Adnan KhanAdnanProduct & AI
San Francisco Bay Area
Get in touch

Source note2 min read

Do Encoders Suffice? A Systematic Comparison of Encoder and Decoder Safety Judges for LLM Adversarial Evaluation

Source

arXiv

arxiv.org/abs/2606.25782v1

Read the source

Source

Plain-Language Brief

This research compares the effectiveness of encoder classifiers (using models like ModernBERT and Ettin) against LLM-based judges in identifying harmful outputs from large language models (LLMs). The study evaluates these encoders using a variety of datasets, strategies, and metrics to determine their performance in safety evaluation.

What the Document Says

  • The paper explores the use of encoder classifiers for safety evaluation of LLMs in chatbots and everyday applications.
  • Encoder classifiers are compared to rule-based prefix matching, fine-tuned LLM classifiers, and LLM judges across various datasets and strategies.
  • Judge-prompting strategies and methods from StrongReject, ShieldGemma, JailbreakBench, AILuminate, SorryBench, Claude-as-a-judge setup, and LlamaGuard 3 & 4 are included.
  • The encoder classifiers are fine-tuned on judge-labeled data using a majority-voting label strategy and then evaluated on a gold-standard holdout dataset.
  • Performance is measured using F1 score, false negative rate, and precision-recall metrics.

Key Concepts Mentioned

  • Large Language Models (LLMs)
  • Encoder classifiers
  • Safety evaluation
  • LLM-based judges
  • Adversarial datasets
  • Fine-tuning
  • Performance evaluation

Claims Made by the Document

  • Encoder classifiers can reliably identify harmful LLM outputs without substantial performance loss relative to LLM-based judges.
  • Encoder classifiers provide cost- and latency-efficient alternatives to LLM-based safety evaluation.

Evidence Used

  • Benchmarking encoder classifiers against various judge-prompting strategies, datasets, and metrics.

Methods / Approach

UNKNOWN

Limitations Stated by the Authors

UNKNOWN

Limitations Noted by the Agent

Agent interpretation — not from the source.

UNKNOWN

Open Questions

UNKNOWN

Notes for Future Q&A

May include interpretation. Labeled where it does.

UNKNOWN

Raw Abstract / Excerpt

With the widespread adoption of large language models (LLMs) in chatbots and everyday applications, companies increasingly need guardrails that are effective while remaining low-cost and low-latency. Safety evaluation of LLM outputs has generally relied on LLM-based judges, which can be effective but are often slow and expensive to deploy at scale. In this paper, we evaluate whether fine-tuned modern encoder classifiers from the ModernBERT family, including ModernBERT and Ettin, can reliably identify harmful LLM outputs in user-model conversations without substantial performance loss relative to LLM-based judges. We benchmark these encoder classifiers against rule-based prefix matching, fine-tuned LLM classifiers, and LLM judges using a range of judge-prompting strategies across open-source adversarial datasets. The LLM judges include evaluation methodologies from StrongReject, ShieldGemma, JailbreakBench, AILuminate, SorryBench, and a Claude-as-a-judge setup, as well as fine-tuned safety classifiers such as LlamaGuard 3 and LlamaGuard 4. The encoder classifiers are fine-tuned on judge-labeled data using a majority-voting label strategy and are then evaluated on a gold-standard holdout dataset to assess their performance relative to LLM judges. We report absolute performance using F1 score, false negative rate, and precision-recall metrics. We also break down results by attack technique, including single-turn prompting, decomposition, escalation, and context manipulation, to identify where encoder classifiers align with or diverge from LLM-based judges. Our findings provide guidance on when encoder classifiers can serve as cost- and latency-efficient alternatives to LLM-based safety evaluation.