Automated jailbreak evaluation must record attacker access, query budgets, and success criteria together.
An LLM jailbreak attempts to make a model answer requests it was trained to refuse. Identically named attacks are not directly comparable when models, prompts, or evaluation methods differ.
This post uses the original GCG and PAIR papers and HarmBench, which evaluated both at ICML 2024. Past attack success is not a current service vulnerability rate.
Conditions behind attack success rates
Attack Success Rate (ASR) is the fraction of defined evaluation units classified as successful. Reports must identify whether the denominator is behavior goals or individual attempts, and how many attempts each goal permits.
| Condition | Information to report |
|---|---|
| Access | Weight and gradient access, or API queries only |
| Budget | Queries per goal, optimization compute, and retries |
| Target | Model version, system prompt, and decoding |
| Success criterion | Evaluated behavior, classifier, and human-review scope |
A judge model's 1–10 score evaluates one response. It is not the same quantity as ASR across multiple goals.
How GCG and PAIR differ
GCG searches suffix tokens using gradients from an accessible model. The paper also evaluates transfer of those suffixes to other models. Transfer results apply to the models and attack conditions tested at the time.
PAIR iteratively improves prompts using target responses and evaluation feedback. It does not require target weights, but it needs query access and an attack budget. The twenty queries in its title are not a guaranteed upper bound for every goal and model.
flowchart LR
A[Evaluation goal] --> G[GCG<br/>search suffixes with gradients]
A --> P[PAIR<br/>refine queries with response feedback]
G --> T[Target model response]
P --> T
T --> E[Evaluate against fixed criteria]| Method | Search information | Cost to check separately |
|---|---|---|
| GCG | Gradients from an accessible model | Optimization and candidate evaluation compute |
| PAIR | Target responses and evaluation feedback | Attacker, target, and judge calls |
These differences do not establish which attack is always more dangerous. Compare threats against the actual exposed interface and permitted budget.
HarmBench's comparison scope
HarmBench compares 18 red-teaming methods and 33 target LLM and defense configurations. Shared behaviors and evaluation procedures make results more comparable.
The paper's automatic judgments use HarmBench evaluation classifiers. They should not be relabeled as Llama Guard results or treated as complete verification of practical misuse.
| What the benchmark provides | What needs separate evaluation |
|---|---|
| Shared behaviors and attack implementations | Service-specific permissions and tools |
| Automated response judgments | Classification errors and borderline cases |
| Comparisons among tested defenses | New attacks and different model versions |
| Joint attack and defense evaluation | False refusals and operational cost |
Applying the evaluation to a service
A service must distinguish generated text from executed actions. Evaluating harmful text generation does not replace authorization for file changes or external transmission.
The following procedure proposes how to connect benchmarks to operational evaluation. The papers did not measure defense performance in this particular service configuration.
1. Fix the model, system prompt, and tool permissions.
2. Define attack goals and the budget per goal.
3. Run legitimate tasks and attack tasks separately.
4. Have people inspect borderline automatic judgments.
5. Record attack success, legitimate task success, and call cost together.Compare defenses under the same conditions. Changing the model or attack budget simultaneously makes the cause of improvement harder to identify.
Summary
GCG and PAIR search for automated jailbreaks under different access conditions. HarmBench provides evidence from comparing these methods under shared criteria. Success rates depend on the target model, attempt budget, and judgment procedure. Real services also need separate evaluation of legitimate task performance and tool authorization.