We argue that a single structural fact organizes a wide range of phenomena in contemporary AI safety: a semantic safety constraint (e.g., the agent does not escape its sandbox) is an off-support object. Formally, if $q$ is the data distribution and $p(cdotmid w)$ the model, the safety predicate $B$ is not measurable with respect to $sigma( ext{model}, q)$, whereas the real log-canonical threshold (RLCT) of singular learning theory (SLT) is. From this non-invariance we derive, as corollaries rather than independent observations:
- why reward hacking and sandbox escape arise under outcome-based optimization;
- why encoding such constraints through Bayesian prior design or soft penalty weighting has poor leverage in singular models;
- why hard invariants belong in the harness and soft dispositions in the model;
- why the same $B$ is nonetheless soundly and locally certifiable by formal verification, exactly as the local learning coefficient (LLC) locally pins the same RLCT --- with two precise points of disanalogy;
- why the residual difficulty, identifying which off-support region matters, coincides with performative prediction and self-referential functional dynamics, where SLT's analytic machinery breaks down. We use the July 2026 OpenAI--Hugging Face evaluation incident as the motivating case. Numerical experiments code and related proofs in lean are available at https://github.com/xiangze/Preventing_Jailbreak_as_regularization. Blogger's Review: This paper reveals the limitations of semantic safety constraints, emphasizing that relying solely on these constraints is insufficient to guarantee safety in learning problems. Instead, formal verification and other methods are necessary to ensure the safety and reliability of intelligent agents.