mlsanityData to 14 Oct 2026

An Empirical Measurement of Jailbreaking Evaluators

arXiv 2609.10594 ↗First posted 7 Sep 2026cs.CR cs.LGcited by 0

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

Expert evaluation of jailbreak responses is costly and difficult to scale, so the community increasingly relies on automated evaluators to determine whether an attack succeeds. However, jailbreak studies typically validate their chosen evaluator independently, repeatedly spending resources on similar evaluation efforts while making results across papers difficult to compare. Different evaluators also encode different definitions of jailbreak success, meaning that reported attack strength and apparent progress can depend substantially on which evaluator is used. We systematically compare six evaluators that recur in recent jailbreak attack and defense research: HarmBench, JailbreakBench, JailbreakRadar, StrongReject, JADES, and JailMeter. To our knowledge, no prior study has evaluated all six on the same human-labeled data under a controlled setup. We evaluate them on JailbreakQR and JailMeter-Eva, using human judgments as the reference, and measure agreement with humans, error types, and consistency across attack families. For evaluators that require a general-purpose LLM judge, we use a shared backbone to control for model-specific variation. We found that JADES exhibits the best overall performance, while HarmBench and StrongReject also demonstrate good performance.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 58 of its 72 references that are in the map. First posted on arXiv 7 Sep 2026.

Builds on

58 of 72 references.

Closest ancestors · 27

Same direction, newest first

  1. 2026JailMeter: An Evidence-Based Evaluation Framework for Jailbreak Attacks on Large Language Models20 Jul
  2. 2025Adjacent Words, Divergent Intents: Jailbreaking Large Language Models via Task Concurrency24 Oct
  3. 2025JADES: A Universal Framework for Jailbreak Assessment via Decompositional Scoring28 Aug
  4. 2024Don't Say No: Jailbreaking LLM by Suppressing Refusal25 Apr
  5. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks2 Apr
  6. 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack2 Apr
  7. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models28 Mar
  8. 2024Making Them Ask and Answer: Jailbreaking Large Language Models in Few Queries via Disguise and Reconstruction28 Feb
  9. 2024CodeChameleon: Personalized Encryption Framework for Jailbreaking Large Language Models26 Feb
  10. 2024A StrongREJECT for Empty Jailbreaks15 Feb
  11. 2024COLD-Attack: Jailbreaking LLMs with Stealthiness and Controllability13 Feb
  12. 2024JailbreakRadar: Comprehensive Assessment of Jailbreak Attacks Against LLMs8 Feb
15 more
  1. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automatically4 Dec
  2. 2023DeepInception: Hypnotize Large Language Model to Be Jailbreaker6 Nov
  3. 2023Jailbreaking Black Box Large Language Models in Twenty Queries12 Oct
  4. 2023Catastrophic Jailbreak of Open-source LLMs via Exploiting Generation10 Oct
  5. 2023Multilingual Jailbreak Challenges in Large Language Models10 Oct
  6. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks5 Oct
  7. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models3 Oct
  8. 2023Low-Resource Languages Jailbreak GPT-43 Oct
  9. 2023GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts19 Sep
  10. 2023Detecting Language Model Attacks with Perplexity27 Aug
  11. 2023GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Cipher12 Aug
  12. 2023"Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models7 Aug
  13. 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul
  14. 2023MasterKey: Automated Jailbreak Across Multiple Large Language Model Chatbots16 Jul
  15. 2023Jailbroken: How Does LLM Safety Training Fail?5 Jul

Other references · 31

  1. 2023GPT-4 Technical Reportcited by 18,396
  2. 2022Training language models to follow instructions with human feedbackcited by 15,971
  3. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 13,028
  4. 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,626
  5. 2022Constitutional AI: Harmlessness from AI Feedbackcited by 3,050
  6. 2023G-Eval: NLG Evaluation using GPT-4 with Better Human Alignmentcited by 2,276
  7. 2020Extracting Training Data from Large Language Modelscited by 2,189
  8. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  9. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,207
  10. 2023Large Language Models are not Fair Evaluatorscited by 1,085
  11. 2021A General Language Assistant as a Laboratory for Alignmentcited by 1,055
  12. 2022Red Teaming Language Models with Language Modelscited by 1,026
19 more
  1. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 651
  2. 2024WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMscited by 496
  3. 2023Exploiting Programmatic Behavior of LLMs: Dual-Use Through Standard Security Attackscited by 278
  4. 2022Red-Teaming the Stable Diffusion Safety Filtercited by 264
  5. 2024SALAD-Bench: A Hierarchical and Comprehensive Safety Benchmark for Large Language Modelscited by 228
  6. 2024ArtPrompt: ASCII Art-based Jailbreak Attacks against Aligned LLMscited by 216
  7. 2023Do-Not-Answer: A Dataset for Evaluating Safeguards in LLMscited by 184
  8. 2023Unsafe Diffusion: On the Generation of Unsafe Images and Hateful Memes From Text-To-Image Modelscited by 175
  9. 2023Beyond Memorization: Violating Privacy Via Inference with Large Language Modelscited by 175
  10. 2023Fundamental Limitations of Alignment in Large Language Modelscited by 155
  11. 2024Does Refusal Training in LLMs Generalize to the Past Tense?cited by 79
  12. 2024Generated Data with Fake Privacy: Hidden Dangers of Fine-tuning Large Language Models on Generated Datacited by 22
  13. 2025Are Smarter LLMs Safer? Exploring Safety-Reasoning Trade-offs in Prompting and Fine-Tuningcited by 20
  14. 2024Reconstruct Your Previous Conversations! Comprehensively Investigating Privacy Leakage Risks in Conversations with GPT Modelscited by 16
  15. 2026Benchmark of Benchmarks: Unpacking Influence and Code Repository Quality in LLM Safety Benchmarkscited by 4
  16. 2026Understanding LLM Behavior When Encountering User-Supplied Harmful Content in Harmless Taskscited by 3
  17. 2026When Understanding Becomes a Risk: Authenticity and Safety Risks in the Emerging Image Generation Paradigmcited by 2
  18. 2026GEO-Flag: Detecting and Measuring GEO-Optimized Web Contentcited by 2
  19. 2026Innocent Panels, Hateful Stories: Evaluating and Detecting Hateful Intent in Multi-Turn Visual Story Generationcited by 1

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2024JailbreakEval: An Integrated Toolkit for Evaluating Jailbreak Attempts Against Large Language Models
  2. 2026How Jailbreak Attacks Inform Safety Alignment: A Defender-Centric, Shapley-Based Evaluation of Jailbreak Contributions
  3. 2026Single-Configuration Attack Success Rate Is Not Enough: Jailbreak Evaluations Should Report Distributional Attack Success
  4. 2024AttackEval: How to Evaluate the Effectiveness of Jailbreak Attacking on Large Language Models
  5. 2026How Real is Your Jailbreak? Fine-grained Jailbreak Evaluation with Anchored Reference
  6. 2025GuidedBench: Measuring and Mitigating the Evaluation Discrepancies of In-the-wild LLM Jailbreak Methods
  7. 2025Guarding the Guardrails: A Taxonomy-Driven Approach to Jailbreak Detection
  8. 2026The Fragility of Jailbreak Robustness Across Operational States