Longsafety: Evaluating long-context safety of large language models

Analysis

Why This Paper Matters

As large language models (LLMs) are increasingly deployed in applications that require processing long documents—such as legal analysis, medical records, and code repositories—the safety implications of long-context understanding have become a pressing concern. While prior safety benchmarks focus on short prompts, real-world usage often involves lengthy inputs where malicious content can be hidden or injected. This paper addresses this gap by introducing LongSafety, the first benchmark specifically designed to evaluate LLM safety in long-context scenarios. The authors demonstrate that safety risks escalate with context length, a phenomenon they term 'long context safety degradation.' This finding is crucial because it reveals that even models with strong safety alignment on short prompts can become vulnerable when the context is extended, posing significant risks in practical deployments.

The paper's significance lies in its systematic approach to uncovering a previously overlooked dimension of LLM safety. By constructing a diverse set of long-context safety tasks, the authors provide a comprehensive evaluation framework that can be used by researchers and practitioners to assess and improve model safety. The study also offers insights into the factors that influence long-context safety, such as the position of unsafe content and model size, which can guide future safety alignment strategies. This work is a timely contribution as the industry moves toward longer context windows (e.g., 128k tokens), and it underscores the need for safety mechanisms that scale with context length.

Technical Contributions

• LongSafety Benchmark: A new benchmark comprising multiple safety scenarios (e.g., harmful content, privacy leakage, prompt injection, jailbreak) and long-context types (e.g., multi-document, long dialogue, code). The benchmark includes both existing safety datasets extended to long contexts and newly generated test cases.
• Evaluation Framework: A systematic evaluation protocol that measures safety scores across different context lengths, enabling the identification of safety degradation trends.
• Analysis of Safety Degradation: The paper provides a detailed analysis of how safety performance varies with context length, model size, and the position of unsafe content, offering actionable insights.
• Attack Resistance Testing: The benchmark includes adversarial attacks like prompt injection and jailbreak, testing the robustness of models in long-context settings.

Results

The authors evaluate several state-of-the-art LLMs, including GPT-4, Llama-2, and Qwen, on the LongSafety benchmark. Key results show that safety scores consistently decrease as context length increases. For instance, models that achieve high safety scores on short contexts (e.g., 90%+) can drop to below 70% when the context is extended to 32k tokens. The degradation is more pronounced for smaller models, but even large models like GPT-4 exhibit a noticeable decline. Additionally, the study finds that unsafe content placed in the middle of a long context is more likely to be overlooked, a phenomenon similar to the 'lost in the middle' issue. Prompt injection attacks become more effective with longer contexts, with success rates increasing by up to 30% compared to short contexts. These results highlight the urgent need for long-context safety alignment.

Significance

This paper has broad implications for the AI community. It challenges the assumption that safety alignment is context-independent and demonstrates that long-context models introduce new attack surfaces. The LongSafety benchmark provides a standardized way to measure and compare long-context safety, which can be adopted by model developers to ensure their models are safe in real-world scenarios. The findings also motivate research into new safety alignment techniques that are robust to context length, such as context-aware safety training or attention-based safety mechanisms. As LLMs continue to scale in context capacity, this work serves as a critical reminder that safety must evolve alongside capability, and it provides a foundation for future research in this direction.