Validity-Aware Jailbreak Evaluation for Large Language Models
Qilong Wu, Sahil Wadhwa, Pranab Mohanty, Giri Iyengar, Varun Chandrasekaran
cs.AI
Quick verdict
SEAV adds retrieval-grounded step/order checks to jailbreak scoring; evidence that prior metrics overcount is suggestive but rests on unadjudicated labels.
Summary
The paper argues that jailbreak evaluation overcounts successes because prevailing evaluators (refusal detection, semantic similarity, rubric scoring) verify plausibility rather than correctness. Analyzing five benchmarks, the authors classify 94.7% of 322 multi-step harmful intents as instructionally factual, and propose SEAV, a four-stage pipeline: extract ordered steps, verify each step's factuality/relevance via web search (Gemini grounding or Tavily), infer step dependencies and check ordering compliance, then aggregate into a 0-1 actionability score (>0.25 = jailbroken). On SD-A, a 154-sample strategic-dishonesty diagnostic, SEAV labels 42.2% as jailbroken versus 57.1-95.5% for five baselines (a 14.9pp FPR reduction vs. the strongest baseline, bootstrap CI [-22.7,-7.1]); on JQR-BINARY (n=262) its F1 (91.2%) is statistically comparable to StrongREJECT (91.7%). On the new 137-sample ORDSENSE dataset, SEAV combines 61.0% sensitivity to dependency-violating reorderings with 9.6% instability under valid reorderings, unlike ordering-blind rubric baselines. Re-evaluating prior-labeled successes, SEAV flags 22.1-51.0% as invalid on three of four benchmarks (JailbreakQR: 0%). Limitations: SD-A invalidity is by construction, not independently verified; the flagged 'issues' are SEAV disagreements rather than adjudicated errors; human audits are small (21/63 rows) with weak dependency-node agreement (kappa=0.341); SD-A false-positive rates swing sharply with the judge model (Gemini 41.6% vs. GLM-5 18.2%); SD-A and JQR-BINARY are not redistributable.
Review complete
Assessment at a glance
5
risk flags identified
● high 0
● medium 3
● low 2
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Most jailbreak intents are instructionally rather than epistemically factual (94.7% of 322 multi-step intents, Table 1), so procedural correctness is the property existing evaluators fail to check.
- SEAV, a four-stage retrieval-grounded step/order verification pipeline, achieves the lowest false-positive rate on the SD-A diagnostic (42.2%, -14.9pp vs. the strongest baseline) while matching StrongREJECT's F1 on JQR-BINARY (91.2% vs. 91.7%).
- SEAV is the only tested evaluator combining low instability under valid reordering (9.6%) with substantial sensitivity to dependency-violating reorderings (61.0%) on ORDSENSE.
- Enforcing correctness reclassifies 22.1-51.0% of prior-labeled jailbreak successes as invalid on three of four public benchmarks, suggesting standard ASR overstates effective capability leakage.
- Results are stable across the tested search backends (<1pp), though per-dataset error rates are evaluator-dependent (SD-A FPR 41.6% for Gemini vs. 18.2% for GLM-5).
Strengths
Correctness-first framing backed by motivating measurement
Table 1 shows 94.7% of 322 multi-step harmful intents are instructionally factual (only 0.9% epistemic) and Table 3 finds 39.9% of 807 sampled responses carry multi-step structure, grounding the claim that procedural validity is central rather than a corner case.
Statistical hygiene uncommon in evaluator papers
Appendix E reports threshold-free AUROC with paired bootstrap (n=2000, seed=42) and 95% CIs: SD-A FPR advantage -14.9pp [-22.7,-7.1] p<0.001; ORDSENSE AUROC +34.8pp p<0.001; the JQR-Binary gap vs. M3 (-1.2pp) is honestly declared non-significant. Ablations use Bonferroni-corrected McNemar tests (Appendix G).
Control dataset guards against the trivial-stricter-threshold explanation
Unusually candid limitations section with self-audit
Released artifacts and full prompt transparency
Weaknesses
Circular ground truth behind both headline claims
Residual error is high and evaluator-dependent, straining the stability claim
Small, internal human validation
Re-evaluation samples are small and carry no uncertainty quantification
Narrow baseline coverage and heterogeneous headline configurations
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
This method paper (UIUC + Capital One; arXiv 2609.00498) targets a measurement problem in LLM safety: jailbreak attack success rates (ASR) are typically decided by refusal behavior, semantic similarity, or rubric-based intent matching, none of which verify that a 'successful' response is actually correct or executable. The authors first quantify the gap: across five benchmarks, 94.7% of 322 multi-step harmful intents are instructionally factual (procedural) and only 0.9% epistemic (Table 1), and 39.9% of 807 sampled responses carry multi-step structure (Table 3). They then propose SEAV, a verification-centric evaluator, claiming it (i) achieves the lowest false-positive rate on a strategic-dishonesty diagnostic, (ii) is the only evaluator balancing ordering sensitivity with stability, and (iii) reclassifies 22.1%-51.0% of prior-labeled successes as invalid on three of four benchmarks. Claims are framed as a complementary operational-validity layer, not a replacement for refusal or harmfulness evaluation (Sections 2, 9) — an appropriately hedged position.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is SEAV and how does it differ from existing jailbreak evaluators?
SEAV (Sequential Epistemic and Action-Level Validation) is a jailbreak evaluation framework that decomposes a model response into ordered steps, verifies each step's factual accuracy via web search, checks whether the step ordering respects inferred dependencies, and outputs a 0-1 actionability score (above 0.25 counts as a successful jailbreak). Unlike refusal-based or semantic-similarity evaluators, it requires the harmful content to be actually correct and executable, not just plausible-sounding.
What did the paper find about existing jailbreak benchmarks?
Re-evaluating samples previously labeled as successful jailbreaks, SEAV judged 22.1%-51.0% invalid on three of four benchmarks (JBB 51.0%, WildGuardMix 34.7%, GPTFuzz 22.1%), mostly due to factual errors or broken procedures; JailbreakQR labels held up (0% issues). Importantly, these 'issues' are disagreements with original labels, not independently adjudicated errors.
Is SEAV's code and data publicly available?
Code, all prompts, evaluated baselines, and the 137-sample ORDSENSE ordering-sensitivity dataset are released at github.com/Ardor-Wu/SEAV. The SD-A and JQR-BINARY diagnostic sets are documented but not redistributable because their source data was not publicly released by the original authors.
What are the main limitations of SEAV?
It still relies on LLM judgment at every stage; SD-A's 'invalid' ground truth comes from dataset construction rather than independent fact-checking; the benchmark reclassification counts are SEAV's own disagreements, not human-adjudicated errors; human audits are small (21 and 63 rows); false-positive rates on SD-A swing notably when the judge model changes (Gemini 41.6% vs. GLM-5 18.2%); and tasks that should always be refused (e.g., CSAM, WMD synthesis) can be undercounted because a factually wrong but non-refusing answer is scored as a failed jailbreak.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Footnote text is interleaved into the Node 4 prompt and compliance-check prompt passages in the extracted text (PDF extraction artifact of footnotes 4-5); the affected passages remain interpretable from context.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.