arXiv:2610.07125v1 Announce Type: cross Abstract: While open-weight models have enjoyed steady progress in capabilities and wide adoption across multiple domains, their safety remains an important co...
The paper critiques current LLM safety evaluations that rely solely on severity taxonomies, arguing they ignore the probability that a threat will actually be executed. It introduces Expected Harm, a metric that multiplies severity by execution likelihood—modeled via execution cost—to better gauge real-world risk. Empirical studies show that models over‑refuse low‑likelihood, high‑cost threats while remaining vulnerable to high‑likelihood, low‑cost ones, a miscalibration traced to the distribution of safety examples in supervised fine‑tuning. This misalignment can be exploited to double the success rate of jailbreak attacks.
The paper introduces Bounded Continuation Analysis (BCA), a method that models autoregressive language model generation as a stochastic process over token prefixes to compute the finite‑horizon probability of reaching a harmful continuation. BCA builds a bounded continuation tree, labels terminal continuations with a semantic harm evaluator, and uses exact probabilistic model checking to estimate harmful reachability. Unlike traditional attack success rate (ASR) metrics that only assess sampled outputs, BCA reveals hidden harmful paths that may coexist with safe responses, enabling more precise red‑team targeting across instruction‑tuned LLMs and JailbreakBench behaviors.
arXiv:2510. 02422v4 Announce Type: replace-cross Abstract: Existing gradient-based jailbreak attacks typically optimize a fixed-length adversarial suffix toward a predefined target response with a static optimization strategy.
arXiv:2604. 22167v2 Announce Type: replace-cross Abstract: Language models are increasingly capable and are being rapidly deployed on a population-level scale.
arXiv:2508. 10029v3 Announce Type: replace-cross Abstract: Safety-aligned large language models can still be manipulated through white-box interventions that modify their internal representations.
arXiv:2503.06989v5 Announce Type: replace-cross Abstract: Recently, Multimodal Large Language Models (MLLMs) have demonstrated their superior ability in understanding multimodal content. However, the...
arXiv:2506. 22666v3 Announce Type: replace-cross Abstract: The rise of API-only access to state-of-the-art LLMs highlights the need for effective black-box jailbreak methods to identify model vulnerabilities in real-world settings.
arXiv:2608. 09624v1 Announce Type: cross Abstract: Internal safety scores judge a prompt before any text is generated, and they are validated by how well they separate harmful prompts from benign ones.
arXiv:2608. 10621v1 Announce Type: new Abstract: Recent research on Large Language Model (LLM) safety has widely adopted guardrails to identify unsafe LLM outputs.
arXiv:2606. 02640v1 Announce Type: cross Abstract: Multi-turn jailbreak attacks pose a growing threat to large language model (LLM) safety because they exploit feedback from auxiliary judge models to iteratively refine prompts toward harmful goals.
arXiv:2606. 26936v1 Announce Type: cross Abstract: With a profusion of jailbreaks for LLMs now widely known, a growing concern is that non-expert malicious actors ("the average Jane") could elicit actionable responses to malicious requests.