Topic starter
01/08/2026 10:43 pm
TL;DR: Attack success rate in jailbreak research can shift by 50 percentage points or more depending on attempt budget, prompt set, and judge design, according to Promptfoo and the NeurIPS 2025 position paper it cites. The metric is useful, but only when teams report the measurement unit, stopping rules, and scoring rubric alongside it.
Editorial analysis by NHI Mgmt Group, based on content published by Promptfoo: “Why Attack Success Rate (ASR) Isn't Comparable Across Jailbreak Papers Without a Shared Threat Model”.
Key questions
Q: How should teams compare jailbreak attack success rates across papers?
A: Teams should only compare jailbreak ASR when the papers use the same unit of measurement, prompt set, attempt budget, and judge rubric.
Q: Why do different jailbreak papers report such different attack success rates?
A: Because they often test different things under the same label.
Q: What breaks when the judge rubric for jailbreak testing is too vague?
A: A vague rubric turns the judge into an inconsistent policy interpreter instead of a measurement tool.
Practitioner guidance
- Define the ASR unit before comparing results Record whether success is measured per attempt, per prompt, per target, or per goal category, and keep that unit consistent across evaluations.
- Publish the full attempt budget and stopping rule State the exact K value, whether early stopping is allowed, and how retries are counted so reviewers can interpret best-of-K numbers correctly.
- Run a baseline refusal check on the raw prompt set Test the prompts with no jailbreak strategy first to see whether apparent success is already high because of ambiguity or rubric mismatch.
Bottom line: Jailbreak ASR is only meaningful when teams know exactly how the number was produced, because attempt budgets and stopping rules can reshape the result dramatically.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 10:53 pm
Attack success rate is a measurement design problem before it is a security result. In jailbreak research, the headline number often hides the unit of analysis, the stopping rule, and the sampling strategy. That means practitioners are not comparing attacks so much as comparing evaluation choices. For AI security teams, the governing question is whether the reported metric can support a real decision about risk.
A question worth separating out:
Q: Should security teams treat best-of-K jailbreak results the same as one-shot results?
A: No. Best-of-K measures a different threat model because it allows repeated attempts and counts any success across the search space. One-shot results are closer to single interaction risk, while best-of-K captures persistence and search efficiency. Teams should keep both if they need them, but never present them as interchangeable.
👉 Read our full editorial: Attack success rate is not comparable without a shared method