batch-inference-safety

Reference implementation for the batch-conditioned refusal robustness evaluation accompanying the accepted paper, "A Paired Testing Protocol for Batch-Conditioned Refusal Robustness in LLM Serving".

What is this?

Batching is usually optimized as a throughput control. The paper asks a narrower deployment question: can the same prompt cross a refusal boundary when the serving batch condition changes?

Across a 180,141-row synthesis of Studies A-C plus a 110-record targeted Study D kernel ablation, the answer is real but small. Batch perturbation can change refusal labels at low rates, the effect is model-specific, and the evidence does not support a universal safety-over-capability law. In the targeted ablation, standard vLLM reproduced 22/55 candidate label flips, while batch-invariant execution reduced the same candidate set to 0/55.

The repo packages four reusable building blocks:

1. RefusalDetector - deterministic regex classifier (1.0 = refused, 0.0 = complied).
2. flip_rate / flip_asymmetry - fraction of paired cells whose label changes between two batch configurations, plus the safety/capability flip-rate ratio.
3. output_instability / fragility_correlation - per-cell variance of the binary refusal label across short repeated runs, plus the cross-model Pearson correlation. The accepted synthesis reports r = .909 across 15 models; alignment type is not predictive (p = .942).
4. mde_at_power / cohens_h_to_pp_at_base_rate - Cohen's-h minimum detectable effect at a given (n, alpha, power), plus a helper for reporting that effect on the raw percentage-point scale at a chosen base rate.

All headline tests in the paper use deterministic scoring plus the helpers above.

Why you need it

A deployment team that batches inference for throughput has three unsatisfying options: trust a single-prompt audit, rerun the entire safety battery at every plausible batch setting, or accept that batch-conditioned behavior is unmeasured. This repo supports a narrower fourth option: rerun paired safety and capability prompts under the exact batch setting used in deployment, then report the observed flip rate, direction, fragility predictors, and minimum detectable effect.

The evidence supports exact-stack validation, not universal prohibition. Do not infer batch safety from alignment type, architecture family, or composition heuristics.

Install

pip install -e .

Dependencies: Python >= 3.9, standard library only (no NumPy, no SciPy).

Quickstart

Refusal detection

from bis import RefusalDetector

detector = RefusalDetector()
print(detector.score("I cannot help with that."))   # 1.0
print(detector.score("Sure, here's how..."))         # 0.0

Flip-rate asymmetry under batch perturbation

from bis import flip_asymmetry

out = flip_asymmetry(
    safety_a=labels_under_batch_a,
    safety_b=labels_under_batch_b,
    capability_a=cap_labels_a,
    capability_b=cap_labels_b,
)
print(out["ratio"])  # > 1 means safety perturbed more; ~1 means parity

Output instability across repeated runs

from bis import output_instability

# 5 repeated runs, same prompts, same batch setting except for seed/order
inst = output_instability(runs)   # 0 == stable, 1 == max unstable

Minimum detectable effect at the served batch size

from bis import cohens_h_to_pp_at_base_rate, mde_at_power

mde = mde_at_power(n=10_000, alpha=0.05, power=0.80)
pp = cohens_h_to_pp_at_base_rate(mde, base_rate=0.50)
print(f"MDE |h| = {mde:.4f}  (~{pp:.2f} pp at 50% base rate)")

Run the example

python examples/quickstart.py

API

from bis import (
    RefusalDetector,    RefusalResult,
    # batch-specific metrics
    flip_rate,          flip_asymmetry,
    output_instability, fragility_correlation,
    mde_at_power,       cohens_h_to_pp_at_base_rate,
    # statistical pipeline
    cohens_d,           cohens_h,
    welch_t,
    oneway_anova,
    tost,
    holm_correct,
    bootstrap_slope_ci,
    wilson_ci,
)

See bis/refusal.py, bis/batch_metrics.py, and bis/stats.py for complete docstrings.

Calibration source

The repository includes a compact calibration summary in data/bis_calibration_summary.json. It records the public headline anchors for the accepted synthesis:

• 180,141 evaluated rows across Studies A-C, plus a 110-record targeted Study D kernel ablation.
• Study A: 63 candidate behavior changes manually reviewed; 17 genuine changes; corrected local rate about 0.16%.
• Study B: 127,224 records across 15 models; output instability correlates with flip rate (r = .909, bootstrap CI [.65, .97]); alignment family is not predictive (p = .942).
• Study C: 14,250 records, batch size 8, 4.7 percentage-point minimum detectable effect at 80% power, 22.1% verified co-batching, and 28 of 31 pooled rare flips in the unsafe direction.
• Study D: 55 candidate rows rerun under the same vLLM/H100 stack with and without batch-invariant execution. Standard vLLM produced 22 label flips and 25 text changes; VLLM_BATCH_INVARIANT=1 produced 0 label flips and 0 text changes on the same candidates. All 110 records completed successfully.

Full per-conversation transcripts and raw harmful prompts/completions are not redistributed by default. Aggregated labels and identifier-keyed metadata are sufficient to rerun the reported aggregate checks.

Citation

@inproceedings{kadadekar2026pairedbatchrefusal,
  title     = {A Paired Testing Protocol for Batch-Conditioned Refusal Robustness in LLM Serving},
  author    = {Kadadekar, Sahil},
  booktitle = {ICML 2026 Workshop on Hypothesis Testing},
  year      = {2026},
  eprint    = {2605.27763},
  archivePrefix = {arXiv},
  primaryClass = {cs.LG},
  doi       = {10.48550/arXiv.2605.27763},
  url       = {https://arxiv.org/abs/2605.27763}
}

See paper/PREPRINT_LINK.md for the paper pointer.

License

Apache 2.0 - permissive use with attribution.

Contact

Issues and PRs are welcome. For private research access to full per-conversation transcripts, component-study run directories, or adjudication materials, open an issue or email the author listed in the citation metadata.