Newest papers

Beyond Attack Success Rate: Cost-Aware Metric for Evaluating Iterative LLM Jailbreaks

Rohan Menon, Chih-Hong Cheng · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.26589 · cited by 0 works (OpenAlex) · open-access PDF

Japanese

攻撃の成功率(ASR)は、被害者モデルへの繰り返しの呼び出しを考慮することなく、大規模な言語モデルに対するジャイルブレイクを評価します。しかし、追加の呼び出しは、展開されたシステムに攻撃を検出し、介入するためのもう一つの機会を与えます。我々は、ステップ予算と1ステップPAPと1ステップPAPを導入し、ジャイルブレイクベンチで追加の被害者モデルベースラインを罰します。我々の評価は、3つのモデルファミリーを超えてジャイルブレイクベンチです。GCGのスコアは、ディスカウント後に7.0〜8.7パーセントポイント減少すると、PAPのコードは変更されていません。 PAIRのための2

Machine translation (Meta M2M100); the English original follows.

Abstract

Attack success rate (ASR) evaluates jailbreaks against large language models without accounting for repeated calls to the victim model. Yet each additional call gives the deployed system another opportunity to detect the attack and intervene. We introduce $\mathrm{ASR}_{\mathrm{STEP}}$, which penalizes additional victim-model calls while retaining binary success judgments. Our evaluation considers GCG~\cite{zou2023universal}, PAIR~\cite{chao2025jailbreaking} with a step budget, and a single-step PAP~\cite{zeng2024johnny} baseline on JailBreakBench across three model families. GCG's scores decrease by 7.0--8.7 percentage points after discounting, while PAP's remain unchanged. While for PAIR~\cite{chao2025jailbreaking}, we see a wider discounting range between 3.4-12 percentage points, showing that the "step" quantity differs per iterative strategy. Reporting both metrics makes the discount due to repeated victim-model interaction explicit. Code is available \hyperlink{https://github.com/SuELS-Group/beyond_asr}{here}.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Metric (unit), Discounting, Computer science, Baseline (sea), Code (set theory), Range (aeronautics)

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange