A new paper on arXiv challenges the common practice of measuring LLM safety through jailbreak attack success rate (ASR). The authors argue that ASR, which records whether a generated response violates safeguards, provides little information about the underlying model behavior. Because ASR depends on sampling, it can miss harmful outputs that exist but are not produced in a given evaluation run.
The paper proposes shifting the focus to "harmful reachability" — whether a model can generate harmful content under any decoding path, not just the ones sampled during a test. This reframes safety as a property of the model's output space rather than a single response. The authors suggest that a model which refuses a prompt may still be unsafe if harmful content is reachable through other continuations.
The distinction matters for safety evaluations. If ASR is the only metric, a model that appears safe in practice may still harbor dangerous capabilities. The paper's reachability-based approach aims to expose those hidden risks, offering a more stringent test for autoregressive models. The full details of the method remain in the preprint, but the core argument is clear: refusal is not robustness.