← Back to all news
arXiv AI By Chi-Wei Chang, Mu-Tien Kuo, Kuan-Wei Lee, Meng-Hsun Tsai

Identically Trained Language Models Break on Different Jailbreaks

Read the original on arXiv AI →

The study evaluates how identically trained language models respond to jailbreak prompts, finding that models trained with the same pretraining run exhibit highly correlated non-refusal rates (average 0.984), while different pretraining seeds reduce correlation to 0.811 and different data recipes slightly lower it further to 0.779. This indicates that a model’s susceptibility to jailbreaks is largely determined by its specific pretraining run rather than the data used. Additionally, each pretraining run leaves a distinct fingerprint, enabling identification of the run from a model’s responses to a set of prompts.

Machine-generated by The Flow from the publisher's headline and feed description — not written or checked by a human. The full article lives at arXiv AI.

Related stories

arXiv AI
Aug 26

ADVERSA: Measuring Multi-Turn Guardrail Degradation and Judge Reliability in Large Language Models

The paper introduces ADVERSA, an automated red‑teaming framework that evaluates large language model safety over multiple turns by tracking continuous compliance trajectories instead of binary jailbreak outcomes. Using a fine‑tuned 70B attacker model and a structured 5‑point rubric, the authors conduct controlled experiments on three frontier victim models, measuring guardrail degradation and judge reliability through a triple‑judge consensus. Results show a 26.7% jailbreak rate with most breaches occurring early, and the study documents inter‑judge agreement, attacker drift, and attacker refusals as key factors affecting safety assessment.

By Harry Owiredu-Ashley
llmsfine-tuningsafety
More like this →
arXiv Computation and Language
Oct 23

Beyond Attack Success Rate: Cost-Aware Metric for Evaluating Iterative LLM Jailbreaks

The paper introduces a new metric, ASR_STEP, that extends the traditional attack success rate (ASR) by penalizing repeated calls to a victim large language model during jailbreak attempts. Experiments on JailBreakBench show that GCG’s scores drop by 7.0–8.7 percentage points after discounting, while PAP’s scores remain unchanged, and PAIR’s discount ranges from 3.4–12 percentage points depending on the iterative strategy. The authors argue that reporting both ASR and ASR_STEP makes the cost of repeated victim-model interactions explicit.

By Rohan Menon, Chih-Hong Cheng
llmsmultimodal
More like this →