Guardrails based on replicable context cannot provide reliable safety for LLMs

The researchers argue that LLM guardrails cannot see how an answer will be used when deciding whether to answer, and that attackers can imitate benign requests and interaction histories, which constitutes a fundamental limitation for dual-use tasks. The paper separates the capabilities a model releases from evidence about downstream use, proving that when evidence is replicable, an attacker-assisted worst-case lower bound exists under the condition of retaining useful answers, yielding a safety trilemma: useful capability, reliable safety, and open access cannot all hold simultaneously. The authors further propose trusted credentials as a supplement to existing guardrails, providing information that is hard to replicate and that predicts actual downstream use, and give the stronger conditions needed to eliminate this lower bound; evidence from dual-use evaluations, adaptive attacks, and deployed trusted access programs supports the real-world relevance of these conditions.