{
  "abstract": "We study three failure modes of deployed safety classifiers: distribution shift, targeted evasion, and invalid scores from reasoning-model monitors. A reduced 800-cell subset of a pre-registered factorial (4 classifiers x 5 shifts x 20 seeds x 2 windows) gives 86.8% control-validated detection (alarm at or after onset, quiet paired no-shift stream; raw TPR 91.5%), mean latency 39.7 steps at w=100 and a classifier-by-shift crossover ($η^2 = 0.186$ complete-case; 0.02-0.03 under a censoring sensitivity analysis) that motivates per-classifier monitoring. Shifted corpora are mostly harmful prompts, so this detects a constructed score change, not accuracy loss. The density-ratio step of weighted conformal adaptation collapses for 3/4 classifiers in high-dimensional embeddings; PCA to 32 dimensions raises temporal-shift coverage (+33pp, +20.5pp). A score-disagreement canary (an un-targeted classifier compared with the primary) flags 37/49 (75.5%) of the GCG inputs DeBERTa scores as safe (Llama Guard pair; 93.9% best single canary), leaving a residual that evades both. For one fixed attack objective we describe a local stall condition (gap $= 1/(2λ)$; observed/predicted 0.86-1.00 at $λ\\geq 2$, n=20; blocked rate does not replicate). Where both models judge content harmful there is no disagreement to detect (2%, 1/50). The best-value frontier LLM canary flags 83.7% (Wilson lower bound 71%) of 49 adversarial prompts with 7/1000 benign false positives. KS false-alarm rates inflate 5.4x under heterogeneous traffic; the two CUSUM runs there conflict. On o3, GCG-appended harmful inputs need 2.5x the token budget of simple benign inputs (T50 = 117 vs 46; length and content not separated), and at 16 tokens o3, o4-mini and gemini-2.5-pro all return 0/100 valid scores.",
  "abstract_shown": true,
  "affiliations": [],
  "article_type": null,
  "arxiv": "2606.11949",
  "author_total": 1,
  "authors": [
    {
      "name": "Jun Wen Leong"
    }
  ],
  "bibtex": "https://research.draconitic.com/paper/6w8xeys6mtfpr.bib",
  "cited_by": 0,
  "doi": "10.48550/arxiv.2606.11949",
  "fulltext_url": null,
  "id": "6w8xeys6mtfpr",
  "issns": [],
  "landing_url": "https://arxiv.org/abs/2606.11949",
  "language": null,
  "licence": "CC-BY-4.0",
  "licence_label": "CC BY 4.0",
  "licence_source": "article",
  "licence_url": "http://creativecommons.org/licenses/by/4.0/",
  "metadata_licence": "CC0-1.0",
  "native_subjects": [
    [
      "arxiv",
      "cs.CR"
    ],
    [
      "arxiv",
      "cs.LG"
    ],
    [
      "arxiv",
      "stat.ML"
    ],
    [
      "openalex",
      "1702|Adversarial Robustness in Machine Learning"
    ]
  ],
  "openalex": "W7164387193",
  "pdf_url": "https://arxiv.org/pdf/2606.11949",
  "pmcid": null,
  "pmid": null,
  "published": "2026-10-25",
  "publisher": null,
  "ris": "https://research.draconitic.com/paper/6w8xeys6mtfpr.ris",
  "sources": [
    {
      "first_seen": "2026-10-30T12:35:49Z",
      "native_id": "2606.11949",
      "source": "arxiv",
      "url": "https://arxiv.org/abs/2606.11949"
    }
  ],
  "subjects": [
    {
      "field": "mathematics",
      "origin": "arxiv:stat.ML",
      "subfield": "statistics"
    }
  ],
  "title": "Online Shift Detection and Conformal Adaptation for Deployed Safety Classifiers",
  "title_text": "Online Shift Detection and Conformal Adaptation for Deployed Safety Classifiers",
  "type": "preprint",
  "updated_at": "2026-10-30T12:35:49Z",
  "url": "https://research.draconitic.com/paper/6w8xeys6mtfpr",
  "venue": "arXiv",
  "versions": []
}