CLAIM-2026-08-07-02

The same work reports a recognition–action gap: models encode the injection-exposure signal yet often fail to translate it into safe actions.

Why it matters

It removes 'the model will refuse' as a design assumption. Recognition and refusal are separable, so a guardrail that relies on the model noticing is relying on the half of the behaviour that was measured to hold, not the half that acts.

Sources

• arxiv2026your