Fine-tuning a guardrail classifier can plant evasion bugs your held-out eval will never catch.

New work shows that fine-tuning LLMs for security classification introduces token-level evasion vulnerabilities that standard in-distribution evaluation completely misses, because models inherit circuits while learning new semantics (arXiv). If you're shipping a fine-tuned moderation or guardrail classifier and trusting your held-out accuracy number, that number is lying to you about adversarial robustness. Test out-of-distribution and adversarially, or you're certifying a blind spot.