{"id":"8ec9d1669e01b43229dd5b9138721a0d539f42b729a921701ae9aeb92bc3c66a","title":"arXiv: Enmo Safety: External, Non-invasive, Model-agnostic Oversight for Off-the-Shelf Language Models","argument":"The authors of the arXiv paper describe Enmo Safety, a safety harness that wraps a chat model without changing its weights and adjusts its safety rules through bounded updates. Each update is kept only if it lowers harm without increasing refusals of benign prompts on a held-out dev split; versions and decisions are recorded. The authors report mixed results. In tests on two models, before-and-after differences were not statistically significant. In a later test of six policy models, Enmo Safety significantly lowered the unsafe rate on two, but not the other four, and raised agentic-harm labels on two. Whether rules fired did not track outcomes, and helpfulness clauses worsened agentic harm on obfuscated attacks. The authors then describe harness v22, which combines a reworded clause with input normalisation, at a measured cost in benign tool-task refusal. The results show the promise the authors are testing: an external safety layer can be changed and audited without modifying model weights. But its measured effects varied across models and kinds of harm. The authors caution that each test cell was one run, so the estimates do not establish a general safety improvement.","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The authors state that each cell is one run and that the estimates do not establish a general safety improvement. The abstract reports significant reductions in unsafe rates on two models, but not on the other four; it also reports increased agentic-harm labels on two models. The abstract does not give the repeated-run results needed to assess whether these test estimates would be consistent across runs.","speaker":{"name":"Khan, Mohammed Nayeem, S., Sarun Kumar K., T., Allan Kevin, Vaidya, Chirag, Tiwari, Vrishank","roleAtSource":"Article author"},"source":{"title":"Enmo Safety: External, Non-invasive, Model-agnostic Oversight for Off-the-Shelf Language Models","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2611.10099","publishedAt":"2026-11-06","dateBasis":"Date basis not provided."},"evidence":[{"text":"Enmo Safety wraps a chat model with input assessment, safety guidance, untrusted-content spotlighting, and an output guard, without modifying model weights.","excerpt":"We study a safety harness that improves itself without touching model weights. Enmo Safety wraps a chat model","url":"https://arxiv.org/abs/2611.10099","relationship":"Source-stated"},{"text":"An update is kept only if it lowers harm without increasing refusals of benign prompts on a held-out dev split.","excerpt":"an update is kept only if it lowers harm without raising refusal of benign prompts on a held-out dev split.","url":"https://arxiv.org/abs/2611.10099","relationship":"Source-stated"},{"text":"In tests on two models using 150 items and a 290-item holdout, before-and-after differences were not statistically significant.","excerpt":"On 150 items and on a 290-item holdout, none of the before/after differences on two models was statistically significant.","url":"https://arxiv.org/abs/2611.10099","relationship":"Source-stated"},{"text":"In a later test of six policy models on a fresh 300-item split, unsafe rates fell significantly on two models, not the other four; agentic-harm labels rose on two.","excerpt":"the harness cut the unsafe rate significantly on two models (12.9% to 7.1%, p = 0.035; 10.2% to 3.6%, p = 0.036), not on the other four, and raised agentic-harm labels on two.","url":"https://arxiv.org/abs/2611.10099","relationship":"Source-stated"},{"text":"The authors report that helpfulness clauses made agentic harm worse than no harness on obfuscated attacks, and that harness v22 incurred more benign tool-task refusals.","excerpt":"the helpfulness clauses made agentic harm worse than no harness on obfuscated attacks. A reworded clause and an input-normalisation step form harness v22, at a measured cost in benign tool-task refusal.","url":"https://arxiv.org/abs/2611.10099","relationship":"Source-stated"},{"text":"The authors caution that the reported estimates do not establish a general safety improvement because each cell was one run.","excerpt":"Each cell is one run, so these estimates do not establish a general safety improvement.","url":"https://arxiv.org/abs/2611.10099","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.10099","checkedAt":"2026-11-12T12:32:22.116Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"Would repeated runs of the same tests produce similar results, given that each cell was one run?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"arXiv: Enmo Safety: External, Non-invasive, Model-agnostic Oversight for Off-the-Shelf Language Models","summary":"The authors of the arXiv paper describe Enmo Safety, a safety harness that wraps a chat model without changing its weights and adjusts its safety rules through bounded updates. Each update is kept only if it lowers harm without increasing refusals of benign prompts on a held-out dev split; versions and decisions are recorded. The authors report mixed results. In tests on two models, before-and-after differences were not statistically significant. In a later test of six policy models, Enmo Safety significantly lowered the unsafe rate on two, but not the other four, and raised agentic-harm labels on two. Whether rules fired did not track outcomes, and helpfulness clauses worsened agentic harm on obfuscated attacks. The authors then describe harness v22, which combines a reworded clause with input normalisation, at a measured cost in benign tool-task refusal. The results show the promise the authors are testing: an external safety layer can be changed and audited without modifying model weights. But its measured effects varied across models and kinds of harm. The authors caution that each test cell was one run, so the estimates do not establish a general safety improvement.","question":"Would repeated runs of the same tests produce similar results, given that each cell was one run?","claims":[{"text":"Enmo Safety wraps a chat model with input assessment, safety guidance, untrusted-content spotlighting, and an output guard, without modifying model weights.","excerpt":"We study a safety harness that improves itself without touching model weights. Enmo Safety wraps a chat model","support":"source-stated"},{"text":"An update is kept only if it lowers harm without increasing refusals of benign prompts on a held-out dev split.","excerpt":"an update is kept only if it lowers harm without raising refusal of benign prompts on a held-out dev split.","support":"source-stated"},{"text":"In tests on two models using 150 items and a 290-item holdout, before-and-after differences were not statistically significant.","excerpt":"On 150 items and on a 290-item holdout, none of the before/after differences on two models was statistically significant.","support":"source-stated"},{"text":"In a later test of six policy models on a fresh 300-item split, unsafe rates fell significantly on two models, not the other four; agentic-harm labels rose on two.","excerpt":"the harness cut the unsafe rate significantly on two models (12.9% to 7.1%, p = 0.035; 10.2% to 3.6%, p = 0.036), not on the other four, and raised agentic-harm labels on two.","support":"source-stated"},{"text":"The authors report that helpfulness clauses made agentic harm worse than no harness on obfuscated attacks, and that harness v22 incurred more benign tool-task refusals.","excerpt":"the helpfulness clauses made agentic harm worse than no harness on obfuscated attacks. A reworded clause and an input-normalisation step form harness v22, at a measured cost in benign tool-task refusal.","support":"source-stated"},{"text":"The authors caution that the reported estimates do not establish a general safety improvement because each cell was one run.","excerpt":"Each cell is one run, so these estimates do not establish a general safety improvement.","support":"source-stated"}],"limitations":["The authors state that each cell is one run and that the estimates do not establish a general safety improvement.","The abstract reports significant reductions in unsafe rates on two models, but not on the other four; it also reports increased agentic-harm labels on two models.","The abstract does not give the repeated-run results needed to assess whether these test estimates would be consistent across runs."],"mediaId":"d32b277c71bf8d43bc4286662c98dadadfd94d9571c8a7fef2e40292a464f42e","correctionReason":null,"id":"8ec9d1669e01b43229dd5b9138721a0d539f42b729a921701ae9aeb92bc3c66a","publicationId":"8f0734fa-8b7a-4ddd-8533-cfe2add77a01","version":1,"sourceUrl":"https://arxiv.org/abs/2611.10099","sourceTitle":"Enmo Safety: External, Non-invasive, Model-agnostic Oversight for Off-the-Shelf Language Models","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-11-06","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-11-10T08:36:36.360Z","createdAt":"2026-11-12T12:01:15.820Z","historical":true,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"d32b277c71bf8d43bc4286662c98dadadfd94d9571c8a7fef2e40292a464f42e","kind":"article","url":"https://arxiv.org/abs/2611.10099","sourceUrl":"https://arxiv.org/abs/2611.10099","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-12T11:47:46.507Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.10099","checkedAt":"2026-11-12T12:32:22.116Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v6","mediaId":"d32b277c71bf8d43bc4286662c98dadadfd94d9571c8a7fef2e40292a464f42e","confidence":0.71,"provider":"typesafe","model":"jev-1.13.0","inputHash":"645258479e867586597485f7c16c1c504be505a5e181d8983520c58d1e801370","decidedAt":"2026-11-12T11:47:48.845Z"},"provenance":{"textHash":"1c2cf09b29db7ef244ffa8165e2b15e5238623f3a76a5663ef90826614b29b4a","observationId":"48c7cac457652c413defe7f13aa0dd2df22f6e46dba547dc8a24733ce9676017","retrievedAt":"2026-11-12T11:47:46.163Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"d643222f-4c86-4742-8b55-c773ab709049"},"reviewer":{"model":"gpt-6-luna","runId":"ec1a4f0e-6c93-408b-8203-124c9678c4b2"}},"audit":{"status":"uncertain","reviewedAt":"2026-11-12T12:01:15.820Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Khan, Mohammed Nayeem","url":null,"kind":"unknown"},{"name":"S., Sarun Kumar K.","url":null,"kind":"unknown"},{"name":"T., Allan Kevin","url":null,"kind":"unknown"},{"name":"Vaidya, Chirag","url":null,"kind":"unknown"},{"name":"Tiwari, Vrishank","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Khan, Mohammed Nayeem","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Khan, Mohammed Nayeem","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.10099","locator":"head/meta[name=author|citation_author]"},"assertionId":"44ac8da9c29a872012387915e090cfcf2bb2b1612d0680822aff3fab36b23daf:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-12T12:32:22.116Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"44ac8da9c29a872012387915e090cfcf2bb2b1612d0680822aff3fab36b23daf","sourceUrl":"https://arxiv.org/abs/2611.10099","contentSha256":"16256cbdc27c74c387184e493490dc48ffc9bf244255a0a719d03a9f706d7b67","textHash":"1c2cf09b29db7ef244ffa8165e2b15e5238623f3a76a5663ef90826614b29b4a","observedAt":"2026-11-12T12:32:22.116Z"}},{"actor":{"name":"S., Sarun Kumar K.","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"S., Sarun Kumar K.","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.10099","locator":"head/meta[name=author|citation_author]"},"assertionId":"44ac8da9c29a872012387915e090cfcf2bb2b1612d0680822aff3fab36b23daf:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-12T12:32:22.116Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"44ac8da9c29a872012387915e090cfcf2bb2b1612d0680822aff3fab36b23daf","sourceUrl":"https://arxiv.org/abs/2611.10099","contentSha256":"16256cbdc27c74c387184e493490dc48ffc9bf244255a0a719d03a9f706d7b67","textHash":"1c2cf09b29db7ef244ffa8165e2b15e5238623f3a76a5663ef90826614b29b4a","observedAt":"2026-11-12T12:32:22.116Z"}},{"actor":{"name":"T., Allan Kevin","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"T., Allan Kevin","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.10099","locator":"head/meta[name=author|citation_author]"},"assertionId":"44ac8da9c29a872012387915e090cfcf2bb2b1612d0680822aff3fab36b23daf:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-12T12:32:22.116Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"44ac8da9c29a872012387915e090cfcf2bb2b1612d0680822aff3fab36b23daf","sourceUrl":"https://arxiv.org/abs/2611.10099","contentSha256":"16256cbdc27c74c387184e493490dc48ffc9bf244255a0a719d03a9f706d7b67","textHash":"1c2cf09b29db7ef244ffa8165e2b15e5238623f3a76a5663ef90826614b29b4a","observedAt":"2026-11-12T12:32:22.116Z"}},{"actor":{"name":"Vaidya, Chirag","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Vaidya, Chirag","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.10099","locator":"head/meta[name=author|citation_author]"},"assertionId":"44ac8da9c29a872012387915e090cfcf2bb2b1612d0680822aff3fab36b23daf:participation:3","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-12T12:32:22.116Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"44ac8da9c29a872012387915e090cfcf2bb2b1612d0680822aff3fab36b23daf","sourceUrl":"https://arxiv.org/abs/2611.10099","contentSha256":"16256cbdc27c74c387184e493490dc48ffc9bf244255a0a719d03a9f706d7b67","textHash":"1c2cf09b29db7ef244ffa8165e2b15e5238623f3a76a5663ef90826614b29b4a","observedAt":"2026-11-12T12:32:22.116Z"}},{"actor":{"name":"Tiwari, Vrishank","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Tiwari, Vrishank","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.10099","locator":"head/meta[name=author|citation_author]"},"assertionId":"44ac8da9c29a872012387915e090cfcf2bb2b1612d0680822aff3fab36b23daf:participation:4","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-12T12:32:22.116Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"44ac8da9c29a872012387915e090cfcf2bb2b1612d0680822aff3fab36b23daf","sourceUrl":"https://arxiv.org/abs/2611.10099","contentSha256":"16256cbdc27c74c387184e493490dc48ffc9bf244255a0a719d03a9f706d7b67","textHash":"1c2cf09b29db7ef244ffa8165e2b15e5238623f3a76a5663ef90826614b29b4a","observedAt":"2026-11-12T12:32:22.116Z"}}],"participationCoverage":{"total":5,"returned":5,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2611.10099","snapshotId":"44ac8da9c29a872012387915e090cfcf2bb2b1612d0680822aff3fab36b23daf","contentSha256":"16256cbdc27c74c387184e493490dc48ffc9bf244255a0a719d03a9f706d7b67","textHash":"1c2cf09b29db7ef244ffa8165e2b15e5238623f3a76a5663ef90826614b29b4a","observedAt":"2026-11-12T12:32:22.116Z","basis":"publisher-page-metadata","sourceLinks":43,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/8ec9d1669e01b43229dd5b9138721a0d539f42b729a921701ae9aeb92bc3c66a/source"}},"canonicalUrl":"https://escapemeridian.com/readings/arxiv-enmo-safety-external-non-invasive-model-agnostic-8ec9d166","formats":{"html":"/readings/arxiv-enmo-safety-external-non-invasive-model-agnostic-8ec9d166","markdown":"/readings/arxiv-enmo-safety-external-non-invasive-model-agnostic-8ec9d166.md","json":"/readings/arxiv-enmo-safety-external-non-invasive-model-agnostic-8ec9d166.json"},"attribution":"Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.","maintainedGuideLinks":[],"readerContext":{"version":"reader-context-v1","attribution":"Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.","terms":[{"id":"term-statistical-significance","name":"Statistical significance","explanation":"A test of whether a result is unlikely to be due to chance alone; it does not say how large or important an effect is.","referenceUrl":"https://en.wikipedia.org/wiki/Statistical_significance"},{"id":"term-agentic","name":"Agentic AI","explanation":"AI systems that plan and carry out a series of steps toward a goal, often by using other software, rather than giving one answer.","referenceUrl":"https://developers.google.com/machine-learning/glossary#agentic"},{"id":"term-model-weights","name":"Model weights","explanation":"The learned numbers that make up a trained model; publishing them lets others run it.","referenceUrl":"https://developers.google.com/machine-learning/glossary#weight"}],"entities":[{"id":"arxiv","name":"arXiv","kind":"organization","context":"arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.","referenceUrls":["https://arxiv.org/","https://info.arxiv.org/help/api/index.html"],"path":"/entities/arxiv","json":"/entities/arxiv.json","markdown":"/entities/arxiv.md"}]},"researchQuestions":[],"withdrawn":false,"references":{"schemaVersion":1,"target":{"type":"reading","id":"8ec9d1669e01b43229dd5b9138721a0d539f42b729a921701ae9aeb92bc3c66a","revision":"8f0734fa-8b7a-4ddd-8533-cfe2add77a01","revisionKind":"publication-id","title":"arXiv: Enmo Safety: External, Non-invasive, Model-agnostic Oversight for Off-the-Shelf Language Models","url":"https://escapemeridian.com/readings/arxiv-enmo-safety-external-non-invasive-model-agnostic-8ec9d166"},"source":{"type":"source","id":"https://arxiv.org/abs/2611.10099","revision":"1c2cf09b29db7ef244ffa8165e2b15e5238623f3a76a5663ef90826614b29b4a","revisionKind":"sha256-source-text","title":"Enmo Safety: External, Non-invasive, Model-agnostic Oversight for Off-the-Shelf Language Models","url":"https://arxiv.org/abs/2611.10099"},"status":"available","items":[],"next":null,"scope":"Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter."},"revisions":[{"id":"8ec9d1669e01b43229dd5b9138721a0d539f42b729a921701ae9aeb92bc3c66a","title":"arXiv: Enmo Safety: External, Non-invasive, Model-agnostic Oversight for Off-the-Shelf Language Models","argument":"The authors of the arXiv paper describe Enmo Safety, a safety harness that wraps a chat model without changing its weights and adjusts its safety rules through bounded updates. Each update is kept only if it lowers harm without increasing refusals of benign prompts on a held-out dev split; versions and decisions are recorded. The authors report mixed results. In tests on two models, before-and-after differences were not statistically significant. In a later test of six policy models, Enmo Safety significantly lowered the unsafe rate on two, but not the other four, and raised agentic-harm labels on two. Whether rules fired did not track outcomes, and helpfulness clauses worsened agentic harm on obfuscated attacks. The authors then describe harness v22, which combines a reworded clause with input normalisation, at a measured cost in benign tool-task refusal. The results show the promise the authors are testing: an external safety layer can be changed and audited without modifying model weights. But its measured effects varied across models and kinds of harm. The authors caution that each test cell was one run, so the estimates do not establish a general safety improvement.","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The authors state that each cell is one run and that the estimates do not establish a general safety improvement. The abstract reports significant reductions in unsafe rates on two models, but not on the other four; it also reports increased agentic-harm labels on two models. The abstract does not give the repeated-run results needed to assess whether these test estimates would be consistent across runs.","speaker":{"name":"Khan, Mohammed Nayeem, S., Sarun Kumar K., T., Allan Kevin, Vaidya, Chirag, Tiwari, Vrishank","roleAtSource":"Article author"},"source":{"title":"Enmo Safety: External, Non-invasive, Model-agnostic Oversight for Off-the-Shelf Language Models","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2611.10099","publishedAt":"2026-11-06","dateBasis":"Date basis not provided."},"evidence":[{"text":"Enmo Safety wraps a chat model with input assessment, safety guidance, untrusted-content spotlighting, and an output guard, without modifying model weights.","excerpt":"We study a safety harness that improves itself without touching model weights. Enmo Safety wraps a chat model","url":"https://arxiv.org/abs/2611.10099","relationship":"Source-stated"},{"text":"An update is kept only if it lowers harm without increasing refusals of benign prompts on a held-out dev split.","excerpt":"an update is kept only if it lowers harm without raising refusal of benign prompts on a held-out dev split.","url":"https://arxiv.org/abs/2611.10099","relationship":"Source-stated"},{"text":"In tests on two models using 150 items and a 290-item holdout, before-and-after differences were not statistically significant.","excerpt":"On 150 items and on a 290-item holdout, none of the before/after differences on two models was statistically significant.","url":"https://arxiv.org/abs/2611.10099","relationship":"Source-stated"},{"text":"In a later test of six policy models on a fresh 300-item split, unsafe rates fell significantly on two models, not the other four; agentic-harm labels rose on two.","excerpt":"the harness cut the unsafe rate significantly on two models (12.9% to 7.1%, p = 0.035; 10.2% to 3.6%, p = 0.036), not on the other four, and raised agentic-harm labels on two.","url":"https://arxiv.org/abs/2611.10099","relationship":"Source-stated"},{"text":"The authors report that helpfulness clauses made agentic harm worse than no harness on obfuscated attacks, and that harness v22 incurred more benign tool-task refusals.","excerpt":"the helpfulness clauses made agentic harm worse than no harness on obfuscated attacks. A reworded clause and an input-normalisation step form harness v22, at a measured cost in benign tool-task refusal.","url":"https://arxiv.org/abs/2611.10099","relationship":"Source-stated"},{"text":"The authors caution that the reported estimates do not establish a general safety improvement because each cell was one run.","excerpt":"Each cell is one run, so these estimates do not establish a general safety improvement.","url":"https://arxiv.org/abs/2611.10099","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.10099","checkedAt":"2026-11-12T12:32:22.116Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"Would repeated runs of the same tests produce similar results, given that each cell was one run?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"arXiv: Enmo Safety: External, Non-invasive, Model-agnostic Oversight for Off-the-Shelf Language Models","summary":"The authors of the arXiv paper describe Enmo Safety, a safety harness that wraps a chat model without changing its weights and adjusts its safety rules through bounded updates. Each update is kept only if it lowers harm without increasing refusals of benign prompts on a held-out dev split; versions and decisions are recorded. The authors report mixed results. In tests on two models, before-and-after differences were not statistically significant. In a later test of six policy models, Enmo Safety significantly lowered the unsafe rate on two, but not the other four, and raised agentic-harm labels on two. Whether rules fired did not track outcomes, and helpfulness clauses worsened agentic harm on obfuscated attacks. The authors then describe harness v22, which combines a reworded clause with input normalisation, at a measured cost in benign tool-task refusal. The results show the promise the authors are testing: an external safety layer can be changed and audited without modifying model weights. But its measured effects varied across models and kinds of harm. The authors caution that each test cell was one run, so the estimates do not establish a general safety improvement.","question":"Would repeated runs of the same tests produce similar results, given that each cell was one run?","claims":[{"text":"Enmo Safety wraps a chat model with input assessment, safety guidance, untrusted-content spotlighting, and an output guard, without modifying model weights.","excerpt":"We study a safety harness that improves itself without touching model weights. Enmo Safety wraps a chat model","support":"source-stated"},{"text":"An update is kept only if it lowers harm without increasing refusals of benign prompts on a held-out dev split.","excerpt":"an update is kept only if it lowers harm without raising refusal of benign prompts on a held-out dev split.","support":"source-stated"},{"text":"In tests on two models using 150 items and a 290-item holdout, before-and-after differences were not statistically significant.","excerpt":"On 150 items and on a 290-item holdout, none of the before/after differences on two models was statistically significant.","support":"source-stated"},{"text":"In a later test of six policy models on a fresh 300-item split, unsafe rates fell significantly on two models, not the other four; agentic-harm labels rose on two.","excerpt":"the harness cut the unsafe rate significantly on two models (12.9% to 7.1%, p = 0.035; 10.2% to 3.6%, p = 0.036), not on the other four, and raised agentic-harm labels on two.","support":"source-stated"},{"text":"The authors report that helpfulness clauses made agentic harm worse than no harness on obfuscated attacks, and that harness v22 incurred more benign tool-task refusals.","excerpt":"the helpfulness clauses made agentic harm worse than no harness on obfuscated attacks. A reworded clause and an input-normalisation step form harness v22, at a measured cost in benign tool-task refusal.","support":"source-stated"},{"text":"The authors caution that the reported estimates do not establish a general safety improvement because each cell was one run.","excerpt":"Each cell is one run, so these estimates do not establish a general safety improvement.","support":"source-stated"}],"limitations":["The authors state that each cell is one run and that the estimates do not establish a general safety improvement.","The abstract reports significant reductions in unsafe rates on two models, but not on the other four; it also reports increased agentic-harm labels on two models.","The abstract does not give the repeated-run results needed to assess whether these test estimates would be consistent across runs."],"mediaId":"d32b277c71bf8d43bc4286662c98dadadfd94d9571c8a7fef2e40292a464f42e","correctionReason":null,"id":"8ec9d1669e01b43229dd5b9138721a0d539f42b729a921701ae9aeb92bc3c66a","publicationId":"8f0734fa-8b7a-4ddd-8533-cfe2add77a01","version":1,"sourceUrl":"https://arxiv.org/abs/2611.10099","sourceTitle":"Enmo Safety: External, Non-invasive, Model-agnostic Oversight for Off-the-Shelf Language Models","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-11-06","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-11-10T08:36:36.360Z","createdAt":"2026-11-12T12:01:15.820Z","historical":true,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"d32b277c71bf8d43bc4286662c98dadadfd94d9571c8a7fef2e40292a464f42e","kind":"article","url":"https://arxiv.org/abs/2611.10099","sourceUrl":"https://arxiv.org/abs/2611.10099","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-12T11:47:46.507Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.10099","checkedAt":"2026-11-12T12:32:22.116Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v6","mediaId":"d32b277c71bf8d43bc4286662c98dadadfd94d9571c8a7fef2e40292a464f42e","confidence":0.71,"provider":"typesafe","model":"jev-1.13.0","inputHash":"645258479e867586597485f7c16c1c504be505a5e181d8983520c58d1e801370","decidedAt":"2026-11-12T11:47:48.845Z"},"provenance":{"textHash":"1c2cf09b29db7ef244ffa8165e2b15e5238623f3a76a5663ef90826614b29b4a","observationId":"48c7cac457652c413defe7f13aa0dd2df22f6e46dba547dc8a24733ce9676017","retrievedAt":"2026-11-12T11:47:46.163Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"d643222f-4c86-4742-8b55-c773ab709049"},"reviewer":{"model":"gpt-6-luna","runId":"ec1a4f0e-6c93-408b-8203-124c9678c4b2"}},"audit":{"status":"uncertain","reviewedAt":"2026-11-12T12:01:15.820Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Khan, Mohammed Nayeem","url":null,"kind":"unknown"},{"name":"S., Sarun Kumar K.","url":null,"kind":"unknown"},{"name":"T., Allan Kevin","url":null,"kind":"unknown"},{"name":"Vaidya, Chirag","url":null,"kind":"unknown"},{"name":"Tiwari, Vrishank","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Khan, Mohammed Nayeem","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Khan, Mohammed Nayeem","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.10099","locator":"head/meta[name=author|citation_author]"},"assertionId":"44ac8da9c29a872012387915e090cfcf2bb2b1612d0680822aff3fab36b23daf:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-12T12:32:22.116Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"44ac8da9c29a872012387915e090cfcf2bb2b1612d0680822aff3fab36b23daf","sourceUrl":"https://arxiv.org/abs/2611.10099","contentSha256":"16256cbdc27c74c387184e493490dc48ffc9bf244255a0a719d03a9f706d7b67","textHash":"1c2cf09b29db7ef244ffa8165e2b15e5238623f3a76a5663ef90826614b29b4a","observedAt":"2026-11-12T12:32:22.116Z"}},{"actor":{"name":"S., Sarun Kumar K.","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"S., Sarun Kumar K.","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.10099","locator":"head/meta[name=author|citation_author]"},"assertionId":"44ac8da9c29a872012387915e090cfcf2bb2b1612d0680822aff3fab36b23daf:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-12T12:32:22.116Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"44ac8da9c29a872012387915e090cfcf2bb2b1612d0680822aff3fab36b23daf","sourceUrl":"https://arxiv.org/abs/2611.10099","contentSha256":"16256cbdc27c74c387184e493490dc48ffc9bf244255a0a719d03a9f706d7b67","textHash":"1c2cf09b29db7ef244ffa8165e2b15e5238623f3a76a5663ef90826614b29b4a","observedAt":"2026-11-12T12:32:22.116Z"}},{"actor":{"name":"T., Allan Kevin","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"T., Allan Kevin","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.10099","locator":"head/meta[name=author|citation_author]"},"assertionId":"44ac8da9c29a872012387915e090cfcf2bb2b1612d0680822aff3fab36b23daf:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-12T12:32:22.116Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"44ac8da9c29a872012387915e090cfcf2bb2b1612d0680822aff3fab36b23daf","sourceUrl":"https://arxiv.org/abs/2611.10099","contentSha256":"16256cbdc27c74c387184e493490dc48ffc9bf244255a0a719d03a9f706d7b67","textHash":"1c2cf09b29db7ef244ffa8165e2b15e5238623f3a76a5663ef90826614b29b4a","observedAt":"2026-11-12T12:32:22.116Z"}},{"actor":{"name":"Vaidya, Chirag","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Vaidya, Chirag","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.10099","locator":"head/meta[name=author|citation_author]"},"assertionId":"44ac8da9c29a872012387915e090cfcf2bb2b1612d0680822aff3fab36b23daf:participation:3","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-12T12:32:22.116Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"44ac8da9c29a872012387915e090cfcf2bb2b1612d0680822aff3fab36b23daf","sourceUrl":"https://arxiv.org/abs/2611.10099","contentSha256":"16256cbdc27c74c387184e493490dc48ffc9bf244255a0a719d03a9f706d7b67","textHash":"1c2cf09b29db7ef244ffa8165e2b15e5238623f3a76a5663ef90826614b29b4a","observedAt":"2026-11-12T12:32:22.116Z"}},{"actor":{"name":"Tiwari, Vrishank","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Tiwari, Vrishank","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.10099","locator":"head/meta[name=author|citation_author]"},"assertionId":"44ac8da9c29a872012387915e090cfcf2bb2b1612d0680822aff3fab36b23daf:participation:4","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-12T12:32:22.116Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"44ac8da9c29a872012387915e090cfcf2bb2b1612d0680822aff3fab36b23daf","sourceUrl":"https://arxiv.org/abs/2611.10099","contentSha256":"16256cbdc27c74c387184e493490dc48ffc9bf244255a0a719d03a9f706d7b67","textHash":"1c2cf09b29db7ef244ffa8165e2b15e5238623f3a76a5663ef90826614b29b4a","observedAt":"2026-11-12T12:32:22.116Z"}}],"participationCoverage":{"total":5,"returned":5,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2611.10099","snapshotId":"44ac8da9c29a872012387915e090cfcf2bb2b1612d0680822aff3fab36b23daf","contentSha256":"16256cbdc27c74c387184e493490dc48ffc9bf244255a0a719d03a9f706d7b67","textHash":"1c2cf09b29db7ef244ffa8165e2b15e5238623f3a76a5663ef90826614b29b4a","observedAt":"2026-11-12T12:32:22.116Z","basis":"publisher-page-metadata","sourceLinks":43,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/8ec9d1669e01b43229dd5b9138721a0d539f42b729a921701ae9aeb92bc3c66a/source"}}}],"audits":[{"publicationId":"8f0734fa-8b7a-4ddd-8533-cfe2add77a01","verdict":"uncertain","findings":[{"dimension":"attribution","status":"pass","explanation":"The draft attributes the harness design, the results and the caution to the paper's authors. It does not present the reported effects as established fact or as Escape Meridian's view.","excerpt":"Authors:Mohammed Nayeem Khan, Sarun Kumar K. S., Allan Kevin T., Chirag Vaidya, Vrishank Tiwari"},{"dimension":"summary","status":"uncertain","explanation":"The draft is largely faithful and keeps the mixed, self-critical findings. One problem: 'The results show the promise the authors are testing' presents a design property as an outcome. Changeability and auditability without weight changes come from the snapshot and ledger design, not from the measured results. Smallest repair: 'The design the authors test lets an external safety layer be changed and audited without modifying model weights; its measured effects varied.' Central terms also need term-library tooltips for lay readers: agentic-harm labels, held-out dev split, policy models and obfuscated attacks.","excerpt":"Every version is snapshotted and every decision ledgered."},{"dimension":"date","status":"pass","explanation":"The originalPublished value, 2026-11-06, matches the arXiv v1 submission date. It is not the later feed date.","excerpt":"[Submitted on 6 Nov 2026]"},{"dimension":"support","status":"pass","explanation":"The claims, limitations and question all match the abstract. These include the non-significant early results and the significant reductions on two of six models. They also include the rise in agentic-harm labels on two models, rule firing being unrelated to outcome, and helpfulness clauses worsening harm. The v22 refusal cost and the one-run caveat are also supported. The question follows from the authors' stated limitation without leading the reader.","excerpt":"Each cell is one run, so these estimates do not establish a general safety improvement."},{"dimension":"media","status":"pass","explanation":"The selected media is the verified arXiv abstract page for this paper. It is the direct original source.","excerpt":null}],"createdAt":"2026-11-12T12:01:15.820Z","model":"anthropic/claude-opus-5.5"}],"correctionUrl":"https://escapemeridian.com/corrections/"}