Why do different jailbreak papers report such different attack success rates?

Why This Matters for Security Teams

attack success rate sounds simple, but in jailbreak research it can hide major differences in test design, model version, prompt set quality, and evaluator strictness. A paper that reports a high ASR may be measuring weak guardrails, while a lower ASR may simply reflect a harder benchmark or a more conservative judge. That makes comparison risky unless the methodology is aligned.

For defenders, the practical issue is not academic disagreement. Security teams use these numbers to judge whether a model can resist prompt injection, coercion, or instruction bypass, and those decisions can affect deployment, monitoring, and escalation thresholds. If the metric is noisy, teams can overestimate resilience or spend time chasing the wrong weakness. Guidance from MITRE ATLAS adversarial AI threat matrix is useful here because it frames attacks by tactic and technique rather than by a single headline score.

In practice, many security teams encounter the real weakness only after a malicious prompt succeeds in production, rather than through intentional side-by-side evaluation.

How It Works in Practice

Jailbreak papers often use the same term, ASR, for materially different workflows. One study may count success after a single crafted prompt. Another may search across many prompt variants and report the best result. A third may allow multiple judge calls, self-critique, or retries. Those choices can move the number far more than the underlying model difference.

There are also evaluation layers that introduce drift. Some papers use human judges, some use model judges, and some use a mix. If the judge is lenient, a borderline refusal may be marked successful. If the judge is strict, the same response may be counted as a failure. Prompt ambiguity also matters: if the benchmark leaves room for interpretation, the model may appear more or less resistant depending on how the scorer reads intent.

• Check whether ASR is based on one-shot prompts, multi-turn conversations, or search over many candidates.
• Look for the exact success definition: harmful output, policy violation, partial compliance, or latent leakage.
• Compare the judge type and whether inter-rater agreement was measured.
• Verify the model version, system prompt, and safety settings used in the test.
• Separate attack quality from benchmark hardness before drawing conclusions.

For operational threat modelling, it is better to map jailbreak behavior to technique families in MITRE ATT&CK Enterprise Matrix and Anthropic — first AI-orchestrated cyber espionage campaign report, then use those mappings to decide what defensive controls need testing.

These controls tend to break down when benchmark datasets are reused across papers without disclosure, because search space, refusal thresholds, and judge prompts are no longer comparable.

Common Variations and Edge Cases

Tighter evaluation often increases cost and manual review time, requiring organisations to balance measurement confidence against throughput. That tradeoff becomes especially visible in red-team programs where many prompts must be scored quickly, but the scoring rules still need to be defensible.

There is no universal standard for jailbreak ASR yet. Current guidance suggests treating published results as directional unless the paper clearly states the attack budget, success criteria, and evaluator method. Best practice is evolving toward reporting confidence intervals, ablation tests, and separate results for different prompt classes. That is particularly important when papers mix single-turn jailbreaks with agentic workflows, because tool use, memory, and multi-step reasoning can change the meaning of success.

For teams building their own evaluations, NIST control families can help structure the process. NIST SP 800-53 Rev 5 Security and Privacy Controls is useful for formalising testing, logging, review, and change control around model releases. That does not solve the benchmark problem, but it reduces the risk of treating a noisy score as an operational guarantee. CISA cyber threat advisories can also help teams align model testing with real-world threat patterns rather than synthetic-only jailbreaks.

The main edge case is long-context or agentic systems with memory and tools, where a single ASR number can hide stage-specific failure points because the model may be safe in direct chat but vulnerable once tool actions or retrieval are introduced.

Related resources from NHI Mgmt Group

• How should security teams handle fraud when bot detection and fraud tools see different parts of the attack?
• Why do SaaS identities create such a large attack surface after a breach?
• Why do stolen credentials remain such an effective attack path?
• Why do over-privileged cloud identities create such a large attack surface?