Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This study investigates the fragility of jailbreak robustness in language models by examining how variations in operational states affect attack success rates (ASR). The authors demonstrate that even minor changes in system prompts can lead to significant fluctuations in ASR, with increases of up to 56 percentage points observed across different operational states. By analyzing seven aligned models and three jailbreak attacks, the research reveals that traditional evaluations based solely on vanilla states are insufficient for accurately assessing jailbreak robustness.
A single change in operational state can boost jailbreak success rates by over 50%, highlighting a critical vulnerability in LLM safety evaluations.
Existing jailbreak evaluations typically characterize robustness using a single attack success rate (ASR) measured in a default configuration (the vanilla state). However, user-LLM interactions can induce diverse operational states beyond the vanilla state. In this work, we find that jailbreak robustness is highly fragile to operational-state variation: even when the attack remains fixed, changing only an ordinary system prompt not designed to affect safety can dramatically alter attack success rates. We systematically investigate this phenomenon across seven aligned models and three representative jailbreak attacks, observing substantial differences in ASR between vanilla and non-vanilla operational states. In one case, ASR increases by up to 56 percentage points (2% to 58%) solely due to a change in operational state. Remarkably, these increases occur even for attacks originally designed and optimized under vanilla-state evaluation. We further show that state-dependent robustness variation is systematically associated with differences in hidden representations along a refusal-related axis, and that projections onto this axis strongly predict jailbreak outcomes. Our results show that a single vanilla-state evaluation may not fully characterize jailbreak robustness, motivating evaluations that also examine how robustness changes across non-vanilla operational states.