Abstract
Production LLM applications commonly stack a regex filter in front of model-side alignment; prior work found no measurable coverage gain from adding a live Gemini backend behind an active regex filter. We investigate whether that ceiling holds when the corpus is \textit{designed to bypass the regex}. We introduce $L_5$-no-regex, which is identical to $L_4$-real (Gemini-2.5-flash, token-budget cap, rate limit, output scrub) but with the nine-pattern filter disabled. We evaluate it against $N{=}45$ adversarial probes across three sub-corpora (carry-forward, regex-bypass, alignment-isolate), amplified by Gemini paraphrase and PAIR to ${\text{~}1{,}555}$ probe-run pairs over $N{=}5$ replications. Under the primary substring classifier, H1 is refuted: the block rate of $L_5$ is $0\text{%}$ across all five OWASP LLM Top-10 categories ($\text{pp}\triangle{=}0$ vs. $L_0$, $p{=}1.00$; Wilson upper bound...)
Blogger's Review: This research delves into the interaction between LLM alignment and regex filters, revealing the vulnerabilities of these mechanisms in adversarial settings. By testing a specially designed corpus, the authors provide valuable insights that should be considered in future applications. Further experiments will enhance our understanding of these models' performance in real-world scenarios.