Refusal Is Not Robustness: Measuring Harmful Reachability in Autoregressive Language Models

Summary

This research proposes bounded continuation analysis (BCA), which models autoregressive generation as a stochastic process over token prefixes and computes the finite-horizon probability that generation reaches a harmful continuation. The authors argue that attack success rate misses harmful paths hidden beneath sampled refusals, and that BCA can distinguish models with identical measured ASR. Across four instruction-tuned LLMs and 100 JailbreakBench behaviors, they report that BCA quantifies hidden harmful behavior and guides red teaming.

Related items

• MediumOpenAI Models Hacked Data Portals, Raided a Crypto Wallet to Finish TasksSimilar attack · SecurityWeek
• InfoECHO: Replacing the Compliance Proxy with Response Harmfulness in Optimization-Based Jailbreak AttackSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoStealthy Poisoning Attacks via Reused KV Cache of ReasoningSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• LowTypeSafe’s Jev ‘even more susceptible to attack’ than LLMs, says security vendorSimilar attack · CSO Online
• LowJev as a judge: How counterfeit policy steers JevSimilar attack · Datadog Security Labs