The Fragility of Jailbreak Robustness Across Operational States
Yuna Park, Hwang Youn Kim, Yujin Kim, Won Woo Ro, Suhyun Kim, Jae-In Hwang
cs.CR · cs.CL
Quick verdict
Claims jailbreak ASR swings up to +56 pp when only the system prompt changes; persuasive and systematic, but the key representation stats rest on n=6 points.
Summary
The paper questions the common practice of characterizing jailbreak robustness by a single attack success rate (ASR) measured in a default 'vanilla' configuration. Holding the attack artifact fixed, the authors swap in only five Big Five persona system prompts and evaluate PAIR, LAA, and AutoDAN on seven open 7B–13B models (Llama-2/3/3.1, Qwen2.5, Mistral, Vicuna) using AdvBench50 at temperature 0, with a GPT-4 judge validated against human labels (92% agreement, 4.8% FPR). Eighteen of 21 model–attack pairs show at least one persona state exceeding vanilla ASR; the extreme case is LAA on Llama-2-7B, rising from 2% to 58%. A State Sensitivity Indicator (SSI) summarizes cross-state stability. A representation analysis on Llama-2-13B/LAA learns a logistic probe on hidden states (AUROC ≈0.97) whose projections correlate with state-level ASR (r=0.943), transfer partially to user-shared role prompts (r=0.61), and stay stable across BERTScore-filtered paraphrases (ANOVA η²=.735). Main limitations: the headline correlation rests on six state-level points with no confidence intervals; appendix replications switch to a keyword judge with 53.2% FPR; the vanilla state is an empty prompt, confounding persona content with prompt presence; and LAA's flagship result sits at T=0, off its published T=1 recipe.
Review complete
Assessment at a glance
0
risk flags identified
● high 0
● medium 0
● low 0
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Changing only a safety-irrelevant system prompt (a Big Five persona) can shift fixed-attack ASR by tens of percentage points — the flagship case is LAA on Llama-2-7B rising from 2% to 58%.
- 18 of 21 model–attack combinations exhibit at least one non-vanilla operational state with higher ASR than the vanilla state, and vanilla ASR often lies outside the non-vanilla range.
- State-dependent robustness variation is systematically associated with a learned refusal-related representation axis: probe projections track state-level ASR (r=0.943) and transfer partially to user-shared role prompts (r=0.61).
- Persona effects have no fixed trait-to-risk mapping across contexts, but within a fixed model–attack context they are stable across semantics-preserving paraphrases (ANOVA η²=.735).
- A single vanilla-state evaluation is insufficient; the proposed State Sensitivity Indicator (SSI) captures robustness stability that vanilla ASR misses (e.g., Llama-3-8B vs Llama-3.1-8B: 88% vs 90% vanilla ASR but SSI 0.881 vs 0.621).
Strengths
Clean conceptual reframing with an explicit threat model
ASR(m,a) → ASR(m,a,s) makes operational state an explicit variable; §3 carefully separates context-induced states from decoding and runtime configs, and §4.2's fixed-artifact protocol (attacks generated once under vanilla, replayed across states) cleanly isolates response-time state effects; a no-attack control shows 0% ASR in all states.
Broad, controlled evaluation grid with real ablations
Seven 7B–13B open models × 3 attacks spanning access levels × 6 states on AdvBench50 (T=0), replicated on MaliciousInstruct and JailbreakBench (Tables 10–11) and across temperatures (Appendix C.1); the Appendix C.2 ablation is a useful negative result: state-conditioned attack generation adds little (Δ ≤ 12 pp; 79.6% identical LAA suffixes), supporting the response-time-state interpretation.
Judge validated against human annotations
Paraphrase study controls for persona wording
Unusually candid limitations section
Weaknesses
Headline representation statistics rest on n=6 points
No neutral, length-matched system-prompt control
Generalization experiments downgrade to a 53.2%-FPR judge
No uncertainty quantification in the main ASR grid
Flagship LAA result is off the attack's published recipe
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
The paper reframes jailbreak evaluation from ASR(m, a) to ASR(m, a, s), where s is a context-induced operational state established by a system prompt (§3). Its claims: (1) safety-irrelevant persona prompts alone swing fixed-attack ASR by tens of points — the flagship case is LAA on Llama-2-7B, 2%→58% under the Conscientiousness prompt (Table 9, Fig. 3b); (2) 18 of 21 model–attack pairs have at least one non-vanilla state above vanilla, and vanilla often lies outside the non-vanilla range (§5.1); (3) state-level ASR is tracked by projections onto a learned refusal-related axis (§6.2), partially transferring to user-shared role prompts (Table 2: AUROC 0.890, r=0.61); (4) a State Sensitivity Indicator (SSI) complements vanilla ASR — Llama-3-8B and Llama-3.1-8B look alike by vanilla ASR (88% vs 90%) but differ sharply in SSI (0.881 vs 0.621, Table 3). Scope is honestly stated: seven open 7B–13B models, AdvBench50 primary, three attacks spanning black/gray/white-box, T=0 decoding, no-attack control at 0% ASR in all states.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 0 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is a 'state-induced robustness shift' in LLM jailbreaking?
It is the change in attack success rate (ASR) that occurs when only the target model's operational state changes — for example via a different system prompt — while the jailbreak attack itself stays fixed. This paper reports shifts of tens of percentage points; in the most extreme case (LAA attack on Llama-2-7B), ASR rises from 2% to 58% when the model is conditioned with a Conscientiousness persona prompt.
Which models and attacks were tested?
Seven open-source 7B–13B chat models (Llama-2-7B/13B-chat, Llama-3-8B, Llama-3.1-8B, Qwen2.5-7B, Mistral-7B-Instruct-v0.2, Vicuna-7B-v1.5) against three jailbreak attacks at different access levels: PAIR (black-box), LAA (gray-box) and AutoDAN (white-box), evaluated mostly on a 50-query AdvBench subset, with MaliciousInstruct and JailbreakBench replications in the appendix.
Does giving an LLM a personality make it unsafe?
Not by itself, and not deterministically. The paper explicitly finds no fixed trait-to-risk mapping: the same persona can raise ASR for one model–attack pair and lower it for another. The takeaway is that robustness measured in one default state may not transfer to other states, so safety evaluations should also check stability across operational states.
Is the refusal-direction probe evidence that representations cause jailbreak susceptibility?
No. The authors state the analysis is associational, not causal. A logistic probe on hidden states predicts jailbreak outcomes with AUROC around 0.97, and state-mean projections track state-level ASR (r=0.943 across only six states), suggesting representations differ systematically across operational states — but a causal role for the learned axis is not established.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figure-embedded data (Figures 2, 3, 5, 7, 8) appears as flattened numeric strings in the extraction; figure-level readings (error bars, point placement) were cross-checked against the corresponding tables (Tables 3, 9, 13, 19) wherever possible.
- The text twice references 'our public repository' but no repository URL appears anywhere in the extracted text; availability is counted as stated, link unverified.
- Table 8's refusal keyword list renders with PDF artifacts (e.g., '</s>', 'It is not</s>'), but the table and its role in the judge comparison are present and legible.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.