Rethinking LLM Jailbreak Evaluation: Continuous Risk Landscapes Beyond Binary Outcomes

Summary

Current LLM jailbreak evaluation relies on a binary success indicator, which hides how a prompt shapes the distribution of possible responses. The authors propose a continuous, context-conditioned risk landscape over first-token branches, estimated by fixing candidate openings and repeatedly sampling their continuations. Across multiple target models and jailbreak attacks, they find risky branches beneath apparently safe outputs, and attacks that are strongest before an adaptive defense are not always strongest after it reacts.

Topics

• Prompt injection and jailbreaks

Related items

• InfoShallowDefend: Harnessing Shallow Safety Alignment for Multi-Turn DefenderSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoHow I Aligned Your Model: Scaling Up Multilingual Safety Training with TemplatesSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoRed-Teaming Large Language Models in Low-Resource African Languages: A Case Study of Yoruba and Nigerian PidginSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoSystematic Evaluation of Adversarial Jailbreaking Attacks and Defenses Across Seven Large Language ModelsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoDiscovering Jailbreaks via Curriculum of ModelsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)