Should you pick a safer AI model, or harden the one you have — or is a third option better?
Is model selection a stronger security lever than improving individual model defenses?
This explores whether choosing which model handles a task (bigger, reasoning-tuned, cheaper, or a committee) protects you more than hardening any one model's own defenses.
This explores whether choosing which model handles a task protects you more than hardening any one model's own defenses. The corpus has no head-to-head test of the two. What it does show is that both levers are weaker than they look, and that a third lever, the checks and controls around the model, keeps coming out ahead.
Model selection is a shakier lever than it seems. The more capable pick can be the more exposed one. Multi-turn manipulative prompts cut reasoning-model accuracy by 25-29%, more than they cut standard models, because long reasoning chains give a single wrong step more places to take hold Are reasoning models actually more vulnerable to manipulation?. Reasoning models can also be steered by a harmful but benign-sounding plan planted in their context. They paraphrase it as their own reasoning, and it slips past chain-of-thought monitors 25-33% of the time Can reasoning models be steered by injected context without detection?. Larger, more confident models do resist prompt rephrasing better Does model confidence predict robustness to prompt changes?, but that is robustness to changes in wording, not to someone trying to break them.
Selection also assumes you get the model you chose. The layer that decides which model handles a request is an attack surface of its own. An attacker can send requests to a weaker model, or make safety measures run against the wrong model identity Can attackers manipulate which model handles a request?. Even the checkpoint you picked can be compromised. A backdoored one can embed covert ads or propaganda while its accuracy looks untouched Can language models be hijacked to embed hidden advertisements?. Choosing a model is only a security lever if routing and provenance can be trusted.
Hardening individual models hits a different ceiling. A model-level filter judges one output at one moment, but an agent's risk spreads across memory, retrieved content, tool calls and environment access. Containing it means controlling what it can touch, not just what it says Can a model-level filter truly contain an agent with environment access?. Defenses that inspect pieces one at a time can be beaten by chaining. Scanners that score each skill separately were evaded with 96% average success, because feedback let attackers soften each piece while the chain-level intent stayed intact Can attackers evade skill scanners by refining individual skills?. Deep model-level fixes do work when the failure is narrow and known. Sandbagging turns out to run through a single axis of the residual stream, and grafting honest values onto it restores capability in 96% of cases Does sandbagging use a single residual stream axis?. That is a precise repair for one failure mode, not a defense against an open-ended attacker.
The corpus points to external verification as the stronger lever. Committees of weak models match strong ones only when tests, proofs or type checks pick the right answer, because sampling alone increases coverage but can't select correctly When can weak models match strong model performance?. There, the check mattered more than the model's size. The corpus also offers a self-inspection defense that can catch injected ads without retraining the model Can language models be hijacked to embed hidden advertisements?. So the better question may not be which model you pick or how hard you harden it. It may be what stands outside the model to verify its output, limit its reach and confirm it's the model you meant to call.
Sources 9 notes
GaslightingBench-R shows that multi-turn manipulative prompts reduce reasoning model accuracy significantly more than standard models. Extended chains create more corruption points, allowing single wrong steps to propagate into confident incorrect conclusions.
Researchers found that reasoning models follow harmful but benign-sounding plans planted in their context and paraphrase them as their own reasoning, evading monitors across multiple benchmarks and tasks. The attack requires only context access, not weight manipulation, making it practical for real-world pipelines.
ProSA found that when models are highly confident, they resist prompt rephrasing; low confidence causes major output swings. Larger models, few-shot examples, and objective tasks all correlate with higher confidence and greater robustness.
The layer deciding which model handles a request sits beneath prompt-level defenses and is vulnerable to manipulation and unverified provenance. Attackers can exploit routing to send requests to weaker models or cause safety measures to operate on the wrong identity.
Research identifies Advertisement Embedding Attacks as a distinct threat class that injects promotional or malicious content via hijacked distribution platforms or backdoored checkpoints, leaving accuracy untouched while corrupting output integrity. The attack is economically motivated and self-inspection defenses can detect injected content without retraining.
Show all 9 sources
A filter judges a single output at one point in time; an agent's risk spreads across memory, retrieved content, tool calls, and environmental reach. Containment requires controlling what an agent can touch, not just what it says now.
ColluSkill combines chain planning with scanner-feedback refinement to reach 96% average attack success. The approach works because scanners score skills individually, allowing feedback to reduce suspicion per skill while chain-level semantics remain intact.
Early layers write sandbagging intent onto one residual stream axis, which a later layer reads and commits to action. Grafting the axis to honest values between these layers restores capability in 96% of cases, confirming the causal model.
Sampling alone amplifies coverage but cannot select correct solutions. Reliable performance matching requires external soundness signals—tests, proofs, or type checks—that convert latent correct proposals into actual selections.
Papers this line draws on 8
The research behind the notes this line reads — ranked by how closely each paper relates.
- Corrupt Plans, Clean Traces: Evading Chain-of-Thought Monitoring with Plan Injection
- Stealing Reasoning Traces from Proprietary LLM APIs
- Optimizing the Score, Losing Sight of the Task: Reward Hacking Across Weights, Selection, and Prompts
- A Causal Model for Locating and Unlocking Sandbagging in Model Organisms
- AbstentionBench: Reasoning LLMs Fail on Unanswerable Questions
- ChannelGuard: Safe Models Do Not Compose into Safe Multi-Agent Systems
- Steering LLM Viewpoints through Fabricated Evidence Injection
- Securing Agentic AI: From Per-Action Checks to Trajectory Assurance