Diagnosing Poisoning Effects in Adapted LLM Guardrails: Beyond Fixed-Threshold Evaluation

LLM guardrails are increasingly adapted with newly collected feedback, but evaluating an updated guard at its old deployment threshold mixes two effects: ordinary adaptation can move the operating point, while poisoned feedback can additionally degrade ranking. We ask how to distinguish poisoning-induced degradation from adaptation-induced operating-point drift. We first conduct controlled INJECTION→SAFE label-flip experiments on encoder guardrails. DistilBERT-CE and DeBERTa-GCE, three training seeds, and 1–10% corruption reveal dose-dependent behavior whose magnitude and ranking effects vary by architecture, seed, and evaluation distribution. Frozen-threshold blocking can change dramatically even when threshold-independent ranking changes little. A locked DeBERTa evaluation and a BIPIA-derived external evaluation further show that restoring a measured operating point on one distribution does not establish transfer to another. We then study an online 4-bit QLoRA guard with clean and 10%-poisoned updates, a frozen Mistral downstream model, HarmBench, and XSTest. Both clean and poisoned adaptation move fixed-threshold operating points toward severe over-refusal, so the fixed threshold alone does not isolate poisoning. Prompt-level CPU-only reanalysis separates these mechanisms. Under the all-HarmBench ranking definition, clean-adapted AUROC ranges from 0.82 to 0.98, whereas poisoned-adapted AUROC ranges from 0.09 to 0.48; the Judge-positive analysis likewise yields paired poisoning losses in all three seeds. At the exact shared BR≈20% point available for seed 29, Clean HR is 28.02% and Poisoned HR is 52.59%, a +24.57 percentage-point gap (95% CI 18.97–30.17). Broader empirical budget frontiers are worse in 11 of 12 estimable seed–budget cells. These results motivate reporting fixed and adjusted operating points together with ranking and matched-utility analyses, rather than treating a fixed threshold as a poisoning-specific measure.