Refusal Is Not Robustness: Measuring Harmful Reachability in Autoregressive Language Models

Parv Kapoor, Teresa Fortes, Claudia Mamede +3

LLM safety evaluations via jailbreaking typically index on attack success rate (ASR): whether a generated response violates safeguards. However, ASR only evaluates sampled outputs…