The Instability of Safety: How Random Seeds and Temperature Expose Inconsistent LLM Refusal Behavior

[2512.12066] The Instability of Safety: How Random Seeds and Temperature Expose Inconsistent LLM Refusal Behavior Skip to main content Search Submit Donate Log in Computer Science > Machine Learning arXiv:2512.12066 (cs) [Submitted on 12 Dec 2025 ( v1 ), last revised 14 Oct 2026 (this version, v4)] Title: The Instability of Safety: How Random Seeds and Temperature Expose Inconsistent LLM Refusal Behavior Authors: Erik Larsen View PDF HTML (experimental) Abstract: Current safety evaluations of large language models rely on single-shot testing, implicitly assuming that model responses are deterministic and representative of the model's safety alignment. We challenge this assumption by investigating the stability of safety refusal decisions across random seeds and temperature settings. Testing four instruction-tuned models from three families (Llama 3.1 8B, Qwen 2.5 7B, Qwen 3 8B, Gemma 3 12B) on 876 harmful prompts across 20 sampling configurations (4 temperatures x 5 seeds), we find that 18-28% of prompts exhibit decision flips (the REFUSE/PARTIAL/COMPLY label changes across configurations), depending on the model. Our Safety Stability Index (SSI) reveals that higher temperatures significantly reduce decision stability (Friedman chi-squared = 396.81, p < 0.001), with mean within-temperature SSI dropping from 0.977 at temperature 0.0 to 0.942 at temperature 1.0. We validate findings across all model families using Claude 3.5 Haiku as a unified external judge, achieving 89.1% inter-judge agreement with the Llama 70B judge on the two models both judges labeled (Cohen's kappa = 0.62). Within each model, prompts with higher compliance rates exhibit lower stability (Spearman rho = -0.47 to -0.70, all p < 0.001), indicating that models "waver" more on borderline requests. These findings demonstrate that single-shot safety evaluations are insufficient for reliable safety assessment and that evaluation protocols must account for stochastic variation in model behavior. For Llama 3.1 8B, single-shot evaluation agrees with multi-sample ground truth only 92.5% of the time when pooling across temperatures (98.7% at greedy to 90.3% at temperature 1.0), and we recommend scaling samples with temperature--one at greedy, three at low temperature, more at higher temperatures (where three reach only ~95%), and ten when pooling--rather than a single flat threshold. Comments: 17 pages, 7 figures, 9 tables. Code and data: this https URL . v4: no reported numbers change. The Claude 3.5 Haiku judge ran at temperature 1.0, not 0.0 (Table 9); at t=0.0, at least 9 of Qwen 2.5's 81 flips are judge noise, so t=0.0 flip rates include judge noise (Secs. 4.3.1, 5.2); a flip is now defined as any REFUSE/PARTIAL/COMPLY label change Subjects: Machine Learning (cs.LG) ; Artificial Intelligence (cs.AI); Computation and Language (cs.CL) ACM classes: I.2.7; I.2.6 Cite as: arXiv:2512.12066 [cs.LG] (or arXiv:2512.12066v4 [cs.LG] for this version) https://doi.org/10.48550/arXiv.2512.12066 Focus to learn more arXiv-issued DOI via DataCite Submission history From: Erik Larsen [ view email ] [v1] Fri, 12 Dec 2025 22:29:13 UTC (51 KB) [v2] Tue, 16 Dec 2025 03:45:08 UTC (73 KB) [v3] Thu, 27 Aug 2026 21:19:17 UTC (82 KB) [v4] Wed, 14 Oct 2026 02:11:31 UTC (82 KB) Full-text links: Access Paper: View PDF HTML (experimental) TeX Source view license Additional Features Audio Summary Current browse context: cs.LG < prev | next > new | recent | 2025-12 Change to browse by: cs cs.AI cs.CL References & Citations SciX Google Scholar Semantic Scholar export BibTeX citation Bookmark Bibliographic Tools Bibliographic and Citation Tools Bibliographic Explorer Toggle Bibliographic Explorer ( What is the Explorer? ) Connected Papers Toggle Connected Papers ( What is Connected Papers? ) Litmaps Toggle Litmaps ( What is Litmaps? ) scite.ai Toggle scite Smart Citations ( What are Smart Citations? ) Code, Data, Media Code, Data and Media Associated with this Article alphaXiv Toggle alphaXiv ( What is alphaXiv? ) Links to Code Toggle CatalyzeX Code Finder for Papers ( What is CatalyzeX? ) DagsHub Toggle DagsHub ( What is DagsHub? ) GotitPub Toggle Gotit.pub ( What is GotitPub? ) Huggingface Toggle Hugging Face ( What is Huggingface? ) ScienceCast Toggle ScienceCast ( What is ScienceCast? ) Demos Demos Replicate Toggle Replicate ( What is Replicate? ) Spaces Toggle Hugging Face Spaces ( What is Spaces? ) Spaces Toggle TXYZ.AI ( What is TXYZ.AI? ) Related Papers Recommenders and Search Tools Link to Influence Flower Influence Flower ( What are Influence Flowers? ) Core recommender toggle CORE Recommender ( What is CORE? ) IArxiv recommender toggle IArxiv Recommender ( What is IArxiv? ) Author Venue Institution Topic About arXivLabs arXivLabs: experimental projects with community collaborators arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website. Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them. Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs . Which authors of this paper are endorsers? | Disable MathJax ( What is MathJax? ) We gratefully acknowledge support from our major funders , member institutions , and all contributors. About · Help · Contact · Subscribe · Copyright · Privacy · Accessibility · Operational Status (opens in new tab)

Related documents

• The Instability of Safety: How Random Seeds and Temperature Expose Inconsistent LLM Refusal Behavior#684310
• Experimental Design: Ethics, Integrity and the Scientific Method#102053
• Fear of coordination costs can increase conservative attitudes#1159791
• The Development of Superstitions in Uncontrollable Environment#260556
• A paradox of promising#768819