Elamur Research⌕
☰
home / papers / 2026 / Inverting the Shield: Systematically Generating Safety Tests from Policy Specifications

Inverting the Shield: Systematically Generating Safety Tests from Policy Specifications

Paper · 2026 · Xiaoyue Lu, Xianglin Yang, Haijun Liu et al.

Summary

Current LLM safety evaluation depends on two approaches. Static benchmarks are costly, prone to contamination, and age quickly. Red-teaming is heuristic, and neither can show which policy clauses were actually tested. The authors propose POLARIS, which borrows specification-based testing from software engineering. It treats a safety policy as a precise description of the boundary an attack must cross, then turns that description into test cases. The pipeline has three steps:

  1. An LLM splits policy text into atomic prohibitions and encodes each one as a First-Order Logic implication, called an Abstract Violation Template (AVT).
  2. The entities and actions from these AVTs are merged into a Semantic Policy Graph, which is enriched with inferred links.
  3. Random walks over the graph produce compositional violation scenarios, which a generator LLM turns into natural-language harmful queries.

Each query can be traced back to the clause it violates. According to the authors, POLARIS reaches higher policy coverage and more successful attacks than established baselines. This matters because it gives a reproducible, coverage-driven way to check policy compliance.

Key points

  • Logic compilation was checked on 13 policy sources, including OpenAI, Claude, Google, Meta, Mistral, Deepseek, Cohere and Baidu. It averaged 9.10/10 on a fine-grained score and 92.06% binary accuracy.
  • Removing the logic layer lowered the policy-compliance rate from 92.9% to 88.9%.
  • Removing graph traversal lowered average novelty at τ = 0.6 from 28.00% to 24.80%. Average coverage at the same threshold fell from 94.90% to 93.20%.
  • Coverage and novelty were measured against AdvBench, DAN, JBB-Behaviors, LLM-Fuzz, MaliciousInstruct, MasterKey, Air-bench, HarmBench, SORRY-Bench and SOSBench.
  • The authors note two limitations: output quality depends on the input policies, and the method covers single-turn interactions only. Code is available at github.com/huac-lxy/POLARIS.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Fields, topics and concepts

📚 Shelves 7The field of science this work belongs to (OpenAlex fields).Computer Science · 16,667 worksArtificial Intelligence · 16,194 worksArts and Humanities · 16,039 worksLanguage and Linguistics · 15,891 worksSocial Sciences · 1,772 worksSafety Research · 543 worksSoftware · 92 works

🧭 Topics 1Research subjects and languages the work is about.Bias, fairness & safety · 517 works

Cite

Cite as Xiaoyue Lu, Xianglin Yang, Haijun Liu, Jiahao Liu, Kuntai Cai, Yan Xiao and Jin Song Dong. 2026. Inverting the Shield: Systematically Generating Safety Tests from Policy Specifications. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.acl-long.1417

@inproceedings{lu2026inverting,
  title = {{Inverting the Shield: Systematically Generating Safety Tests from Policy Specifications}},
  author = {Xiaoyue Lu, Xianglin Yang, Haijun Liu, Jiahao Liu, Kuntai Cai, Yan Xiao and Jin Song Dong},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.1417},
  url = {https://doi.org/10.18653/v1/2026.acl-long.1417}
}

References

57 references, 15 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Anthropic. Anthropic acceptable use policy. Jinze Bai, Shuai Bai, Yunfei Chu, Zeyu Cui, Kai Dang, Xiaodong Deng, Yang Fan, Wenbin Ge, Yu Han, Fei Huang, Binyuan Hui, Luo Ji, Mei Li, Junyang Lin, Runji Lin, Dayiheng Liu, Gao Liu, Chengqiang Lu, Keming Lu, and 29 others. 2023. Qwen technical report. a…
  2. Patrick Chao, Edoardo Debenedetti, Alexander Robey, Maksym Andriushchenko, Francesco Croce, Vikash Sehwag, Edgar Dobriban, Nicolas Flammarion, George J. Pappas, Florian Tramèr, Hamed Hassani, and Eric Wong. 2025. Jailbreakbench: an open robustness benchmark for jailbreaking large language models. In…
  3. Wei-Lin Chiang, Zhuohan Li, Ying Sheng Zi Lin, Zhanghao Wu, Hao Zhang, Lianmin Zheng, Siyuan Zhuang, Yonghao Zhuang, Joseph E. Gonzalez, Ion Stoica, , and Eric P. Xing. 2023. Vicuna: An open-source chatbot impressing gpt-4 with 90%* chatgpt quality. find
  4. Cohere. Cohere for ai acceptable use policy. etc. Cyberspace Administration of China. 2023. Interim measures for the management of generative artificial intelligence services. find
  5. Shaona Ghosh, Prasoon Varshney, Erick Galinkin, and Christopher Parisien. 2024. Aegis: Online adaptive ai content safety moderation with ensemble of llm experts. Preprint, arXiv:2404.05993. — [arXiv:2404.05993](https://arxiv.org/abs/2404.05993) find
  6. Harrison Goldstein, Joseph W. Cutler, Daniel Dick-stein, Benjamin C. Pierce, and Andrew Head. 2024. Property-based testing in practice. In Proceedings of the IEEE/ACM 46th International Conference on Software Engineering, ICSE ’24, New York, NY, USA. Association for Computing Machinery. find
  7. Google. Google generative ai prohibited use policy. find
  8. Sagar Goyal, Eti Rastogi, Sree Prasanna Rajagopal, Dong Yuan, Fen Zhao, Jai Chintagunta, Gautam Naik, and Jeff Ward. 2024. Healai: A healthcare llm for effective medical documentation. In Proceedings of the 17th ACM International Conference on Web Search and Data Mining, WSDM ’24, New York, NY, USA.… find
  9. Weiyang Guo, Jing Li, Wenya Wang, YU LI, Daojing He, Jun Yu, and Min Zhang. 2025. Mtsa: Multi-turn safety alignment for llms through multi-round red-teaming. Preprint, arXiv:2505.17147.
  10. Weiyang Guo, Zesheng Shi, Zeen Zhu, Yuan Zhou, Min Zhang, and Jing Li. 2026. Backdoors in rlvr: Jailbreak backdoors in llms from verifiable reward. Preprint, arXiv:2604.09748.
  11. Dibyendu Brinto Bose. 2025. From prompts to properties: Rethinking llm code generation with property-based testing. In Proceedings of the 33rd ACM International Conference on the Foundations of Software Engineering, FSE Companion ’25, New York, NY, USA. Association for Computing Machinery. find
  12. Zhang-Wei Hong, Idan Shenfeld, Tsun-Hsuan Wang, Yung-Sung Chuang, Aldo Pareja, James R. Glass, Akash Srivastava, and Pulkit Agrawal. 2025. Curiosity-driven red teaming for large language models. In Red Teaming GenAI: What Can We Learn from Adversaries? find
  13. Albert Q. Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, Lélio Renard Lavaud, Marie-Anne Lachaux, Pierre Stock, Teven Le Scao, Thibaut Lavril, Thomas Wang, Timothée Lacroix,… find
  14. Fengqing Jiang, Fengbo Ma, Zhangchen Xu, Yuetai Li, Bhaskar Ramasubramanian, Luyao Niu, Bo Li, Xianyan Chen, Zhen Xiang, and Radha Poovendran. 2025. Sosbench: Benchmarking safety alignment on scientific knowledge. Preprint, arXiv:2505.21605. — [arXiv:2505.21605](https://arxiv.org/abs/2505.21605) find
  15. Inbal Magar and Roy Schwartz. 2022. Data contamination: From memorization to exploitation. In Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers), pages 157–165, Dublin, Ireland. Association for Computational Linguistics. find
  16. Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, David Forsyth, and Dan Hendrycks. 2024. Harmbench: a standardized evaluation framework for automated red teaming and robust refusal. In ICML, ICML’24. JMLR.org.
  17. Hengle Jiang and Ke Tang. 2026. Why agents compromise safety under pressure. Preprint, arXiv:2603.14975. find
  18. Meta. Meta llama-2’s acceptable use policy. find
  19. Liwei Jiang, Kavel Rao, Seungju Han, Allyson Ettinger, Faeze Brahman, Sachin Kumar, Niloofar Mireshghallah, Ximing Lu, Maarten Sap, Yejin Choi, and Nouha Dziri. 2024a. Wildteaming at scale: From in-the-wild jailbreaks to (adversarially) safer language models. Preprint, arXiv:2406.18510.
  20. Ministry of Science and etc. Technology. 2023. Scientific and technological ethics review regulation (trial). find
  21. Yuancheng Jiang, Jiahao Liu, Jinsheng Ba, Roland HC Yap, Zhenkai Liang, and Manuel Rigger. 2024b. Detecting logic bugs in graph database management systems via injective and surjective graph query transformation. In Proceedings of the 46th IEEE/ACM International Conference on Software Engineering. find
  22. Priyanshu Kumar, Devansh Jain, Akhila Yerukola, Liwei Jiang, Himanshu Beniwal, Thomas Hartvigsen, and Maarten Sap. 2025. Polyguard: A multilingual safety moderation tool for 17 languages. Preprint, arXiv:2504.04377. — [arXiv:2504.04377](https://arxiv.org/abs/2504.04377) find
  23. Mariam Lahami, Moez Krichen, Hajer Barhoumi, and Mohamed Jmaiel. 2015. Selective test generation approach for testing dynamic behavioral adaptations. In Testing Software and Systems, pages 224–239, Cham. Springer International Publishing. find
  24. Jiahao Liu, Bonan Ruan, Xianglin Yang, Zhiwei Lin, Yan Liu, Yang Wang, Tao Wei, and Zhenkai Liang. 2025. Traceaegis: Securing llm-based agents via hierarchical and behavioral anomaly detection. arXiv preprint arXiv:2510.11203. — [arXiv:2510.11203](https://arxiv.org/abs/2510.11203) find
  25. AI @ Meta Llama Team. 2024. The llama 3 herd of models. Preprint, arXiv:2407.21783.
  26. Haipeng Luo, Qingfeng Sun, Can Xu, Pu Zhao, Jian-guang Lou, Chongyang Tao, Xiubo Geng, Qingwei Lin, Shifeng Chen, and Dongmei Zhang. 2023. Wizardmath: Empowering mathematical reasoning for large language models via reinforced evol-instruct. arXiv preprint arXiv:2308.09583.
  27. Ziyang Luo, Can Xu, Pu Zhao, Qingfeng Sun, Xiubo Geng, Wenxiang Hu, Chongyang Tao, Jing Ma, Qingwei Lin, and Daxin Jiang. 2024. Wizardcoder: Empowering code large language models with evol-instruct. In The Twelfth International Conference on Learning Representations. find
  28. Mistral. Mistral’s legal terms and conditions. OpenAI. Openai usage policies. find
  29. Zhenhui Ou, Dawei Li, Zhen Tan, Wenlin Li, Huan Liu, and Siyuan Song. 2025. Building safer sites: A large-scale multi-level dataset for construction safety research. Preprint, arXiv:2508.09203. — [arXiv:2508.09203](https://arxiv.org/abs/2508.09203) find
  30. Hassan Sartaj, Muhammad Zohaib Iqbal, Atif Aftab Ahmed Jilani, and Muhammad Uzair Khan. 2019. A search-based approach to generate mc/dc test data for ocl constraints. In Search-Based Software Engineering: 11th International Symposium, SSBSE 2019, Tallinn, Estonia, August 31 – September 1, 2019, Proc… find
  31. Phil Stocks and David Carrington. 1996. A framework for specification-based testing. IEEE Trans. Softw. Eng., 22(11):777–793. find
  32. Gemma Team, Thomas Mesnard, Cassidy Hardin, Robert Dadashi, Surya Bhupatiraju, Shreya Pathak, Laurent Sifre, Morgane Rivière, Mihir Sanjay Kale, Juliette Love, Pouya Tafti, Léonard Hussenot, Pier Giuseppe Sessa, Aakanksha Chowdhery, Adam Roberts, Aditya Barua, Alex Botev, Alex Castro-Ros, Ambrose Sl… find
  33. Qwen Team. 2025. Qwen3 technical report. Preprint, arXiv:2505.09388. etc. The Cyberspace Administration of China. 2021. Provisions on the management of algorithmic recommendations in internet information services. etc. The Cyberspace Administration of China. 2022. Provisions on the administration of…
  34. Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, Dan Bikel, Lukas Blecher, Cristian Canton Ferrer, Moya Chen, Guillem Cucurull, David Esiobu, Jude Fernandes, Jeremy Fu, Wenyin Fu, and 49 others… — Llama 2: Open Foundation and Fine-Tuned Chat Models
  35. Thaís Harumi Ussami, Eliane Martins, and Leonardo Montecchi. 2016. D-mbtdd: An approach for reusing test artefacts in evolving system. In 2016 46th Annual IEEE/IFIP International Conference on Dependable Systems and Networks Workshop (DSN-W). find
  36. Neeraj Varshney, Pavel Dolin, Agastya Seth, and Chitta Baral. 2024. The art of defending: A systematic evaluation and analysis of LLM defense strategies on safety and over-defensiveness. In Findings of the Association for Computational Linguistics: ACL 2024, pages 13111–13128, Bangkok, Thailand. Ass… find
  37. Haoyu Wang, Zeyu Qin, Li Shen, Xueqian Wang, Dacheng Tao, and Minhao Cheng. 2025. Safety reasoning with guidelines. In Forty-second International Conference on Machine Learning. find
  38. Wenqiang Wang, XIAO Yan, Huiyu Zhou, Peng Chen, Si-Yuan Liang, Xiaochun Cao, and 1 others. Simplify in-context learning. find
  39. Wenxuan Wang, Zhaopeng Tu, Chang Chen, Youliang Yuan, Jen-tse Huang, Wenxiang Jiao, and Michael Lyu. 2024. All languages matter: On the multilingual safety of LLMs. In Findings of the Association for Computational Linguistics: ACL 2024, pages 5865– 5877, Bangkok, Thailand. Association for Computatio… find
  40. Aidan Wen, Norah A. Alzahrani, Jingzhi Jiang, Andrew Joe, Karen Shieh, Andy Zhang, Basel Alomair, and David Wagner. 2025. Seedaichemy: Llm-driven seed corpus generation for fuzzing. Preprint, arXiv:2511.12448. — [arXiv:2511.12448](https://arxiv.org/abs/2511.12448) find
  41. Tinghao Xie, Xiangyu Qi, Yi Zeng, Yangsibo Huang, Udari Madhushani Sehwag, Kaixuan Huang, Luxi He, Boyi Wei, Dacheng Li, Ying Sheng, Ruoxi Jia, Bo Li, Kai Li, Danqi Chen, Peter Henderson, and Prateek Mittal. 2025. SORRY-bench: Systematically evaluating large language model safety refusal. In The Thi… find
  42. Yiheng Xiong, Ting Su, Jue Wang, Jingling Sun, Geguang Pu, and Zhendong Su. 2024. General and practical property-based testing for android apps. In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering, ASE ’24, page 53–64, New York, NY, USA. Association for Com… find
  43. Can Xu, Qingfeng Sun, Kai Zheng, Xiubo Geng, Pu Zhao, Jiazhan Feng, Chongyang Tao, Qingwei Lin, and Daxin Jiang. 2024a. WizardLM: Empowering large pre-trained language models to follow complex instructions. In The Twelfth International Conference on Learning Representations.
  44. Zhangchen Xu, Fengqing Jiang, Luyao Niu, Yuntian Deng, Radha Poovendran, Yejin Choi, and Bill Yuchen Lin. 2024b. Magpie: Alignment data synthesis from scratch by prompting aligned llms with nothing. Preprint, arXiv:2406.08464.
  45. Qian Yang, Jin Xu, Wenrui Liu, Yunfei Chu, Ziyue Jiang, Xiaohuan Zhou, Yichong Leng, Yuanjun Lv, Zhou Zhao, Chang Zhou, and Jingren Zhou. 2024a. Air-bench: Benchmarking large audio-language models via generative comprehension. Preprint, arXiv:2402.07729.
  46. Xianglin Yang, Gelei Deng, Jieming Shi, Tianwei Zhang, and Jin Song Dong. 2026. Enhancing model defense against jailbreaks with proactive safety reasoning. Preprint, arXiv:2501.19180. — [arXiv:2501.19180](https://arxiv.org/abs/2501.19180) find
  47. XIANGLIN YANG, Yufei He, Shuo Ji, Bryan Hooi, and Jin Song Dong. 2026. Zombie agents: Persistent control of self-evolving LLM agents via self-reinforcing injections. In ICLR 2026 Workshop on Lifelong Agents: Learning, Aligning, Evolving. find
  48. Ziqi Yang, Xuhai Xu, Bingsheng Yao, Ethan Rogers, Shao Zhang, Stephen Intille, Nawar Shara, Guodong Gordon Gao, and Dakuo Wang. 2024b. Talk2care: An llm-based voice assistant for communication between healthcare providers and older adults. Proc. ACM Interact. Mob. Wearable Ubiquitous Technol., 8(2). find
  49. Haneul Yoo, Yongjin Yang, and Hwaran Lee. 2025. Code-switching red-teaming: LLM evaluation for safety and multilingual understanding. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 13392–13413, Vienna, Austria. Association fo…
  50. Xiaohan Yuan, Jinfeng Li, Dongxia Wang, Yuefeng Chen, Xiaofeng Mao, Longtao Huang, Jialuo Chen, Hui Xue, Xiaoxia Liu, Wenhai Wang, Kui Ren, and Jingyi Wang. 2025. S-eval: Towards automated and comprehensive safety evaluation for large language models. Proc. ACM Softw. Eng., 2(ISSTA). find
  51. Yi Zeng, Yu Yang, Andy Zhou, Jeffrey Ziwei Tan, Yuheng Tu, Yifan Mai, Kevin Klyman, Minzhou Pan, Ruoxi Jia, Dawn Song, and 1 others. 2024. find
  52. Air-bench 2024: A safety benchmark based on risk categories from regulations and policies. CoRR. find
  53. Yedi Zhang, Haoyu Wang, Xianglin Yang, Jin Song Dong, and Jun Sun. 2026. Llm-enabled applications require system-level threat monitoring. Preprint, arXiv:2602.19844. — [arXiv:2602.19844](https://arxiv.org/abs/2602.19844) find
  54. Yi Zhang, An Zhang, XiuYu Zhang, Leheng Sheng, Yuxin Chen, Zhenkai Liang, and Xiang Wang. 2025. find
  55. Alphaalign: Incentivizing safety alignment with extremely simplified reinforcement learning. Preprint, arXiv:2507.14987. — [arXiv:2507.14987](https://arxiv.org/abs/2507.14987) find
  56. Andy Zou, Zifan Wang, J. Zico Kolter, and Matt Fredrikson. 2023. Universal and transferable adversarial attacks on aligned language models. Preprint, arXiv:2307.15043.
  57. Overview of the Appendix This appendix includes our supplementary materials as follows: • More details of the experimental setup are reported in Appendix A • Additional experimental details and comprehensive results are provided in the Appendix B. find

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/lu-2026-inverting-shield-systematically-generating-safety/