Safe Alone, Unsafe Together: Compositional Curvature Safety Alignment for Prompt Robustness

Safety-aligned language models are typically evaluated against isolated prompt transformations or sampled attack compositions. We identify a distinct failure mode in which transformations that preserve appropriate behavior individually interact to cross the model's safety boundary. We formalize compositional prompt safety over a lattice of policy-preserving factors and introduce adverse safety curvature, the negative part of the mixed discrete derivative of a sequence-level appropriate-response margin. We show that factor-pair-specific curvature bounds yield a lower bound on every composed margin and a certified composition order on an exhaustively verified finite lattice. Guided by this result, we propose $C^{2}SA$, which discovers violated base-margin, singleton, curvature, and utility conditions and applies minimum-change updates in an editable parameter subspace. During alignment, $C^{2}SA$ evaluates curvature contexts of size at most three, requiring lattice nodes only through order five; orders six through eight are reserved exclusively for higher-order extrapolation. Across three open-weight model families and eight prompt factors, $21.7\%$ of harmful requests that are safe under every singleton transformation fail at one or more test-only orders. Adverse curvature predicts these failures with an AUROC of $0.85$. Relative to the strongest curvature-hinge baseline, $C^{2}SA$ reduces ASR across orders six through eight from $22.0\%$ to $18.0\%$ and SCFR from $9.5\%$ to $7.5\%$, while changing benign helpfulness by only $0.3$ points. Pair-specific certification covers $75.5\%$ of test prompts through order three, and the robustness gains persist under unseen factor realizations, held-out factor families, factor-order permutations, and adaptive post-repair attacks. These results establish adverse safety curvature as a measurable and controllable source of compositional alignment failure.