Safety in Batches? Understanding and Mitigating Safety Failures in Batch Prompting
TL;DR
This work identifies batch prompting as a distinct safety failure mode, not reducible to known vulnerabilities such as in-context learning or long-context effects, and analyzes its causes from two complementary perspectives: alignment signal weakening and refusal signal dilution.
Abstract
Batch prompting is a practical inference strategy for large language models, but its safety implications remain underexplored. We show that the success of batch prompting for utility does not extend to safety: a harmful question that is reliably refused in isolation can elicit a harmful response when embedded in a batch of benign questions. We identify this as a distinct safety failure mode -- not reducible to known vulnerabilities such as in-context learning or long-context effects -- and analyze its causes from two complementary perspectives: alignment signal weakening and refusal signal dilution. Across widely used open-source and frontier commercial models, batch prompting consistently achieves high attack success rates as a simple black-box attack. We further show that batch-aware preference optimization effectively mitigates the vulnerability. These findings highlight a blind spot in current safety alignment and point to batch-aware alignment as a necessary step toward robust deployment. Code is available at https://github.com/96kihyun/batch_jailbreak