JailMeter: An Evidence-Based Evaluation Framework for Jailbreak Attacks on Large Language Models
Qingjia Huang, Jingyu Zhang, Jianguo Wu, Yakai Li, Weijuan Zhang, Yankai Rong, Junyi Yao, Shengzhi Zhang, Xiaoqi Jia
Why It Matters
What makes this one worth your time
Understanding and evaluating jailbreak attacks is crucial for improving the safety and alignment of large language models, which are increasingly used in sensitive applications.
JailMeter offers a robust framework for evaluating jailbreak attacks on language models with high accuracy.
Summary
The paper introduces JailMeter, a framework for evaluating jailbreak attacks on large language models, using dual-feedback optimization inspired by Information Bottleneck theory to filter noise and assess attack effectiveness. It achieves high accuracy on a benchmark of human-labeled jailbreak instances and is distilled into a smaller model for efficient large-scale evaluation.
Key contributions
- Development of JailMeter, an evaluation framework for jailbreak attacks.
- Application of dual-feedback optimization inspired by Information Bottleneck theory.
- Creation of JailMeter-Eva benchmark with human-labeled jailbreak instances.
Notable insights
- The use of dual-feedback optimization to filter noise while preserving malicious content is a clever application of Information Bottleneck theory.
- Distilling the evaluation framework into a smaller model for efficiency is a practical approach to scaling evaluations.
Possible limitations
- Not stated in the abstract
Abstract
arXiv:2607.19424v1 Announce Type: cross Abstract: The assessment of jailbreak attacks against large language models currently suffers from inconsistent evaluation criteria and methods, leading to unreliable estimates of attack success rates. We propose JailMeter, an evidence-based evaluation framework designed to more faithfully measure jailbreak effectiveness. Inspired by the Information Bottleneck theory, JailMeter applies dual-feedback optimization to filter jailbreak noise from model responses while preserving content relevant to the original malicious question. This process produces concise evidence for a rigorous assessment under which an attack is validated only when the response captures the malicious intent and delivers a complete answer, thereby signaling a substantive bypass of model safety alignment. We evaluate JailMeter on JailMeter-Eva, a challenging benchmark containing 330 human-labeled, non-rejected jailbreak instances. JailMeter achieves an accuracy of 97.27%, substantially outperforming existing evaluation methods. To support large-scale evaluation, we further distill JailMeter into a small language model, JailMeter\textsubscript{SLM}, which maintains comparable reliability with significantly reduced computational costs. Code and dataset are available at https://github.com/Magi2B0y/JailMeter.