A new technique patches safety classifiers after they are already wrong, no retraining required.
Researchers built Regime-Conditional Verification (RCV), a lightweight wrapper that sits on top of an off-the-shelf safety classifier. It reads the classifier's internal representations to estimate the probability that a given prediction disagrees with the deployer's intended policy, then selectively corrects the predictions it flags as likely wrong. The same correctness signal doubles as a drift detector: since it needs no labels, it can flag when live traffic has moved away from what the classifier was trained on. Tested across three off-the-shelf classifiers and two benchmark datasets, RCV improved policy adherence in every combination, catching up to 81 percent of unsafe content the classifiers had been missing.
Safety classifiers usually fail in one of two boring but costly ways: they were trained to enforce someone else's rules, or their accuracy quietly erodes as real-world traffic shifts. RCV treats both as a monitoring-and-correction problem instead of a retrain problem, which matters because retraining is slow, expensive, and hard to justify until something has already gone wrong. In a deployment study built around ten attack campaigns deliberately excluded from RCV's training data, the system still caught every one, and most instances of drift got repaired by updating the correction layer rather than the classifier itself.
The results come from the paper's own benchmark and a single deployment study, and the 0.81 catch-rate is a ceiling figure, not a typical outcome. The real test is whether wrapper-style patches like this hold up against the next attack campaign nobody has thought of yet.