Amit Singh Bhatti

The work sizes the selection cost of picking the best single model as comparator on the evaluation data in safety-routing benchmarks: 0.003-0.030 of harm under random splits and 0.045-0.113 under held-out categories on HELM Safety, comparable to the whole deficit attributed to routing, rising seven- to ninefold on AgentDojo when suites are held out; scored honestly under shift, routing buys little, and an attacker who knows which model it faces lowers GPT-5.4's judged recognition by 19.6 points.

The work sizes the selection cost of picking the best single model as comparator on the evaluation data in safety-routing benchmarks: 0.003-0.030 of harm under random splits and 0.045-0.113 under held-out categories on HELM Safety, comparable to the whole deficit attributed to routing, rising seven- to ninefold on AgentDojo when suites are held out; scored honestly under shift, routing buys little, and an attacker who knows which model it faces lowers GPT-5.4's judged recognition by 19.6 points.