The Missing Compliance Class: LLM Graders That Collapse Jailbreak Success, and a Free Check

Summary

This research shows that dense LLM graders used to score jailbreak attacks can collapse compliant responses into the evasion class, so the reported attack success rate depends heavily on which grader is used. On two corpora of 900 responses and eight graders, the compliance rate differs by a factor of 22 to 25, while the non-refusal rate differs by 18 to 23 percentage points. The authors propose reporting the compliance rate with its per-class label counts and the named grader, alongside the non-refusal rate.

Mitigation

The authors propose a reporting minimum that keeps the compliance rate and adds its per-class label counts and the named grader. Beside it goes the non-refusal rate, whose disagreement across graders is additive.

Topics

• Prompt injection and jailbreaks

Related items

• InfoSafety Mid-Training: Internalizing LLM Safety as a Foundational CapabilitySimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoConcerns in Benchmarking Jailbreaks: An Empirical Study of Attack Success RatesSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoBeyond Attack Success Rate: Cost-Aware Metric for Evaluating Iterative LLM JailbreaksSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoBudgeted Attack Scheduling for LLM Red-Teaming: The Roles of Static Priors, Semantic Guidance, and Online FeedbackSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoPeer Pressure: Execution-Verified Co-Evolution of Attacker and Defender Populations for Code SecuritySimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)