arXiv 2512.01037, a paper first posted November 2025 and revised 12 September 2026 (v3), names a failure mode most safety audits never test for: Semantic Confusion, contradictory refusal decisions across meaning-preserving rephrasings of the same request. The practical consequence is direct. If paraphrases of a refused prompt can flip the outcome, then one refused prompt no longer proves an intent class is blocked, and audits have to probe paraphrase neighborhoods rather than single canonical prompts.
Two scope notes before the mechanism, because the evidence base is thin by design. The findings below come from a single author-reported paper, conference-accepted but not independently replicated, and nothing in it is a regulatory mandate. The abstract also names no specific models and reports no quantitative confusion rates, so the size of the effect across deployed systems is unverified. What the paper does supply is a definition, a corpus, three metrics, and an audit recommendation, which is enough to change how a compliance team designs its probes.
What Semantic Confusion actually is
The failure mode is worth separating from the one most red teams already know. Jailbreak coverage typically describes adversarial rephrasings: prompts engineered to change intent, wrap a harmful request in a roleplay, or smuggle instructions past a filter. Semantic Confusion is different and quieter. The paper defines it as contradictory refusal decisions across meaning-preserving paraphrases, cases where the surface form of the request changes but the intent stays fixed, and the model’s refusal decision flips anyway.
That distinction matters for how you interpret the result. A jailbreak tells you an attacker can construct a new input the safety boundary was never meant to cover. Semantic Confusion tells you the boundary itself is locally unstable: two prompts that mean the same thing, neither of them adversarial in construction, get different decisions. The abstract does not specify which direction the flips run (refused-to-complied versus complied-to-refused) or how often they occur, and those numbers are exactly what an internal replication would need to establish. What is established is the measurement claim: this inconsistency exists as a measurable structure, and it is invisible to the way refusal is usually reported.
This fits a pattern Groundy has tracked across audit-reliability work. LLM judge scores vary run to run. Semantic Confusion is a distinct mechanism in the same family: not variance in the evaluator, but instability in the refusal decision itself, with intent held constant so the variation cannot be explained away as a different question.
What the study built: ParaGuard and three confusion metrics
The paper’s contribution is infrastructural as much as empirical. To measure confusion, the authors built ParaGuard, a 10,000-prompt corpus organized as controlled paraphrase clusters. Each cluster holds intent fixed while varying surface form, so any difference in refusal behavior within a cluster cannot be attributed to a difference in what was asked. That design is the part auditors can reuse even if they never touch the corpus itself: the unit of testing stops being the prompt and becomes the cluster.
On top of the corpus, the paper proposes three model-agnostic, token-level metrics. The shared mechanic, per the abstract, is comparing each rejected prompt with its nearest accepted neighbors, drawing on three signals: token embeddings, next-token probabilities, and perplexity. Perplexity, for readers who have not had to define it in an audit document, is commonly defined as the canonical performance measure for language models: how well a model predicts a corpus, with higher assigned likelihood yielding lower perplexity.
| Metric | Role (inferred; the abstract gives no per-metric formulas) | Diagnostic signals | Audit use |
|---|---|---|---|
| Confusion Index | Confusion structure at the boundary, computed per rejected prompt against nearest accepted neighbors | Token embeddings, next-token probabilities, perplexity | Locate where the refusal boundary is locally inconsistent |
| Confusion Rate | Frequency of contradictory decisions across paraphrase neighborhoods | Same token-level signals | Consistency KPI alongside refusal rate |
| Confusion Depth | How far into the accepted neighborhood the confusion extends | Same token-level signals | Judge whether flips are edge cases or deep boundary failures |
The abstract names all three metrics and their shared comparison method but does not give per-metric formulas in the supplied text, so the column above describes roles, not definitions; the full paper is the authority for implementation. The point that survives without formulas is architectural: all three metrics are computed against nearest accepted neighbors, which means they measure the boundary’s local geometry rather than the model’s global behavior. “Model-agnostic” is the operative property for an audit team. You do not need vendor cooperation or internal weights to compute a consistency number, only the model’s outputs and standard token-level signals.
Why a clean refusal-rate dashboard does not clear the boundary
The paper’s sharpest finding for practitioners is about aggregate numbers: experiments across diverse model families show that the global false rejection rate can hide important structure in the refusal boundary.
Read that as a claim about dashboards. A team that reports “we refuse nearly every harmful prompt in category X” is reporting a marginal rate over a test set. If the test set contains one canonical phrasing per intent, the rate summarizes behavior at isolated points and says nothing about the neighborhoods around those points. The boundary can look clean in aggregate while being locally confused, because confusion is a within-cluster property and a single-prompt-per-intent test set has no clusters. The same caution applies in reverse: the paper’s own argument means an audit that passes today’s aggregate thresholds is not exonerated by that pass.
The hedge matters too. The finding is that global rates can hide boundary structure, not that they measure nothing. Aggregate refusal rates remain useful for trend monitoring and for catching regressions; they are insufficient as a gating criterion, which is a different and narrower claim. This is the same arithmetic logic that applied when English refusal rates failed to transfer to Indic languages: an average over the wrong partitioning conceals the variance that matters. Here the partitioning is paraphrase space rather than language.
What an audit should actually test
The paper’s conclusion doubles as an audit-design requirement: refusal evaluation should measure not only how often a model refuses, but how consistently it refuses across nearby paraphrases. Translated into a testing program, that implies four changes.
Probe with clusters, not canonical prompts. For each intent class in scope, generate or curate a set of meaning-preserving paraphrases and run all of them, holding intent fixed and varying surface form. ParaGuard’s 10k-prompt design is the reference implementation, but the principle transfers to any internal corpus: a cluster of N paraphrases per intent yields a consistency observation, where a single prompt yields only a point estimate.
Track consistency metrics next to frequency metrics. Confusion Index, Confusion Rate, and Confusion Depth give the audit three quotable numbers that the aggregate refusal rate cannot supply. The natural dashboard pairing is refusal rate (how often) beside confusion rate (how consistently), computed over the same intents.
Compare against nearest accepted neighbors. The metrics’ comparison mechanic suggests a specific diagnostic habit: when a prompt is refused, look at the closest accepted prompts in embedding and token-probability space. If near-identical requests are being accepted, the refusal was a surface-form accident, not a policy decision.
Report cluster-level results, not only marginals. An audit finding someone signs should state the consistency observed within each intent cluster, because that is the level at which the failure mode lives. This mirrors the trajectory lesson from agent security testing, where single-turn tests certified the wrong property: the unit of testing has to match the unit of failure.
One caution on scope. This framework tests the refusal decision’s stability, not the correctness of the safety policy behind it, and not what the model was thinking. Consistency probes belong alongside behavioral evaluations as evidence of record, in the same way hidden-reasoning work argues transcripts are not audit logs: behavior, not narration and not aggregate rates, is what an audit can stand on.
Evidence maturity: what one paper can and cannot support
The venue context is not a footnote here; it determines how the paper can be cited. The arXiv listing’s Comments field states the paper was accepted at the 2026 IEEE International Conference on Data Science and Advanced Analytics (DSAA 2026), so this is conference-accepted work, not an unreviewed preprint. The copy of record still sits on arXiv, an open-access repository of more than three million articles across eight subject areas, and per arXiv’s own about page, submissions there are approved after moderation that checks topicality and scholarly value, are not peer-reviewed by arXiv itself, and carry no warranty, with contents wholly the submitter’s responsibility. For anyone citing arXiv governance in compliance documents, one more recent change is worth noting: in March 2026 arXiv announced it would separate from Cornell University, becoming an independent nonprofit on 2026-07-01 to diversify funding, per Wikipedia’s arXiv entry.
The paper has been public since November 2025, and the supplied record still contains no independent replication, no contradicting benchmark, no named models, and no confusion-rate numbers. The effect’s magnitude and its generalization across deployed models, safety policies, and languages are therefore unverified. Nothing in these pages speaks to any regulatory regime; conformity-assessment angles under specific legislation are not evidenced and should not be attached to this paper. The general reason audit programs should test behavior directly rather than rely on vendor-level claims predates the paper: LLMs are observed to confidently assert claims not justified by their training data, which is why model-level alignment assertions have never been sufficient evidence of a deployed control.
The verdict: consistency-test the control, validate internally first
Treat refusal as a deployed control that must be consistency-tested, not as a model-level alignment claim. Concretely: build paraphrase clusters that hold intent fixed while varying surface form, on ParaGuard’s design; compute Confusion Index, Confusion Rate, and Confusion Depth against nearest accepted neighbors using token embeddings, next-token probabilities, and perplexity signals; and decline to clear a safety boundary on aggregate refusal-rate numbers alone. Cite arXiv 2512.01037 as conference-accepted but unreplicated work, and run the internal replication first, because the absence of named models and effect sizes in the record means your own paraphrase-neighborhood results are currently the only numbers that can support a signed finding about your deployment.
The audit method does not stand or fall with the paper’s evidence base: holding intent fixed and probing neighborhoods is sound test design whether or not Semantic Confusion replicates broadly across deployed models. Build the probes for that reason, cite the paper as the current evidence, and revisit the numbers when independent results land.
Frequently Asked Questions
What is the difference between Semantic Confusion and a jailbreak?
Jailbreak coverage typically describes adversarial rephrasings: prompts engineered to change intent, wrap a harmful request in a roleplay, or smuggle instructions past a filter. Semantic Confusion is different and quieter. The paper defines it as contradictory refusal decisions across meaning-preserving paraphrases, cases where the surface form of the request changes but the intent stays fixed, and the model’s refusal decision flips anyway.
What are the three metrics proposed to measure Semantic Confusion?
On top of the corpus, the paper proposes three model-agnostic, token-level metrics. The shared mechanic, per the abstract, is comparing each rejected prompt with its nearest accepted neighbors, drawing on three signals: token embeddings, next-token probabilities, and perplexity.
