# Statistical Estimation of Adversarial Risk in Large Language Models under Best-of-N Sampling

arXiv: https://arxiv.org/abs/2601.22636 · HTML: https://mlsanity.com/paper/2601.22636/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- Placed in Jailbreaking, one of 12 directions in LLM safety and security.
- Builds on 6 of its 13 references that are in the map.
- First posted on arXiv 30 Jan 2026.

## Placed in

- LLM safety and security / [Jailbreaking](https://mlsanity.com/safety/jailbreaking/)

## Builds on (most cited first, 6 of 6)

- [Evaluating Large Language Models Trained on Code](https://mlsanity.com/paper/2107.03374/) (2021)
- [HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal](https://mlsanity.com/paper/2402.04249/) (2024)
- [Jailbreak-R1: Exploring the Jailbreak Capabilities of LLMs via Reinforcement Learning](https://mlsanity.com/paper/2506.00782/) (2025)
- [Iterative Self-Tuning LLMs for Enhanced Jailbreaking Capabilities](https://mlsanity.com/paper/2410.18469/) (2024)
- [Safety and Security Analysis of Large Language Models: Benchmarking Risk Profile and Harm Potential](https://mlsanity.com/paper/2509.10655/) (2025)
- [Jailbreaking in the Haystack](https://mlsanity.com/paper/2511.04707/) (2025)

## Built on by (most cited first, 6 of 6)

- [MultiBreak: A Scalable and Diverse Multi-turn Jailbreak Benchmark for Evaluating LLM Safety](https://mlsanity.com/paper/2605.01687/) (2026)
- [The Great Pretender: A Stochasticity Problem in LLM Jailbreak](https://mlsanity.com/paper/2605.14418/) (2026)
- [Tail-Shape Estimation in LLM Evaluation Is Fragile: A Protocol for Diagnosing False Positives](https://mlsanity.com/paper/2606.16511/) (2026)
- [Depth, Not Breadth: Best-of-N Jailbreaking Beyond Surface Noise](https://mlsanity.com/paper/2607.26639/) (2026)
- [Fair ASR: Re-Evaluating Black-Box Jailbreaks under Shared Target-Call Budgets](https://mlsanity.com/paper/2608.17360/) (2026)
- [Escaping Alignment: A Physical Trap Model of Best-of-N Jailbreaking](https://mlsanity.com/paper/2609.32116/) (2026)

## Abstract (arXiv)

Large Language Models (LLMs) are typically evaluated for safety under single-shot or low-budget adversarial prompting, which underestimates real-world risk. In practice, attackers can exploit large-scale parallel sampling to repeatedly probe a model until a harmful response is produced. While recent work shows that attack success increases with repeated sampling, principled methods for predicting large-scale adversarial risk remain limited. We propose a scaling-aware Best-of-N estimation of risk, SABER, for modeling jailbreak vulnerability under Best-of-N sampling. We model sample-level success probabilities using a Beta distribution, the conjugate prior of the Bernoulli distribution, and derive an analytic scaling law that enables reliable extrapolation of large-N attack success rates from small-budget measurements. Using only n=100 samples, our anchored estimator predicts ASR@1000 with a mean absolute error of 1.66, compared to 12.04 for the baseline, which is an 86.2% reduction in estimation error. Our results reveal heterogeneous risk scaling profiles and show that models appearing robust under standard evaluation can experience rapid nonlinear risk amplification under parallel adversarial pressure. This work provides a low-cost, scalable methodology for realistic LLM safety assessment. We will release our code and evaluation scripts upon publication to future research.