aa0dd2df22f6e46dba547dc8a24733ce9676017. Source text hash: 1c2cf09b29db7ef244ffa8165e2b15e5238623f3a76a5663ef90826614b29b4a.
Revision and source-check history
Version 1 · 2026-11-12T12:01:15.820Z
arXiv: Enmo Safety: External, Non-invasive, Model-agnostic Oversight for Off-the-Shelf Language Models
The authors of the paper describe Enmo Safety, a safety harness that wraps a chat model without changing its weights and adjusts its safety rules through bounded updates. Each update is kept only if it lowers harm without increasing refusals of benign prompts on a held-out dev split; versions and decisions are recorded. The authors report mixed results. In tests on two models, before-and-after differences were not . In a later test of six policy models, Enmo Safety significantly lowered the unsafe rate on two, but not the other four, and raised -harm labels on two. Whether rules fired did not track outcomes, and helpfulness clauses worsened agentic harm on obfuscated attacks. The authors then describe harness v22, which combines a reworded clause with input normalisation, at a measured cost in benign tool-task refusal. The results show the promise the authors are testing: an external safety layer can be changed and audited without modifying . But its measured effects varied across models and kinds of harm. The authors caution that each test cell was one run, so the estimates do not establish a general safety improvement.
Original source
cs.AI · Article
Source details
Original source date: Nov 6, 2026 (2026-11-06).
Date basis: Date basis not provided.
Added to Escape Meridian: 2026-11-12T12:01:15.820Z. First observed: 2026-11-10T08:36:36.360Z. Retrieved: 2026-11-12T11:47:46.163Z.
Limits
The authors state that each cell is one run and that the estimates do not establish a general safety improvement. The abstract reports significant reductions in unsafe rates on two models, but not on the other four; it also reports increased -harm labels on two models. The abstract does not give the repeated-run results needed to assess whether these test estimates would be consistent across runs.
Open question
Would repeated runs of the same tests produce similar results, given that each cell was one run?
Source-stated
Enmo Safety wraps a chat model with input assessment, safety guidance, untrusted-content spotlighting, and an output guard, without modifying model weights.
We study a safety harness that improves itself without touching model weights. Enmo Safety wraps a chat model
Source-stated
An update is kept only if it lowers harm without increasing refusals of benign prompts on a held-out dev split.
an update is kept only if it lowers harm without raising refusal of benign prompts on a held-out dev split.
Source-stated
In tests on two models using 150 items and a 290-item holdout, before-and-after differences were not statistically significant.
On 150 items and on a 290-item holdout, none of the before/after differences on two models was statistically significant.
Source-stated
In a later test of six policy models on a fresh 300-item split, unsafe rates fell significantly on two models, not the other four; agentic-harm labels rose on two.
the harness cut the unsafe rate significantly on two models (12.9% to 7.1%, p = 0.035; 10.2% to 3.6%, p = 0.036), not on the other four, and raised agentic-harm labels on two.
Source-stated
The authors report that helpfulness clauses made agentic harm worse than no harness on obfuscated attacks, and that harness v22 incurred more benign tool-task refusals.
the helpfulness clauses made agentic harm worse than no harness on obfuscated attacks. A reworded clause and an input-normalisation step form harness v22, at a measured cost in benign tool-task refusal.
Source-stated
The authors caution that the reported estimates do not establish a general safety improvement because each cell was one run.
Each cell is one run, so these estimates do not establish a general safety improvement.
Source and contributor context
Khan, Mohammed Nayeem, S., Sarun Kumar K., T., Allan Kevin, Vaidya, Chirag, Tiwari, Vrishank · Article author
These are credits stated by the source; they do not establish a profile match or authorship of every passage.
Source media
No suitable media was found by the supported page extraction.
Terms and references
Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.
Statistical significance
A test of whether a result is unlikely to be due to chance alone; it does not say how large or important an effect is.
Agentic AI
AI systems that plan and carry out a series of steps toward a goal, often by using other software, rather than giving one answer.
Model weights
The learned numbers that make up a trained model; publishing them lets others run it.
arXiv
arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Editorial provenance
Version 1. Publication ID: 8f0734fa-8b7a-4ddd-8533-cfe2add77a01.
Prepared by gpt-6-luna; grounding review by gpt-6-luna.
Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-12T12:01:15.820Z. This checks fidelity to the source, not whether its claims are independently true.
Editorial selection: accept; reasons: material_development.
Observation: 48c7cac457652c413defe7f13aa0dd2df22f6e46dba547dc8a24733ce9676017. Source text hash: 1c2cf09b29db7ef244ffa8165e2b15e5238623f3a76a5663ef90826614b29b4a.
uncertain · 2026-11-12T12:01:15.820Z · anthropic/claude-opus-5.5
Publication: 8f0734fa-8b7a-4ddd-8533-cfe2add77a01
attribution — pass: The draft attributes the harness design, the results and the caution to the paper's authors. It does not present the reported effects as established fact or as Escape Meridian's view.
Authors:Mohammed Nayeem Khan, Sarun Kumar K. S., Allan Kevin T., Chirag Vaidya, Vrishank Tiwari
summary — uncertain: The draft is largely faithful and keeps the mixed, self-critical findings. One problem: 'The results show the promise the authors are testing' presents a design property as an outcome. Changeability and auditability without weight changes come from the snapshot and ledger design, not from the measured results. Smallest repair: 'The design the authors test lets an external safety layer be changed and audited without modifying model weights; its measured effects varied.' Central terms also need term-library tooltips for lay readers: agentic-harm labels, held-out dev split, policy models and obfuscated attacks.
Every version is snapshotted and every decision ledgered.
date — pass: The originalPublished value, 2026-11-06, matches the arXiv v1 submission date. It is not the later feed date.
[Submitted on 6 Nov 2026]
support — pass: The claims, limitations and question all match the abstract. These include the non-significant early results and the significant reductions on two of six models. They also include the rise in agentic-harm labels on two models, rule firing being unrelated to outcome, and helpfulness clauses worsening harm. The v22 refusal cost and the one-run caveat are also supported. The question follows from the authors' stated limitation without leading the reader.
Each cell is one run, so these estimates do not establish a general safety improvement.
media — pass: The selected media is the verified arXiv abstract page for this paper. It is the direct original source.
Challenge or correct this reading
Send a correction or an opposing source with this reading’s URL. Disagreement and uncertainty can remain unresolved.
arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Explore arXivA test of whether a result is unlikely to be due to chance alone; it does not say how large or important an effect is.
Definition referenceAI systems that plan and carry out a series of steps toward a goal, often by using other software, rather than giving one answer.
Definition referenceThe learned numbers that make up a trained model; publishing them lets others run it.
Definition referencearXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Explore arXivAI systems that plan and carry out a series of steps toward a goal, often by using other software, rather than giving one answer.
Definition referencearXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Explore arXivA test of whether a result is unlikely to be due to chance alone; it does not say how large or important an effect is.
Definition referenceAI systems that plan and carry out a series of steps toward a goal, often by using other software, rather than giving one answer.
Definition referenceThe learned numbers that make up a trained model; publishing them lets others run it.
Definition referencearXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Explore arXivAI systems that plan and carry out a series of steps toward a goal, often by using other software, rather than giving one answer.
Definition reference