New Metrics Proposed for Evaluating Jailbreak Attack Success Rates
A new position paper published on arXiv argues that current methods for evaluating jailbreak attacks on AI models are fundamentally insufficient because they typically report success rates based on limited, single-configuration parameter settings. The authors, Carsten Maple, Abhishek Kumar, and Riya Tapwal, contend that this practice fails to capture the true threat landscape, as attack success varies significantly across different parameters like prompt templates and conversation rounds. To address this, the paper introduces two new metrics: Variant Sensitivity Measure (VSM), which quantifies the deviation between best-case and mean performance, and Union Coverage (UC), which measures the total fraction of prompts resulting in unsafe responses across all tested configurations. Empirical tests on models like Mistral-7B and Qwen3-0.6B demonstrate that while best-case Attack Success Rates (ASR) might appear moderate, union coverage can be significantly higher, revealing a broader vulnerability surface. The authors advocate for distributional reporting, including VSM and comprehensive variant coverage, to become the new minimum standard for parameterized jailbreak evaluation, providing defenders with a more accurate understanding of typical performance and missed attack surfaces.
Wire timeline
New Metrics Proposed for Evaluating Jailbreak Attack Success Rates
A new position paper published on arXiv argues that current methods for evaluating jailbreak attacks on AI models are fundamentally insufficient because they typically report success rates based on limited, single-configuration parameter settings. The authors, Carsten Maple, Abhishek Kumar, and Riya Tapwal, contend that this practice fails to capture the true threat landscape, as attack success varies significantly across different parameters like prompt templates and conversation rounds. To address this, the paper introduces two new metrics: Variant Sensitivity Measure (VSM), which quantifies the deviation between best-case and mean performance, and Union Coverage (UC), which measures the total fraction of prompts resulting in unsafe responses across all tested configurations. Empirical tests on models like Mistral-7B and Qwen3-0.6B demonstrate that while best-case Attack Success Rates (ASR) might appear moderate, union coverage can be significantly higher, revealing a broader vulnerability surface. The authors advocate for distributional reporting, including VSM and comprehensive variant coverage, to become the new minimum standard for parameterized jailbreak evaluation, providing defenders with a more accurate understanding of typical performance and missed attack surfaces.
cs.AI updates on arXiv.org