When Safety Is Not Load-Bearing: Counterfactual Dependability Evaluation of Mandatory-Path Safety Mechanisms in Language Models

Author abstract

Abstract

Endpoint refusal rates are necessary for evaluating language-model safety, but they are not a dependability argument. A safety mechanism can appear effective while remaining detachable: the model may retain useful behavior when the mechanism is disabled, misrouted, or bypassed. MYCELIUM studies counterfactual load-bearing safety by instrumenting selected transformer projections with low-rank anchor families and testing the same examples under normal, disabled, wrong-route, safety-zero, non-safety-zero, and random-zero executions. On a 20B-parameter model, the final mandatory-path system patches six attention output projections, matches 48 anchor tensors, trains on balanced reservoirs, completes an 800-row generation matrix, and includes an 800-row returned human adjudication. The stricter implementation improves test validity but still fails the behavioral load-bearing claim gate.

Claim under test

Is the safety path structurally load-bearing?

A load-bearing safety mechanism should preserve benign utility on the normal path while producing a measurable utility cost when disabled, misrouted, or removed. Unsafe examples should remain safe or fail closed across the same counterfactual controls. MYCELIUM treats this as a dependability claim requiring both internal dependency evidence and behavioral separation.

Results

Key findings

Evaluation design

Method at a glance

Model

20B-parameter language model with six patched attention output projections

Instrumentation

48 matched low-rank anchor tensors across core, utility, soft-safety, and hard-safety families

Modes

Normal, anchor off, wrong route, forced route, family zeroing, and random wrapper zeroing

Evidence

Training traces, checkpoint hashes, aggregate tables, generation matrix, manifests, and human-adjudication summaries

Non-claims

What this result does not claim

• It does not claim universal safety, universal robustness, or a complete jailbreak defense.
• It does not show that load-bearing safety is impossible; the evidence is limited to the tested model, anchor placement, objective, and control matrix.
• It does not claim that the current IEEE TDSC review manuscript has been accepted.

Open research

Public-safe artifact

The Zenodo package contains the manuscript, aggregate training and evaluation tables, human-adjudication summaries, manifests, checksums, and public metadata. It intentionally excludes raw prompts, raw completions, private generation logs, and private annotation packets.

Reuse and citation

Cite the public artifact

Sezer, N. M., Aksoy, Ö. F., Öztürk, A. R., Salihoğlu, F. A., & Dalar, Y. E. (2026). When Safety Is Not Load-Bearing: Counterfactual Dependability Evaluation of Mandatory-Path Safety Mechanisms in Language Models. Public-safe artifact, Zenodo.

@article{sezer2026mycelium,
  title   = {When Safety Is Not Load-Bearing: Counterfactual Dependability Evaluation of Mandatory-Path Safety Mechanisms in Language Models},
  author  = {Sezer, Nedim Mutlu and Aksoy, Ömer Faruk and Öztürk, Ahmet Rıfat and Salihoğlu, Feyzi Arda and Dalar, Yağız Ekrem},
  year    = {2026},
  doi     = {10.5281/zenodo.21275744},
  url     = {https://doi.org/10.5281/zenodo.21275744},
  note    = {Public-safe artifact; journal manuscript under review}
}