Title: Jailbreaking Large Language Models Against Moderation Guardrails via Cipher Characters
Benchmark: JAMBench
Summary: The paper proposes JAMBench - a benchmark for LLM jailbreaks against content moderation classifiers used as guardrails. The dataset is specifically designed to not trigger input-level harm classifiers, but trigger output-level harm classifiers to enable the study of evading output-level detection through jailbreaks.
Phenomenon type: General Capability (A broadly useful ability, which could be relevant to multiple applications)
Target phenomenon: natural language understanding, jailbreaking, harmful behaviour
Phenomenon defined by authors: No
Phenomenon definition: Vulnerability of content moderation classifiers to jailbreaks.
Definition scope: Subset
Definition integrity: Composite phenomenon
Definition integrity detail: Yes
Phenomenon contested: Not defined
Task definition: The task is to elicit a harmful response by an LLM while circumventing content moderation.
Task item definition: A harmful question
Task source: Author-crafted task examples (e.g. hand-written examples, manual transformation of existing data into questions)
Task source detail: author-crafted from scratch.
Task ecology: Partial real task (e.g. answering medical questions collected from real people)
Dataset size: 160
Dataset metadata available: Yes
Dataset metadata detail: Category, severity of harm
Sampling method: Targeted items (creators defined a task space and chose tasks within it strategically)
Split reviewed: Test
Response format: Multiple choice
Response format detail: The base task is eliciting harmful response from an LLM while evading content moderation (so the LLM outputs Free Response). However, for the benchmark, we are utilizing [Harmful Question + LLM  + Content Moderator ] and receive a harmfulness score that should be deceptive and hence the wrong filter decision is made.
Metric definition: Exact Match (accuracy, F1, precision, recall), A non-defined "jailbreak success rate". likely LLM-as-a-Judge but unclear.
Metric aggregation: Simple Mean
Metric statistics: Experiments are repeated 5 times but resulting information onf uncertainty are not reported.
Metric subscores: Yes
Metric subscores detail: harm domain: Hate, Sexual, Violence, Self-Harm
Metric access: Model access required (e.g. logits)
Few-shot evaluation: Yes
Authorship: Academia
Benchmark availability: Yes
Task face validity: Yes
Metric face validity: Yes
Results interpreted by authors: Yes
Results compared: Yes
Results comparison explanation: Yes
Results realism: No
Human baseline: No
Authors discuss validity: No
Taxonomy: Alignment / Safety
New taxonomy: General Capability / Safety
Other notes: Extremely little information is provided about the process and rationale of creating items. However, it is clear that datasets are designed to be adversarial to current content moderation. This has major implications on the construct validity but is not discussed at all.