FlagThis

Abstract

Production LLM applications commonly stack a regex filter in front of model-side alignment; prior work found no measurable coverage gain from adding a live Gemini backend behind an active regex filter. We ask whether that ceiling holds when the corpus is designed to bypass the regex. We introduce $L_5$-no-regex (identical to $L_4$-real but with the nine-pattern filter disabled) and evaluate it against $N=45$ adversarial probes across three sub-corpora (carry-forward, regex-bypass, alignment-isolate), amplified by Gemini paraphrase and PAIR to 1,555 probe-run pairs over $N=5$ replications. Under the primary substring classifier, H1 is refuted: $L_5$ block rate is 0% across all five OWASP LLM Top-10 categories ($p=1.00$; Wilson upper bound < 5%). A secondary LLM-judge metric on PAIR variants shows 56-100% block rates ($p < 0.01$), revealing alignment does respond to adversarially-framed probes but produces refusals too nuanced for substring matching.