Safety pipelines often block content by thresholding a model's first-token unsafe score. We show that a single prompt's score is not a reliable probability and compare two repairs: mean ensemble and calibration with development labels. Across seven vision-language models and two benchmarks, an input's unsafe probability varies across 15 task-preserving rewordings with a standard deviation of 0.16-0.30 on average; the inputs that vary most are more often misclassified. The 15-prompt mean has lower negative log-likelihood (NLL) than the best single prompt, even one chosen with evaluation labels, on 13 of 14 model-benchmark pairs. Development labels change the picture: jointly selecting and calibrating a single prompt outperforms the similarly calibrated mean for all seven models on held-out data from the development benchmark. Under cross-benchmark evaluation without refitting, however, the advantage reverses, with the calibrated mean outperforming the single prompt on six of seven models. We recommend evaluating first-token scores as a prompt family, using the mean ensemble as the label-free baseline, calibrating one prompt when development labels exist and deployment data match, and calibrating the mean when they may not.

翻译：暂无翻译