Capability-Based Scaling Trends for LLM-Based Red-Teaming
Authors: Alexander Panfilov
Paul Kassianik
Maksym Andriushchenko
Jonas Geiping
Venue: ICLR 2026 Poster (2026)
Keywords: jailbreaks
red-teaming
ai safety
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: Jailbreaking success rate follows a predictable trend with respect to the capability gap between attacker and target LLMs

Abstract: As large language models grow in capability and agency, identifying vulnerabilities through red-teaming becomes vital for safe deployment. However, traditional prompt-engineering approaches may prove ineffective once red-teaming turns into a \emph{weak-to-strong} problem, where target models surpass red-teamers in capabilities. To study this shift, we frame red-teaming through the lens of the \emph{capability gap} between attacker and target. We evaluate more than 600 attacker-target pairs using LLM-based jailbreak attacks that mimic human red-teamers across diverse families, sizes, and capability levels.  Three strong trends emerge: (i) more capable models are better attackers, (ii) attack success drops sharply once the target’s capability exceeds the attacker's, and (iii) attack success rates correlate with high performance on social science splits of the MMLU-Pro benchmark. From these observations, we derive a \emph{jailbreaking scaling curve} that predicts attack success for a fixed target based on attacker-target capability gap. These findings suggest that fixed-capability attackers (e.g., humans) may become ineffective against future models, increasingly capable open-source models amplify risks for existing systems, and model providers must accurately measure and control models' persuasive and manipulative abilities to limit their effectiveness as attackers.

Published as a conference paper at ICLR 2026
CAPABILITY-BASED SCALING TRENDS FOR LLM-BASER RED-TIGMING
Alexander Panfiloy 1.233 Paul Kassianik
Maksym Andriushchenko
Jonas Geiping Geiping1.2.31 2,3.1
ELLIS Institute Tübingen
Max Planck Institute for Intelligent Systems Tübingen Al Center
Foundation Al Cisco Systems Inc. "EPFL
al eexander... www.eeeaaaaaio..eellll.....
ABSTRACT
As large language models grow in capability and agency, identifying vulnerabilities through red-teaming becomes vital for safe deployment. However, traditional prompt-engineering approaches may prove ineffective a weak-to-strone problem, where target models surpass red-teamers in capabilities. To study this shift, frame red-teaming through the lens of the capability gap between attacker and target. We evaluate more than 600 attacker-target pairs using LLM-based jailbreak attacks that mimic human red-teamers across diverse families, sizes, and capability levels. Three strong trends emerge: (i) more capable models are better attackers, (ii) attack success drops sharply once the targets capability exceeds the attacker's s, and (iii) attack success rates correlate with high performance on social science splits of the MMLU-Pro benchmark. From these observations, we derive jailbreaking scaling curve that predicts attack success for fixed target based on attacker-target capability gap. These findings suggest that fixed- capability attackers (c.g.. humans) may become ineffective against future models, increasingly capable open- sour-source models amplify risks for existing systems, and model providers must accurately measure and control models' persuasive and manipulative abilities to limit their effectiveness as attackers.
red-teaming turns into
INTRODUCTION
Large language models (LLMs) are rapidly evolving into powerful general-purpose systems, capable of reasoning (Guo et al., 2025), task completion (OpenAI, 2025), and even conducting research (Intology AI, 2025). Alongside this rise, substantial efforts have been made to ensure the safery of these models. As part of the pre-release safety evaluation process, human red-teamers often probe LLMs for failure modes and unsafe behaviors (Anthropic, 2024; Kavukcuoglu, 2025). This gives rise to various jailbreaking attacks, aimed at eliciting harmful behaviors in worst-case scenarios, i.e., assessing how secure or adversarially aligned model is (Carlini et al., 2023: Qi et al., 2024a).
The real-world harm from jailbroken models remains rather limited (Geiping et al., 2024), if present all (Willison, 2023). However, the core argument is that general and agentic capabilities advance, sufficiently integrated Al systems will pose very practical security risks (Rando et al., 2025; Bostrom, 2014). Robey et al. (2025) offer glimpse of such future: an LLM-powered robot dog jailbroken using a purely black-box RoboPAIR attack, leading to physical-worid harm.
However, some foresee a future where systems become impossible to jailbreak (Kokotajlo et al., 2025). While Kokotajlo et al. (2025) offer no empirical evidence for such maximalist predictions, we observe two orthogonal trends that point in that direction for human-like black-box red-teaming: (i) safety mechanisms are getting stronger (both system-level (Sharma et al., 2025) and model-level (Zou et al., 2024; Kritz et al., 2025)); and (ii) models themselves are becoming smarter general.
Equaa supervision.
Code available https: / //gi
com wwt....co//ottkkeeeeee.. http://ppppatttybaeeededeeea
1 -tty-basedsse scaling..

---

Published as a conference paper at ICLR 2026
Linear Scaling Trend for
Forecast for Human Red-Teaming
Capability-Based Scaling
LLM-based Red- Teaming
Model Families: - Liama2
Liame3 Mistral - Vicune = Qwen2.5
Gemini
OpenAl
Modelled Human MMLUUPPr
Per-Target Attack Success Rate
1.0
GPTTallhh
weak-to-strong
Attacker Success Rate
0.6
0.8
MMLU-Pro Score
0.4
0.6
Claude 3.7 Sonnet
gemim/ 5pm
'GPT-beld
0.4
0.4
"GPT-
"65'
0.2
0.2
0.0
strong-to-weak
General Capabilities Attacker
0.2
-2
Capability Difference
0.0
Existing Models Hypothetical Models
between Attacker and Target
O Predicted Attack Success Rate
Figure I: Overview of Our Contributions. We evaluate over 600 attacker-target combinations with four LLM--based jailbreak attacks and find that attacker success rate scales linearly with general capability (measured with MMLU-Pr scores). 2 However, for a fixed target model the attack success rate follows sigmoid curve and can be predicted accurately from the attacker-taree capability gap. @ Using the scaling trends observed in currently deployed models, forecast that red- red-teaming any fixedcapaaiility attacker, such human, will inevitahly become less effective target models' capabilities increase.
This increase in capability means that models also better adhering to safety guidelines and better at reasoning about user intent (Zaremba et al., 2025; Ren et al., 2024b).
As models become This contrasts with the vast majority of current black-box attacks, which "outsmart" target models in variety of ways: clever prompt engineering (Liu et al., 2023), role-playing (Shah al., 2023), social-engineering techniques (Zeng et al., 2024), etc. In an attempt to understand how future weak-to-strong dynamies may impact model security, we ask:
capable, red-teaming is increasingly being cast weak-to-strong problem.
At what capability gap might human-like red-teaming become infeasible?
To answer this question, we model the success of red-teaming as function of the capability gap (the difference in benchmark scores, e.g., MMLU-Pro (Wang et al., 2024)) between Attacker and Target. To evaluate capabilities on equal footing, we implement four human-like LLM- based jailbreaking attacks: PAIR (Chao et al., 2025), TAP (Mehrotra et al., 2024), PAP (Zeng al., 2024) and Crescendo (Russinovich et al., 2025). We execute them on over 600 attacker-target pairs, examining 29 target models across variety of families, parameter sizes, and capability levels (see Figure 2). We consider exclusively LLM-based red-teaming attacks. We apply model unlocking (Qi al., 2024b; Volkov, 2024) remove safety guardrails from open-source models while preserving their general capabilities for use as attackers (see Section 3.2 and Appendix A).
This large-scale study yields several key insights that contribute to our understanding of future black-box box red-teaming. These are as follows:
Stronger Models are Better Attackers. Attacker success, averaged over targets, rises almost linearly with general capability (p > 0.88; see Section 4). This underscores the need to benchmark models' red-teaming capabilities (as opposed defensive capabilities) before release.
A Capability-
Red-Teaming Scaling Curve. For most currently released models, including closed-soures ones, attack success rate (ASR) declines predictably as the capability gap between at- tackers and targets increases and can be accurately modeled as sigmoid function (see Section and Section 5). This finding suggests that while human red-teamers will become less effective against advanced models, increasingly capable open-source models will put existing LLM systems at risk.
Social-Science Capabilities are Stronger ASR Predictors than STEM Knowledge. Model capabilities related to social sciences (e.g., health, psychology and philosophy) are more strongly correlated with attacker success rates than STEM capabilities (Section 6). This finding highlights the need to measure and control models' persuasive and manipulative capabilities.
Taken together, our findings offer a practical framework for reasoning about how long LLM -.we-ed applications are likely to remain safe in the face of advancing L.MM attackers. They underscore the
2

---

Published as a conference paper at ICLR 2026
need for model providers to further invest in improving robustness, scalable automated red- red-teaming and systematic benchmarking of persuasion and manipulative abilities of models.
RELATED WORK
Human Red- Red-Teaming, To prevent harmful behavior in deployed models, LLM providers employ manual red- red-teaming, where human testers attempt to elicit unsafe outputs and refine model responses through targeted feedback (Anthropic, 2024; Team Gemini et al., 2024; Ganguli al., 2022). While effective for identifying certain behavioral flaws, this approach is not scalable: it relies on creativity, manual data curation, and high-cost human oversight. Moreover, human red-teamers often fail to discover unnatural but highly effective inputs that are uncovered by automated white-box jailbreak attacks (Zou et al., 2023; Andriushchenko et al., 2025). Nonetheless, some human-discovered strategies, such as multi-turn attacks (Li et al., 2024a), past-tense framing (Andriushchenko & Flammarion, 2025), and payload-splitingg (Liu et al., 2023) do not emerge naturally from automated pipelines and show strong transfer across models once discovered.
Automated -ea-ingn Automated red-teaming, or juilbreaking, has emerged as a scalable way to benchmark LLMs under worst-case safety scenarios (Chao et al., 2024; Mazeika et al., 2024; Perez et al., 2022) with attack success rate (ASR) as the primary evaluation metric. To emulate human-like probing strategies, numerous LLM-based jailbreak methods have been proposed (Chao et al., 2025; Mehrotra et al., 2024; Russinovich et al., 2025; Pavlova et al., 2024; Sabbaghi et al., 2025) where attacker model is guided by red-teaming prompt containing human-curate in- context demonstrations. These methods operate under black-box threat model that mirrors human constraints and broadly reflect human-like strategies (Shah et al., 2023; Schulhoff et al., 2023; Li et al., 2024a; Zeng et al., 2024). These strategies include role-playing (Chao et al., 2025; Shen al., 2024), word substitution (Chao et al., 2025), emotional appeal (Chao al., 2025; Zeng et al., 2024), usage of the past tense (Russinovich et al., 2025), decomposing harmful queries over multiple turns (Glukhov et al., 2025; Russinovich et al., 2025), and others. While typically less effective than white-box algorithmic attacks (Boreiko et al., 2025), the most capable LLt--attcckess perform on par with experienced human red-teamers (Kritz et al., 2025).
Jailbreaking and Capabilities. In recent large-scale analysis of safety benchmarks, Ren et al. (2024b), inter alia, were the first to quantify the relationship between jailbreaking success and model capability, reporting negative correlation for human-likk jailbreaks. This is supported by Huang et al. (2025), who, in a different context, observed a bidirectional effect: highly capable models are more consistently refusing while weaker models often fail produce harmful outputs due low utility. Howe et al. (2025) present preliminary evidence that GCG attack success decreases as model size (and therefore capabilities) increases within the Qwen 2.5 family.
Scaling Trends of Jailbreaking. In the context of jailbreaking, prior work has primarily examined scaling with inference-time compute. Increasing compute benefits both sides: more compute spent on reasoning on the defender side reduces ASR (Zaremba et al., 2025) while more compute spent generating attacks increases (Boreiko et al., 2025). On the attacker side, ASR has been shown to follow power-law with respect to the number of jailbreak attempts (Hughes et al., 2025) and with respect to the number of harmful in-context demonstrations (Anil et al., 2024). Schaeffer al. (2025) further derive how power-law scaling arises from exponential scaling for individual jailbreaking problems. Howe et al. (2025) explore how attack success scales with compute spent on adversarial training and conclude that the attacker's compute scaling outpaces the defender's.
Our work explores a complementary axis: Instead of scaling the number of jailbreaking attempts, we study how ASR scales with the difference between attacker and target model capabilities.
3 EXPERIMENTAL SETUP: THE TARGET, THE ATTACKER AND THE JUDGE
LLM-based jailbreaking attacks offer a natural framework to study how capability dynamics between attackers and targets affect red red-teaming success. Unlike human studies (Li et al., 2024a), they allow direct and controlled comparison between attacker and target capabilities, as both roles are fulfilled by language models. To capture the diversity of human red-teamers' strategies, include following
3

---

Published as a conference paper at ICLR 2026
Attack Success Rate on HarmBench
@wen2.5-722
1.5
owen2.5-55 5:326
1lama3.3-70b
llama3.1 70b
mistral-small-24
llama3-70b
qwen2.5-14b
Attacker Model
qwen2.577
Ilama3 1-8b
mixtral-8x/7
llama3-8b
qwen2.5.3b
1lama2-70b
@wen2.5-1.55
llamm3.223b
0.4
mistral 7b
Ilama2-155 13b
vicuna-1 3b
0.3
vicuna-7b
llama2-76 7b
02
llama3.2-18
qwen2.5 0,5b
Direct Query
Avg. Target ASR
0.0
ewerrii s0.5b
ameere 5-70
vicums 13b
66x76
caaan 5 72b
Awen2..5 4-14
Ilamm8. 2.3b-
Hamaa.1-700 1-70b
11amm3.3-77 2amm3.3-770b 3-70b
Illmm3.2 2 1b-
Ilama3. 1-8b
gemini-2.0 D-flash
Ilama3 70b-
03
o4
gpt-4.1
n3
llama8 8b-
gemini 2, pro
liama2: 122-118
Ilama2 70b.
Ilamaa-77 1ona227b--.
claude 3.7 7-sonntt--
Avg. Attacker ASR
mintrakses
awering
owent
interrl
mistra
Target Model
Figure All Attacker-Tarre Target Combinations. We evaluate over 600 attacker-target pairs, with each heatmap showing max per-pair Attack Success Rate (ASR) eliciting unsafe behaviors (over the first 50 queries HarmBench), aggregated across all evaluated attacks. Column view: Sorted by Average Target ASR (last row), lighter-colored columns (e.g.. Llama2-133 13b) indicating more robust targets, Row view: Sorted by Attacker MMLU-Pro, darker-colored rows (e.g., Qwen2.5-32h) indicating stronger attackers. From the last column, Average Attacker ASR, observe that increases with attacker capahility. 1lama3.2-Ib being the least capable model o3 (target-only) the most capable our analysis (based on MMI.U-Pro).
single-turn attacks: PAIR (Chao et al., 2025), TAP (Mehrotra et al., 2024), PAP (Zeng et al., 2024), and multi-turn Crescendo (Russinovich al., 2025) attack.
Each attack involves three key model components: the Target, a victim model that should not comply with the harmful query; the Attacker, an LLM that generates prompts designed elicit harmful responses; and the Judge, which evaluates target responses for compliance, relevance, and quality, and provides feedback the attacker. For these components, varying sizes and capabilities: Llama2 (Touvron et al., 2023), Llama3 (Grattafiori et al., 2024), Vicuna (Chiang al., 2023), Mistral (Jiang et al., 2024), and Qwen2.5 (Yang al., 2024). Additionally, we include Gemini (Kavukcuoglu, 2025), GPT-4.1 (OpenAI, 2025), o-series (OpenAI, 2025b;a), and Claude-3.7 Sonnet (Anthropic, 2025) models as targets only.
consider five model families of
We use HarmBench (Mazeika et al., 2024), a standardized benchmark for evaluating jailbreaking attacks. Each attack run independently per harmful behavior and proceeds over N inner steps. Tar- get responses are evaluated post-hoc using neutral HarmBench judge that is known for high human agreement (Mazeika et al., 2024; Souly et al., 2024; Boreiko et al., 2025) and is not involved in the attack loop influences the attack process. We evaluate all generated target model outputs each inner step and report ASR as best-of-N attempts, with up to 25, unless stated otherwise. The use of ASR @:25 allows disentangle attacker's and judge's contributions, which we analyze in Section 6.
We adapt the HarmBench implementation for PAIR, PAP and TAP and the AIM Intelligence implementation (Yu, 2024) for Crescendo. Hyperparameter details are provided in Appendix B. We provide additional evaluation on ClearHarm dataset (Hollinsworth et al., 2025) in Appendix C, The remainder of this section focuses on the model components used in the attacks.
3.1 THE TARGET
Target models vary widely in how they are aligned, both in terms of alignment goals and training procedures. Even models of similar scale and generation differ in robustness: Vieuna notably
'Hamm implementation differs from original the work by Zeng et al. (2024).
4

---

Published as a conference paper at ICLR 2026
1.0
= p= 0.88
1.0
R 0.83
Model Families
Attacker Success Rate
-0.71
Llama2
Target Target Vuinerability
Liema
Mistral
Viouna
0.6
0.6
Qwen2.5
Claude
Gemini
0.4
0.4
OpenAl
Model Size
0.2
0,2
3-48
13-320
0.2
0.4
0.6
0.2
0.4
0.6
0.8
Attacker MMLU-Pro
Target MMLU-Pro
>708
Figure More Capable Models Are Stronger as Both Attackers and Targets. Left: Attacker Success Rate, averaged over all targets, increases linearly with attacker capability. Right: Target Vulnerability, defined as the max achieved per-target ASR, decreases with target capability. Models generally follow sigmoid-lik curve, with only early Llama models (Llama2-7b,- 1a,,77,,--3,,700 70b, and Llama3-8b) emerging outliers due to their notably higher robustness pattern that later Llama releases do not maintain. It² is reported for each fit, excluding four outliers Target Vulnerability, alongside with Spearman p.
easier to break than the Llama2 models (Chao et al., 2024; Mazeika et al., 2024; Boreiko et al., 2025), Llama3 appears to have undergone adversarial training (Boreiko et al., 2025), while models like DeepSeek (Guo et al., 2025) are better aligned to region-specific queries (Rager & Bau, 2025).
While standardized safety and instruction tuning of all target base models is possible principle, would be both prohibitively expensive and unrepresentative of how alignment is handled in real-world deployments. We therefore focus our analysis on per-target and per-family trends, exercising caution in tross-family comparisons. To ensure shared baseline notion of safety, we follow Boreiko et al. (2025) and add the Llama2 system prompt to all target models, with which models exhibit low ASR on direct HarmBench queries (see Figure 2, last row).
3.2 THE ATTACKER
The attacker model initialized with a method speciffc system prompt that describes the red-teaming task and the target harmful behavior. As the attack progresses, the attacker's 's context is incrementally updated with previous prompts, target responses, and judge feedback from earlier steps.
Model Unlocking. Prior studies typically restricted attacker model choice to models with minimal safety tuiing, such as Vicuna- 13b or Mixtral-8x7b (Chao et al., 2025; Mehrotra et al., 2024; Schwartz et al., 2025). This is due to the fact that safety-aligne red-teaming (Kritz et al., 2025; Tsmindashvili et al., 2025). To climinate the attacker's 's refusal as a confounding factor in analysis, we first unlock all attacker models.
models typically refuse participate in
Following prior work (Gade et al., 2023; Yang et al., 2023; Arditi et al., 2024; Volkov, 2024; Qi et al., 2024b; 2025a), exploit the observation that safety alignment is rather "shallow" and can be easily undone. Specifically, we perform LoRA (Hu et al., 2022) fine-tuning using a mix of Badl lama (Gade al., 2023; Volkov, 2024) and Shadow Alignment (Yang et al., 2023) datasets, totaling close to 1500 harmful examples. Unlocking success is evaluated with ASR of direct HarmBench queries. Full details on the unlocking procedure with benchmark scores for each model are provided in Appendix A.
3.3 THE JUDGE
Many prior works rely on highly capable models, such as GPT-4, to act as inner judges that provide feedback to the attacker (Chao et al., 2025; Mehrotra et al., 2024; Yu, 2024; Russinovich et al., 2025; Ren et al., 2024a). In our experiments, we use the unlocked attacker as judge, prompted with a method-specifie system prompt that defines the grading scheme for the target's response. We analyze the role of the judge in Section and we find that the choice of judge does not impact the attack's success rates at high N in the best-of-N setting.
5

---

Published as a conference paper at ICLR 2026
Median Prediction
68% CI
Train Data: ASR of varying attackers a fixed target
Individual Fit
95% Cl
Test Data: ASR of varying attackers on new frontier targets (Gemini, OpenAl)
1.0
Qwen2.5-722
1.0
Mistral-7b-v0.2
1.0
Llama3.2-1b
Per- Per-Target Scaling
R' - 0.63
Attack Success Rate
0.8
Miscoverage 0.7%
0.6
0.6
0.2
0.2
= 0.84
0.0
Miscoverage (%) 3.7%
0.0
Miscoverage (%) 5.0%
0.0
-4
-2
Per-Family Aggregation
Qwen2.5 Models
1.0
Mistral Models
Llama3 Models
Attack Success Rate
0.6
0.6
0.4
0.4
0.2
0.2
Avg. 0.79
R² 0.81
Avg. 0.67 Avg. Miscoverage =%) 3.2%
Avg. Miscoverage (%) 13.3%
Avg. Miscoverage 2.8%
0.0
0.0
0.0
2
-4
2
-4
0 Capability Difference
2
Capability Difference
Capability Difference
Figure 4: Capability -Babbe Scaling of Jailbreaking Attack Success Rate. Top: Per-target scaling, For each larget model fit linear model in logit space using the max achieved ASR of every attacker-target pair, then map predictions back to probability space; shaded bands show bootstrapped confidence intervals. Bottom: Family-levol scaling. Per-target curves from the same family are aggregated into a single scaling trend, which we test on new targets, not part of the model family. The Qwen2.5 curve generalizes best, closely matching ASR on closed-source state-of-the-art reasoning models (Gemini and OpenAl models plotted in yellow).
4 JAILBREAKING SUCCESS SCALES BOTH WAYS WITH CAPABILITIES
We unlock 22 models and evaluate over 600 attacker target combinations, including more than 150 combinations with closed-source state-of of-tte--rttttttt reasoning models as targets. Results on the first 50 HarmBench behaviors, aggregated over attacks, are presented in Figure 2.
We then separately evaluate each attacker and target model standard benchmarks (see Ap- pendix A.1): IFEval (Zhou et al., 2023), GSM8k (Cobbe et al., 2021), and MMLU-Pro (Wang al., 2024). For closed-source models, benchmark scores taken from vals.ai (vals.ai, 2025) or the official model cards when available. We observe a consistent trend (see Figure 3): the general capability (measured with MMLU-Pro) of both attacker and target models strongly correlates with jailbreaking success.
Stronger Models
Are Better Attackers. Averaged over the highest achieved ASR on each target in the model set, model's average Attacker ASR scales linearly with its general capability, as measured by MMLU-Pro on the unlocked model (Figure 3, left). The average Spearman correlation between average Attacker ASR and MMLU-Pro score exceeds 0.84. We further analyze the correlation with other benchmarks and MMLU-Pro splits in Section
latexStronger Models Are Hardier Targets. We assess the maximal ASR achieved against each target over all considered attacks and attackers, as we are interested worst-case robustness, since single strong attacker is sufficient to breach an LLM-based application. Consistent with Ren et al. (2024b), we observe a negative correlation between ASR and target models' capabilities, but beyond that, able precisely characterize the relationship.
From Figure we infer that for most currently deployed models, including all recent open-source releases and closed-soures frontier models, target's 's MMLU-Pro score approaches that of the strongest attacker (MMLU-Pro zs 0.62), target ASR declines gradually; once the target surpasses the attacker, ASR falls rapidly (R²2 0.83). In other words, jailbreak success depends the capability

---

Published as a conference paper at ICLR 2026
Claude-3.7 Sonnet
Claude-4.5 Sonnet
mmissraa-smmll--22
gemimi-2 2.0-flash
gemini-2.55 pro
owen2. 5-32b
Ilamma. 1-700b
1lamm3.33 3-70b
K qwen2 5-72b
mixtral-
owen2. 5.5
A owen2. 10.55-144
llama3-705
03-mini
04-mini
"GPT-alpha"
"GT GGPT-beta bet-beta"
gpt-4.1
GPT-5
GGP--
MMLU-Pro Score
01
03
'5'
1.0
0.5
0.0
Existing Models Hypotetical Models
Predicted Human ASR (+std) Highest ASR in Evaluation
Evaluated Models
Human MMLU-Pro (0.898)
Figure Forecast Human Red-Teaming, Using aggregated scaling trends across target models, we predict ASR for a fixed human attacker (modelled as 0.898 on MML.U-rro). The forecast shows a continued decline as future models grow more capable and capability gap widens. For the reference, we add the highest achieved ASR with an LLM-attacker in our study.
gap rather than the attacker's absolute strength: an attacker is highly effective only while its capability exceeds or matches the target's s, and it loses leverage once the target surpasses.
Four of the chronologically earliest Llama models deviate from this trend, exhibiting notably higher robustness than their capability scores would predict. We further discuss this deviation in Section 7.
Takeaway: Jailbreaking success scales linearly with attacker's capability for fixed target set. Thus, newly released models increase risks for deployed LLMs, making essential (i) regular robustness evaluations and (ii) pre-release attacking capabilities testing. Identified outliers show that heavy safety tuning can extend a system's lifespan against stronger attackers.
CAPABILITY GAP-BASED SCALING OF JAILBREAKING SUCCESS
We posit that, for sufficiently capable targets, jailbreak success is primarily governed by the difference between (i) the target's defending capability (i.e., the extent of safety tuning) and (ii) the attacker's attacking capability (i.e.. its ability to elicit harmful responses). Following the results in Section 4, we use MMLU-Pro scores of unlocked models proxy for attacking capabilities.
For defensive capabilities, we use MMLU-Pro scores of original checkpoints. While better proxies (e.g.. FLOPs spent on safety alignment) are not publicly available, the identified trend appear hold for most recent models. To account for residual differences in safety tuning across model families, we analyze how per-target ASR scales with the capability gap between attacker and target.
Modeling. For each target model t E T, we fit separate regression model using all attackers A]. For same targee pairs we select the highest ASR over the attacks. Following Miller et al. (2021), we fit linear regression in the transformed space, by
for attacker-target pairs {a
applying logit transformation logit(p) = log (_ which maps both ASR and MMLU-Pro scores IR. We then define the capability gap 8 between attacker and target formally as the difference of their logit-scores: 8 = logit (oMMLU-PPT) logit (MMLUPP which provides zero-centered, symmetric and unbounded measure of relative capability.
We perform per-target modeling of logit-transformed ASR as linear function of the capability gap. To quantify predictive uncertainty, we bootstrap per-target data and aggregate regression ensembles. Full details on considered metrics, model selection and uncertainty estimation are provided in Appendix D.
We present per-target scaling trends in Figure 4. For Qwen2.5, Mistral, and Vicuna, ASR follows a consistent sigmoid-like curve; Llama3 fit lies further to the right, reflecting stronger safeguards. The four earliest Llama models remain exceptionally robust in the strong-to-weak regime, indicating that MMLU-Pro is an insufficient measure for their defensive capability; these models follow separate trend and the only outliers among the 29 models analyze (see Figure 1, center). Assuming similar safety tuning within the same model family and generation, we also show the far-family (aggregated) scaling in Figure 4, bottom.
Results.
7

---

Published as a conference paper at ICLR 2026
The curve established for the Qwen2.5 family generalizes well frontier targets, the most capable closed-source reasoning models, used as a held-out test set. Test points always have negative gap, those exceed in capabilities every attacker in our analysis. Llama3, as better safeguarded family, moves the curve rightwards. In the saturated weak-to-strong regime (6.-1 < -3.5), ASR do not exceed 0.2, while can be challenging in strong-to-weet for extensively safety tuned models.
Forecasting. We aim to use the derived scaling trends to forecast ASR for fixed attacker across future models. Since it unclear whether upcoming models will follow more safeguarded trajectory like Llama3 or a looser one like Qwen2.5, we base our forecast on the median scaling trend aggregated across all considered targets (excluding Llama2 and Llama3-8b due to poor fit). Assuming current LLM-based jailbreak methods remain representative, we use the median line parameters (k 1.73, b -0.79) to forecast for fixed human red-teamer with assumed MMLU-Pro score 0.898 across present and future models in Figure 5. Future targets are assumed to surpass human-level general capability. Our model predicts that human ASR declines as models grow more capable. In Section 6.3, we analyze how future attacks, potentially more representative of human red-teaming and achieving higher ASR, could alter this trend.
Jailbreaking success can be predicted from the capability gap between attacker and target, as measured by benchmarks scores. Current trends suggest human red-teaming will lose effectiveness once models surpass human-level capability. If forthcoming models adopt safeguards as strong as those in early Llama releases, the drop would occur even sooner.
Takeaway:
6 ANALYSIS
In this section analyse how different attacker capabilities, judge choice, and attack methods influence attack success rate (ASR) and the resulting scaling curves.
6.1 WHAT MAKES A GOOD ATTACKER?
1.0
We analyze unlocked attacker models to identify which attacker capabilities cor- relate most strongly with ASR averaged across all targets. We present the results in Figure for a selection of benchmarks.
Correlation with ASR
Social Sciences
STEM
3.9
Law
MMLU Pro
Economies
Biology
History
Philosophy
Psycholog
Health
Physics
Busimess
0.8
Chemistry
GSM8K
Engineering
Math
Averaged over targets, attacker ASR cor- relates most strongly with the social- science splits of MMLU-Pro, whereas correlations with STEM splits are over- all weaker. We speculate that effective attackers might rely on psychological in- sight and persuasiveness, also used hu- man social-engincerrng. While these cor- relations do not establish a causal link, and multiple-choice benchmarks are not direct measure of persuasive capability, it is plausible that both jailbreaking performance and psychology benchmark scores rely on overlapping latent capabilities related to modeling human cognition and social behavior.
0.
IFEval
Figure 6: Correlation with Benchmarks. We compute Pearson r between average attacker ASR and various benchmark scores. Because
capable models score higher nearly every benchmark, r high across the board; however. the strongest correlation appears in the social-sciences splits of MMLU-Pro
Today's 's safety discourse is hyper-focused 2024b; Götting et al., 2025) and on unsuccessful attempts to unlearn them (Qi et al., 2025b; Lucki al., 2025). Our results point different blind spot: as models grow, their persuasive power rises (Durmus et al., 2024), yet systematic benchmarks for measuring and limiting this trait remain scarce. Tracking such capabilities should therefore become a priority, both forecast attacker strength and to protect users and LLM-based systems from manipulation risks (Matz et al., 2024; O'Grayy, 2025).
model's hazardous technical capabilities (Li et al.,
6.2 WHAT MATTERS MORE: A GOOD JUDGE OR A GOOD ATTACKER?
Prior work typically uses a high-capability model as the inner judge (Chao et al., 2025; Mehrotra et al., 2024; Russinovich et al., 2025). We confirm that more capable models are better judges: Pearson
8

---

Published as a conference paper at ICLR 2026
Model Size
Vicuna-7b
+38
ASR for a Fixed Attacker
with Varying Judges
ASRg22
Llama3.
Judge MML MMLU-Pr0
0.6
3-88
0.8
13-328
>70B
Model Families
Llama2
Llama3
0.4
Mistral
Qwen2.5
Vicuna
00
0.0
0.2
0.4
0.6
0.9
0.0
0.2
0.6
0.8
Judge Correlation (PAIR vs HarmBench)
Judge Correlation (PAIR vs HarmBench)
Figure 7: Stronger Models Are Better Judges, but This Does Not Affect ASR. Left: More capable models evaluate harmfulness better and correlate stronger with the HarmBench judge. Right: The judge does not increase ASR; only improves prompt selection @ level. When all per-behaviour attacks are evaluated, A stays nearly constant across judges for a fixed attacker.
r (Judge Correlation in Figure 7) between each judge's 's score and neutral HarmBench judge labels increases with the inner judge's MMLU-Pro score (Figure 7, left).
To disentangle the influence of the judge and attacker on ASR, we run PAIR with two fixed attackers (Vicuna-7b and Llama3-8b) while switching the judge. We find that the judge does not affect the qual- ity of prompts the attacker generates; only affects selection. the maximum over all generated prompts, is stable across judges, whereas ASR @ 1, which uses only the top-ranked prompt, rises with judge capability because stronger judges pick better inputs.
shown in Figure (right), ASR @25, 25,
This insight is valuable for the jailbreak community, it suggests that costly closed-source judges are unnecessary inside the attack loop as selection can be done post-hoc.
6.3 How Do DIFFERENT ATTACKS AFFECT THE SCALING?
The release new LLM-based attacks can in- crease attack success rate and thus modify per- target trends. In Section 5, we the scaling curves using the maximum ASR across attacks for each attacker-target pair. Figure complements that analysis by showing trends aggregated per attack. Stronger attacks shift the curve leftward and make it steeper, increasing the capability gap which a jailbreak is still feasible.
1.0
Atx(Attakks)
Sigmoid
Attack Success Rate
0.8
1te 20 ke.kbb
== 1..0,.0 b 0.8
0.8
0.6
0.4
Attacks
On robust targets (see Figure 13) Crescendo and PAP achieve higher ASR, yet overall both un- derperform PAIR and TAP when run on the same query budget. This agrees with recent study by Havaei al. (2025), which show that TAP signif- icantly outperforms Crescendo. We attribute the original success Crescendo to its use of highly capable GPT-4 attacker (Russinovich et al., 2025).
PAIR
0.2
TAP
PAP
Crescendo
0.0
-4
-2
General Capability Difference between Attacker and Target
Figure Stronger Attacks Shift the Curve and Make It Steeper. Each line shows the scaling curves aggregated over all targets, with only com- attacker- -trgetttttret pairs among attacks included in per-target fits. TAP overall achieves the highest ASR across larger capability gaps.
DISCUSSION
Limitations. Our evaluation relies on four attacks which do not exhaust the range of tactics a human red-teamer might employ. Humans act as lifelong learners, transferring any newly discovered exploit from one harmful behavior another. AutoDan-Turte (Liu et al., 2025) explores this direction, however Havaei et al. (2025) report that TAP is more effective a direct comparison.
Several studies discuss training specialized models that learn to jailbreak other models (Kumar et al., 2024; Liao Sun, 2024; Lee et al., 2025; Liu et al., 2025). If a weaker model can be trained into a much stronger attacker, capability- framework may capture that jump, since uses MMLU-

---

Published as a conference paper at ICLR 2026
Pro as fixed proxy for attacking capabilities. However, current attacker models trained to jailbreak a particular target often transfer poorly to newer targets (Havaei et al., 2025; Kumar et al., 2024).
On the defender side, MMLU-Pro remains limited proxy. Our results demonstrate that four early Llama models deviate from what target-only MMLU-Pro scores would predict. We hypothesize this stems from specific design choices in their safety training: Llama2 models are known to be overrefusive (Touvron et al., 2023; Samvelyan et al., 2024), occasionally rejecting benign queries, while Llama3-8b appears have incorporated adversarial training (Boreiko et al., 2025), which may confer robustness to the particular attacks we used beyond what general capabilities alone would suggest. These observations indicate that intensive safety interventions can shift models off the general capability- based trend, though notably, later Llama releases revert to the trend followed by other modern models.
Alternative proxies for defensive robustness might include FLOPs spent safety tuning. However, such metrics are rarely disclosed by model developers, making systematic comparison infeasible. Despite these limitations, a general capability measure remains reasonable and highly predictive proxy for both attacking and defensive capabilities across the large suite of models we evaluated, including frontier closed-source models.
Implications. For model providers: (i) Safety tuning pays off: well-guarded models remain robust even against far stronger attackers; (ii) cazarious-cupaabiity evaluations must look beyond "hard science" and examine models' persuasive and psychological skills; (iii) a model's own attacking capabilities should be benchmarked before release; and (iv) release of substantially stronger open-source model requires re-evaluation of the robustness of existing deployed systems.
For the jailbreaking community: (i) Attacker strength drives the ASR, the benefit of costly judges is limited; and (ii) widening capability gap will make manual human red-teaming substantially harder, making automated red-teaming the key tool for future evaluations, drawing attention to rising sandbagging (van der Weij et al., 2025) and oversight (Goel et al., 2025) problems.
Conclusion. Jailbreaking success governed by the capability gap between attacker and target. Across 600+ attacker-target pairs we show that stronger models are both better attackers and hardier targets, and we derive scaling curves that predict ASR from this gap. Persuasive, skills drive attack strength more than STEM knowledge, underscoring the need for new benchmarks on psychological and manipulative red teaming capabilities. These results call for capability- pre-release testing and scalable Al- red-teaming as models continue to advance.
REPRODUCIBILITY STATEMENT
We provide model-unlocking details in Appendix A and attack hyperparameters in Appendix B. We include code and documentation with our submission to facilitate reproducibility.
ACKNOWLEDGMENTS
The authors thank, in alphabetical order: Alexander Rubinstein, Dmitrii Volkov, Egor Krasheninnikov, Guinan Su, Igor Glukhov, Simon Lermen, Vaclav Voråčck, and Valentyn Borciko for their time, helpful comments and insights. AP especially thanks Evgenii Kortukov and Shashwat Goel for their thoughtful feedback throughout the project and assistance with the manuscript. PK thanks Blaine Nelson and Kamilé Lukošiūtë for their thoughtful feedback throughout the project.
JG and MA thank the Schmidt Science Foundation for its support. AP acknowledges support from the ELSA (European Lighthouse Secure and Safe AI) Mobility Fund and thanks the International Max Planck Research School for Intelligent Systems (IMPRS-IS) for their support.
REFERENCES
Maksym Andriushchenko and Nicolas Flammarion. Does refusal training in LLMs generalize the past tense? In The Thirteenth International Conference on Learning Representations, 2025. URL https://cpeerev/ net forum? dwwammdddaaaueeeee fM.
10

---

Published as a conference paper at ICLR 2026
Maksym Andriushchenko, Francesco Croce, and Nicolas Flammarion. Jailbreaking leading safety- aligned LLMs with simple adaptive attacks. In The Thirteenth International Conference on Learn- ing Representations, 2025. URL /oppp///i//e/eeeeeee.eo net/
Cem Anil, Esin Durmus, Nina Panickssery, Mrinank Sharma, Joe Benton, Sandipan Kundu, Joshua Batson, Meg Tong, Jesse Mu, Daniel Ford, Fracesco Mosconi, Rajashree Agrawal, Rylan Schaeffer, Naomi Bashkansky, Samuel Svenningsen, Mike Lambert, Ansh Radhakrishnan, Carson Denison, Evan Hubinger, Yuntao Bai, Trenton Bricken, Timothy Maxwell, Nicholas Schiefer, James Sully, Alex Tamkin, Tamera Lanhan, Karina Nguyen, Tomasz Korbak, Jared Kaplan, Deep Ganguli, Samuel R. Bowman, Ethan Perez, Roger Baker Grosse, and David Duvenaud. Many-shot jail- breaking, In Advances in Neural Information P Processing Systems, volume 37, pp. 129696-127742, 2024.
Anthropic. The claude 3 model family: Opus, sonnet, haiku, 2024. URL https://api. semanticscho wwt. 268232499.
Anthropic. Claude 3.7 sonnet and claude code. https: /www. www.aapic...coocaaaaca.cooccca -laude-3-7-oa 3-rte------onnet. February 2025. Accessed: 2025-11-23.
Andy Arditi, Oscar Obeso, Aaquib Syed, Daniel Paleka, Nina Panickssery. Wes Gurnee, and Neel Nanda. Refusal in language models is mediated by single direction. In Advances in Neural Information Processing Systems, volume 37, pp. 136037-136083, 2024.
Devansh Arpit. Stanishaw Jastrzębski, Nicolas Ballas, David Krueger, Emmanuel Bengio, Maxinder S. Kanwal, Tegan Maharaj. Asja Fischer, Aaron Courville, Yoshua Bengio, and Simon Lacoste- Julien. A closer look memorization in deep networks. In Proceedings of the 34th International Conference on Machine Learning, volume 70, pp. 233-242, 2017.
Arip Asadulaev, Alexander Panfilov, and Andrey Filchenkov. Easy batch normalization. arXiv preprint arXiv:2207.08940) 2022.
Mikhail Belkin, Daniel Hsu, Siyuan Ma, and Soumik Mandal. Reconciling modern machine-learnin practice and the classical bias-variance trade-off. Proceedings of the National Academy of Sciences, 116632):1549911555 2019.
Valentyn Boreiko, Alexander Panfilov, Vaclav Voracek, Matthias Hein, and Jonas Geiping. An interpretable n-gram perplexity threat model for large language model jailbreaks. In Proceedings of the 42nd International Conference on Machine Learning, volume 267, pp. 5017-5044, 2025.
Nick Bostrom. Superintelligence. Puths, dangers, strategies. Oxford University Press, 2014.
Nicholas Carlini, Milad Nasr, Christopher A. Choquette-Chin Matthew Jagielski, Irena Gao, Pang Wei W Koh, Daphne Ippolito, Florian Tramer, and Ludwig Schmidt. Are aligned neural networks adversarially aligned? In Advances in Neurul Information Processing Systems, volume 36, pp.
61478-61500, 2023.
Patrick Chao, Edoardo Debenedetti, Alexander Robey, Maksym Andriushchenko, Francesco Croce, Vikash Schwag, Edgar Dobriban, Nicolas Flammarion, George J. Pappas, Florian Tramèr, Hamed Hassani, and Eric Wong. Jailbreakbench: An open robustness benchmark for jailbreaking large language models. In Advances in Neural Information Processing Systems, volume 37, pp. 55005-55029, 2024.
Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J. Pappas, and Eric Wong. Jailbreaking black box large language models in twenty queries. In 2025 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), pp. 42, 2025. doi: 00.1099/ 2025.00010.
Wei-Lin Chiang, Zhuohan Li, Zi Lin, Ying Sheng, Zhanghao Wu, Hao Zhang, Lianmin Zheng, Siyuan Zhuang, Yonghao Zhuang, Joseph E. Gonzalez, lon Stoica, and Eric P. Xing. Vicuma: An open-source chatbot impressing gpt-4 with 90%* chatgpt quality, March 2023, URL https: -3--0-vii--a-------------------- vicnaa.
11

---

Published as a conference paper at ICLR 2026
Karl Cobbe, Vineet Kosaraju, Mohammad Bavarian, Mark Chen, Heewoo Jun, Lukasz Kaiser, Matthias Plappert, Jerry Tworek, Jacob Hilton, Reiichiro Nakano, Christopher Hesse, and John Schulman. Training verifiers to solve math word problems. arXiv preprint arXfv:2110.14168, 2021.
Esin Durmus, Liane Lovitt, Alex Tamkin, Stuart Ritchie, Jack Clark, and Deep Ganguli. Measuring the persuasiveness of language models, 2024. URL httpp:://wwt http://wwwww.......cccccoo com/ news/ innauriing-mdeell www.oode---pesssssieeeeeeee
Pranav Gade, Simon Lermen, Charlie Rogers-Smith, and Jeffrey Ladish. Badllama: cheaply removing
safety fine-tuning from Ilama 2-chat 13b. arXiv preprini arXiv:2311.001 2023.
Deep Ganguli, Liane Lovitt, Jackson Kernion, Amanda Askell, Yuntao Bai, Saurav Kadavath, Ben Mann, Ethan Perez, Nicholas Schiefer, Kamal Ndousse, Andy Jones, Sam Bowman, Anna Chen, Tom Conerly, Nova DasSarma, Dawn Drain, Nelson Elhage, Sheer El-Showk, Stanislav Fort, Zac Hatfield-Dodds, Tom Henighan, Danny Hernandez, Tristan Hume, Josh Jacobson, Scott Johnston, Shauna Kravec, Catherine Olsson, Sam Ringer, Eli Tran-Johnson, Dario Amodei, Tom Brown, Nicholas Joseph, Sam McCandlish, Chris Olah, Jared Kaplan, and Jack Clark. Red teaming language models to reduce harms: Methods, scaling behaviors, and lessons learned. arXiv preprint arXiv:2209.07855 2022.
Leo Gao, Jonathan Tow, Baber Abbasi, Stella Biderman, Sid Black, Anthony DiPofi, Charles Foster, Laurence Golding, Jeffrey Hsu, Alain Le Noac"h, h, Haonan Li, Kyle McDonell, Niklas Muennighoff, Chris Ociepa, Jason Phang, Laria Reynolds, Hailey Schoelkopf, Aviya Skowron, Lintang Sutawika, Eric Tang, Anish Thite, Ben Wang, Kevin Wang, and Andy Zou. The language model evaluation harness, 07 2024. URL https: /weedoo.ooo.oo/////oooooo.oo/..o org/ www.rrroorooooo dsrdd/ss///..................... / 26086002.
Jonas Geiping, Alex Stein, Manli Shu, Khalid Saifullah, Yuxin Wen, and Tom Goldstein. Coercing 1lms to do and reveal (almost) anything. arXiv preprint arXiv:2402.14020, 2024.
David Glukhov, Ziwen Han, Ilia Shumailov, Vardan Papyan, and Nicolas Papernot. Breach by a thousand leaks: Unsafe information leakage in 'safe' Al responses. In The Thirteenth International Conference on Learning Representations, 2025. URL https: /ttp://opppreeeeeeee ew net/ forum? id=8Rov0 jpOT.
Shashwat Goel, Joschka Struber, Ilze Amanda Auzina, Karuna K Chandra, Ponnurangam Kumaraguru, Douwe Kiela, Ameya Prabhu, Matthias Bethge, and Jonas Geiping. Great models think alike and this undermines oversight. In Proceedings of the 42nd International Conference Machine Learning, volume 267, pp. 19621-19678, 2025.
Jasper Götting, Pedro Medeiros. Jon G Sanders, Nathaniel Li, Long Phan, Karam Elabd, Lennart Justen, Dan Hendrycks, and Seth Donoughe. Virology capabilities test (vct): A multimodal virology q&a benchmark. arXiv e-prints, pp. arXiv-2504, 2025.
Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, et al. The llama herd of models. arXiv preprint arXiv:2407. 2tt.:2207..2788.. 21783, 2024.
Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song. Peiyi Wang, Qihao Zhu, Runxin Xu, Ruoyu Zhang, Shirong Ma. Xiao Bi, Xiaokang Zhang, Xingkai Yu, Yu Wu, Z. F. Wu, Zhibin Gou, Zhihong Shao, Zhuoshu Li, Ziyi Gao, Aixin Liu, Bing Xue, Bingxuan Wang, Bochao Wu, Bei Feng, Chengda Lu, Chenggang Zhao, Chengqi Deng, Chenyu Zhang, Chong Ruan, Damai Dai, Deli Chen. Dongjie Ji, Erhang Li. Fangyun Lin, Fucong Dai. Fuli Luo, Guangbo Hao, Guanting Chen, Guowei Li, H. Zhang, Han Bao, Hanwei Xu, Haocheng Wang, Honghui Ding, Huajian Xin, Huazuo Gao, Hui Qu, Hui Li, Jianzhong Guo, Jiashi Li, Jiawei Wang, Jingehang Chen, Jingyang Yuan, Junjie Qiu, Junlong Li, J. L. Cai, Jiaqi Ni, Jian Liang. Jin Chen, Kai Dong, Kai Hu, Kaige Gao, Kang Guan, Kexin Huang, Kuai Yu, Lean Wang, Lecong Zhang, Liang Zhao, Litong Wang, Liyue Zhang, Lei Xu, Leyi Xia, Mingchuan Zhang, Minghua Zhang, Minghui Tang, Meng Li, Miaojun Wang, Mingming Li, Ning Tian, Panpan Huang, Peng Zhang, Qiancheng Wang. Qinyu Chen. Qiushi Du, Ruiqi Ge, Ruisong Zhang, Ruizhe Pan, Runji Wang, R. J. Chen, R. L. Jin, Ruyi Chen, Shanghao Lu, Shangyan Zhou, Shanhuang Chen, Shengfeng Ye, Shiyu Wang, Shuiping Yu, Shunfeng Zhou, Shuting Pan, S. S. Li, Shuang Zhou, Shaoqing Wu, Tao Yun, Tian Pei, Tianyu
12

---

Published as a conference paper at ICLR 2026
Sun, T. Wang, Wangding Zeng, Wanjia Zhao, Wen Liu, Wenfeng Liang, Wenjun Gao, Wengin Yu, Wentao Zhang, W. L. Xiao, Wei An, Xiaodong Liu, Xiaohan Wang, Xiaokang Chen, Xiaotao Nie, Xin Cheng, Xin Liu, Xin Xie, Xingchao Liu, Xinyu Yang. Xinyuan Li, Xuecheng Su, Xuheng Lin, X. Q. Li, Xiangyue Jin, Xiaojin Shen, Xiaosha Chen, Xiaowen Sun, Xiaoxiang Wang. Xinnan Song. Xinyi Zhou, Xianzu Wang, Xinxia Shan, Y. K. Li, Y. Q. Wang, Y. X. Wei, Yang Zhang, Yanhong Xu, Yao Li, Yao Zhao, Yaofeng Sun, Yaohui Wang, Yi Yu, Yichao Zhang, Yifan Shi, Yiliang Xiong. Ying He, Yishi Piao, Yisong Wang, Yixuan Tan, Yiyang Ma, Yiyuan Liu, Yongqiang Guo, Yuan Ou, Yuduan Wang, Yue Gong, Yuheng Zou, Yujia He, Yunfan Xiong, Yuxiang Luo, Yuxiang You, Yuxuan Liu, Yuyang Zhou, Y. X. Zhu, Yanping Huang, Yaohui Li. Yi Zheng, Yuchen Zhu, Yunxian Ma, Ying Tang, Yukun Zha, Yuting Yan, Z. Z. Ren, Zehui Ren, Zhangli Sha, Zhe Fu, Zhean Xu, Zhenda Xie, Zhengyan Zhang, Zhewen Hao, Zhicheng Ma, Zhigang Yan, Zhiyu Wu, Zihui Gu, Zijia Zhu, Zijun Liu, Zilin Li, Ziwei Xie, Ziyang Song, Zizheng Pan, Zhen Huang. Zhipeng Xu, Zhongyu Zhang, and Zhen Zhang. DeepSeck-Ro R1 incentivizes reasoning in LLMs through reinforcement learning. Nature, 645:633-638 (3883,368,,00 2025. doi: 100033//41586-025--94444
Rez Havaei, Alan Wu, and Rex Liu. The jailbreak cookbook. generalanalysis cww/ www./////////////.o//.../oooeeee wwilbreak_cookbeeee 05-08.
https:/ htops://www... March 2025. Accessed: 2025-
Oskar J. Hollinsworth, Ian R. McKenzie, Tom Tseng, and Adam Gleave. Clearharm: A more chal- lenging jailbreak dataset. Dataset, available from Hugging Face (Aiigmmentlocaarrc//CCaaaaaaal) June 2025. URL https: http////uggggggggeg co/ asaaasetss s i www.iinneettteeeaac..... ClearHarm.
Nikolaus Howe, Ian McKenzie, Oskar Hollinsworth, Michal Zajac, Tom Tseng, Aaron Tucker, Pierre-Luc Bacon, and Adam Gleave. Scaling trends in language model robustness. In Proceedings of the 42nd International Conference on Machine Learning, volume 267, pp. 24080-241 24138, 2025.
Edward Hu, Yelong Shen, Phillip Wallis, Zeyuan AZh,, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. LoRA: Low-rank adaptation of large language models. In The Tenth International Conference on Learning Representations, 2022. URL https: opwnrevieee net/ forum) id=nzevKeeFYEF,
Brian R.Y. Huang, Maximilian Li, and Leonard Tang. Endless jailbreaks with bijection learning. In The Thirteenth International Conference on Learning Representations, 2025. URL https:
// //ppppreeeiw..eo.e.e net www.:eewwnw///.mmmiiieieee
John Hughes, Sara Price, Aengus Lynch, Rylan Schaeffer, Fazl Barez, Arushi Somani, Sanmi Koyejo, Henry Sleight, Erik Jones, Ethan Perez, and Mrinank Sharma. Best-of-n jailbreaking. in Neural Information Processing Systems, volume 38, 2025.
jasteai-n In Advances
Minyoung Huh, Hossein Mobahi, Richard Zhang, Brian Cheung, Pulkit Agrawal, and Phillip Isola. The low-rank simplicity bias in deep networks. Trunsactions on Machine Learning Research, 2023.
Intology AI. Zochi technical report, 2025. URL httpps:/ggichbb.ccmm/tttt//// Zochi/bi /tlpb/lllaaaaeee maaaiinoocchneehieeee ca Repp_
Albert Q. Jiang, Alexandre Sablayrolles, Antoine Roux, Arthur Mensch, Blanche Savary, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Emma Bou Hanna, Florian Bressand, Gianna Lengyel, Guillaume Bour, Guillaume Lample, Lélio Renard Lavaud, Lucile Saulnier, Marie- Anne Lachaux, Pierre Stock, Sandeep Subramanian, Sophia Yang, Szymon Antoniak, Teven Le Scao, Théophile Gervet, Thibaut Lavril, Thomas Wang, Timothée Lacroix, and William El Sayed. Mixtral of experts. arXiv preprint arXiv:2401.04000 2024.
Simran Kaur, Simon Park, Anirudh Goyal, and Sanjeev Arora. Instruct-skillmix: A powerful pipeline for LLM instruction tuning. In The Thirteenth International Conference on Learning Representations, 2025. URL https: / ropenreiees net/ 2it.mmmid444447:i
Koray Kavukcuoglu. Gemini 2.5: Our most intelligent AI model. Google Blog (The Key- word), March 2025. URL https: //bl///b//./o/// http://lloggggggl//e///oo gemi -mode -ttinhhiikiiiee wtthhhhnnin----pttee.t.t.t rah.
13

---

Published as a conference paper at ICLR 2026
Daniel Kokotajlo, Scott Alexander, Thomas Larsen, Eli Lifland, and Romeo Dean. AI 2027. https: //ai-2027 atw.:27e.aauuuueeeeeeee.eaa org/, ,025. Al Futures Project (in collaboration with Lightcone Infrastructure).
Jeremy Kritz, Vaughn Robinson, Robert Vacareanu, Bijan Varjavand, Michael Choi, Bobby Gogov, Scale Red Team, Summer Yue, Willow E Primack, and Zifan Wang. Jailbreaking to jailbreak. arXiv preprint urXiv:2502.096:3 2025.
Vishal Kumar, Zeyi Liao, Jaylen Jones, and Huan Sun. Amplegeg-plus: A strong generative model of adversarial suffixes to jailbreak Ilms with higher success rates fewer attempts. arXiv preprint arXiv:2410.22144 2024.
Seanie Lee, Minsu Kim, Lynn Cherif, David Dobre, Juho Lee, Sung Ju Hwang, Kenji Kawaguchi, Gauthier Gidel, Yoshua Bengio, Nikolay Malkin, and Moksh Jain. Learning diverse attacks on large language models for robust red-teaming and safety tuning. In The Thirteenth International Conference on Learning Representations, 2025. URL https:/ /openreviii ew net/ forum?
id=1mXufFuvvs
Nathaniel Li, Ziwen Han, Ian Steneker, Willow Primack, Riley Goodside, Hugh Zhang, Zifan Wang, Cristina Menghini, and Summer Yue. Llm defenses not robust multi-turn human jailbreaks yet. arXiv preprint arXiv:2408. 15221, 2024a.
Nathaniel Li, Alexander Pan, Anjali Gopal, Summer Yue, Daniel Berrios, Alice Gatti, Justin D. Li, Ann- ann-Kathrin Dombrowski, Shashwat Goel, Gabriel Mukobi, Nathan Helm- Rassin Lababidi, Lennart Justen, Andrew Bo Liu, Michael Chen, Isabelle Barrass, Oliver Zhang, Xiaoyuan Zhu, Rishub Tamirisa, Bhrugu Bharathi, Ariel Herbert- Voss, Cort B Breuer, Andy Zou, Mantas Mazeika, Zifan Wang. Palash Oswal, Weiran Lin, Adam Alfred Hunt, Justin Tienken-Harder, Kevin Y. Shih, Kemper Talley, John Guan, Ian Steneker, David Campbell, Brad Jokubaitis, Steven Basart, Stephen Fitz, Ponnurangam Kumaraguru, Kallol Krishna Karmakar, Uday Tupakula, Vijay Varadharajan, Yan Shoshitaishvili, Jimmy Ba, Kevin M. Esvelt, Alexandr Wang, and Dan Hendrycks. The WMDP benchmark: Measuring and reducing malicious with unlearning. In Proceedings of the 41st International Conference on Machine Learning, volume 235, pp. 28525-28550, 2024b.
Xuechen Li, Tianyi Zhang, Yann Dubois, Rohan Taori, Ishaan Guirajani, Carlos Guestrin, Percy Liang, and Tatsunori B. Hashimoto. Alpacaeval: An automatic evaluator of instruction-follooinng models. https: htgggtttthbt./////////ggg.eeeeet wttp://cc/tttttuaaaaaaaa waapa/aaaaaaaaaaaaaaaaaaaaaaaaaa _val, 2023.
Zeyi Liao and Huan Sun. Amplegeg: Learning a universal and transferable generative model of adversarial suffixes for jailbreaking both open and closed llms. In Conference on Language Modeling, 2024.
Xiaogeng Liu, Peiran Li, G. Edward Suh, Yevgeniy Vorobeychik, Zhuoqing Mao, Somesh Jha, Patrick McDaniel, Huan Sun, Bo Li, and Chaowei Xiao. Autodan-turbo: A lifelong agent for strategy self-exploration to jailbreak 1mms. In The Thirteenth International Conference on Learning Representations, 2025, URL https: / //wp///eeeee...ecooo//e net wwwrroooummminuuuuoo
Yi Liu, Gelei Deng, Zhengzi Xu, Yuekang Li, Yaowen Zheng, Ying Zhang, Lida Zhao, Tianwei Zhang, Kailong Wang, and Yang Liu. Jailbreaking chatgpt via prompt engineering: An empirical study, arXiv preprint 2rX.v:2305.13866 2023.
Ilya Loshchilov and Frank Hutter. Decoupled weight decay regularization. In The Seventh Interna- tional Conference on Learning Representations, 2019. URL https: //tp///eeeeee..eettt.teeee forum? d=Bkg6Ri
Jakub Lucki, Boyi Wei, Yangsibo Huang, Peter Henderson, Florian Tramèr, and Javier Rando. An adversarial perspective on machine unlearning for Al safety. Trunsactions on Machine Learn- ing Research, 2025. ISSN 2835-8856. URL https: http///pppp/....e/ee/oeeeeee.eep net Forum?ids J5 J5IRYTK29s.
Sandra C Matz, Jacob D Teeny, Sumer S Vaid, Heinrich Peters, Gabriella M Harari, and Moran Cerf. The potential of generative ai for personalized persuasion at scale. Scientific Reports, 14(1):4692, 2024.
14

---

Published as a conference paper at ICLR 2026
Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, David Forsyth, and Dan Hendrycks. HarmBench: A standard- ized evaluation framework for automated red teaming and robust refusal. In Proceedings of the 4 Ist International Conference on Machine Learning, volume 235, pp. 35181-35224, 2024.
Ian R McKenzie, Oskar Hollinsworth, Tom Tseng, Xander Davies, Stephen Casper, Aaron Tucker, Robert Kirk, and Adam Gleave. Stack: Adversarial attacks on Ilm safeguard pipelines. arXiv preprint arXiv:2506.240663 2025.
Anay Mehrotra, Manolis Zampetakis, Paul Kassianik, Blaine Nelson, Hyrum Anderson, Yaron Singer, and Amin Karbasi. Tree of attacks: Jailbreaking black-box Ilms automatically. In Advances in Neural Information Processing Systems, volume 37, pp. 61065-611111 61 6050 2024.
John Miller, Rohan Taori, Aditi Raghunathan, Shiori Sagawa, Pang Wei Koh, Vaishaal Shankar, Percy Liang, Yair Carmon, and Ludwig Schmidt. Accuracy the line: on the strong correla- tion between out-of-distribution and in-distribution generalization, In Proceedings of the 38th International Conference Machine Learning, volume 139, pp. 7721-7735, 2021.
Cathleen
O'Grady.
'unethical' ai research on reddit under fire. Science, URL fetps://www.et www.ece.eecc........o www.ncc..og/oonneeeeeeeeee worgg//onten//attiiin.
April 2025.
OpenAl. Introducing openai o3 and 04-mini. OpenAl Blog, April 2025a. URL ttthhtts://opnaaa htmm/innexxintrooduce o3 and- -iiini/..
OpenAl. 03-mini: Pushing the frontier of cost-effective reasoning, OpenAl Blog, January 2025b. URL
com/ htte//ndex////// httpp////pppaaa---np-
OpenAl. Operator system card, 2025.
URL https:// ppppeaaicoomopppratttoooo
cestem__card.ooe
OpenAL. https: http:://ppeemt...cmm//eee//////p
2025. Accessed: 2025- 1--23.
Maya Pavlova, Erik Brinkman, Krithika Iyer, Vitor Albicro, Joanna Bitton, Hailcy Nguyen, Joe Li, Cristian Canton Ferrer, Ivan Evtimov, and Aaron Grattafiori. Automated red teaming with goat: the generative offensive agent tester. arXiv preprint arXiv:2410.00060 2024.
Ethan Perez, Saffron Huang, Francis Song. Trevor Cai, Roman Ring, John Aslanides, Amelia Glaese, Nat McAleese, and Geoffrey Irving. Red teaming language models with language models. In Yoav Goldberg, Zornitsa Kozareva, and Yue Zhang (eds.), Proceedings of the 2022 Conference Empirical Methods in Natural Language Processing, pp. 5419-3448 Abu Dhabi, United Arab Emirates, December 2022. Association for Computational Linguistics. doi: 10. 10.18653/v1/2222 emnlp-main.225. URL https::pp...... : /aa/aaaaannttho aclanthology..... org / wwt.:22mmmmmmmmmmmmm.mm p- in 225/.
Xiangyu Qi. Yangsibo Huang, Yi Zeng, Edoardo Debenedetti, Jonas Geiping, Luxi He, Kaixuan Huang. Udari Madhushani, Vikash Sehwag, Weijia Shi, Boyi Wei, Tinghao Xie, Danqi Chen, Yu Chen, Jeffrey Ding, Jiaqi Ma, Arvind Narayanan, Weijie J Su, Mengdi Wang, Chaowei Xiao, Bo Li, Dawn Song, Peter Henderson, Prateek Mittal, and Ruoxi Jia. Ai risk management should incorporate both safety and security. arXiv preprint arX.: 19524, 2024a.
Xiangyu Qi, Yi Zeng, Tinghao Xie, Pin- Yu Chen, Ruoxi Jia, Prateek Mittal, and Peter Henderson. Fine-tuning aligned language models compromises safety, even when users do not intend to! In The Twelfth International Conference on Learning Representations, 2024b. URL https: //openrevi ew n wwweteetoorueeeeeeeeeeeeeeeeeeee forum? witeiii-hhhyyytt EddZ.
Xiangyu Qi, Ashwinee Panda, Kaifeng Lyu, Xiao Ma, Subhrajit Roy, Ahmad Beirami, Prateck Mittal, and Peter Henderson. Safety alignment should be made more than just a few tokens deep. In The Thirteenth International Conference on Learning Representations, 2025a. URL https: http:://ppeeeiiieeeeee wtt.///rettfoeeeee/////
net/ forum? i 6Mxhg9PEDE.
Xiangyu Qi, Boyi Wei, Nicholas Carlini, Yangsibo Huang, Tinghao Xie, Luxi He, Matthew Jagielski, Milad Nasr, Prateek Mittal, and Peter Henderson. On evaluating the durability of safeguards for oeen-weight LLMs. In The Thirteenth International Conference on Learning Representations, 2025b. URL https://///........ http:s://ppoeevveeeeeee net/ forum? F=XXCqduSsV..
15

---

Published as a conference paper at ICLR 2026
Can Rager and David Bau. Auditing ai bias: The deepseck case, 2025. URL https:// dsthoughts www.aa...iii... info/.
Javier Rando, Jie Zhang, Nicholas Carlini, and Florian Tramèr. Adversarial ml problems are getting harder to solve and to evaluate. arXiv preprint arXiv:2502.0222 2025.
Qibing Ren, Hao Li, Dongrui Liu, Zhanxu Xie, Xiaoya Lu, Yu Qiao, Lei Sha, Junchi Yan, Lizhuang Ma, and Jing Shao. Derail yourself: Multi-turn IIm jailbreak attack through self-discovered clues. arXiv preprint arXiv:2440. 2024a.
Richard Ren, Steven Basart, Adam Khoja, Alexander Pan, Alice Gatti, Long Phan, Xuwang Yin, Mantas Mazeika, Gabriel Mukobi, Ryan Hwang Kim, Stephen Fitz, and Dan Hendrycks. Safe- tywashing: Do ai safety benchmarks actually measure safety progress? In Advances in Neural Information Processing Systems, volume 37, pp. 68559-68594, 2024b.
Alexander Robey, Zachary Ravichandran, Vijay Kumar, Hamed Hassani, and George J Pappas. Jailbreaking llm-controlled robots. In IEEE International Conference on Robotics and Automation (ICRA), 2025.
Domenic Rosati, Jan Wehner, Kai Williams, E ukasz Bartoszeze, David Atanasov, Robic Gonzales, Subhabrata Majumdar, Carsten Maple, Hassan Sajja, and Frank Rudzicz. Representation noising: A defence mechanism against harmful finetuning. In Advances in Neural Information Processing 2024.
Systems, volume 37, pp.
Alexander Rubinstein and Arnas Uselis. Stai-tuned experiment scheduler: Structured experiment management with google sheets, weights & biases, and hpc integration. https: / / / thub. com/ arubique stnd, 2025. GitHub repository. Utility code for reproducible and streamlined experiment management with Google Sheets integration, W&B logging, and HPC support (e.g.. Slurm).
Mark Russinovich, Ahmed Salem, and Ronen Eldan. Great, now write article about that: The crescendo multi-turn IIm jailbreak attack. In 34th USENIX Security Symposium (USENIX Security 25), pp. 2421-2440, 2025.
Mahdi Sabbaghi, Paul Kassianik, George J. Pappas, Amin Karbasi, and Hamed Hassani. Adversarial reasoning at jailbreaking time. Proceedings of the 42nd International Conference on Machine Learning, volume 267, pp. 22526-52551 2025.
Mikayel Samvelyan, Sharath Chandra Raparthy, Andrei Lupu, Eric Hambro, Aram H. Markosyan, Manish Bhatt, Yuning Mao, Minqi Jiang, Jack Parker-Holder, Jakob Foerster, Tim Rocktäschel, and Roberta Raileanu. Rainbow teaming: Open-ended generation of diverse adversarial prompts. In Advances in Neural Information Processing Systems, volume 37, pp. 69747-69786, 2024.
Rylan Schaeffer, Joshua Kazdan, John Hughes, Jordan Juravsky, Sara Price, Aengus Lynch, Erik Jones, Robert Kirk, Azalia Mirhoseini, and Sanmi Koyejo. How do large language monkeys get their power (laws)? Proceedings of the 42nd International Conference on Machine Learning. volume 267, pp. 53132-33111111 53176, 2025.
Sander Schulhoff, Jeremy Pinto, Anaum Khan, Louis-François Bouchard, Chenglei Si, Svetlina Anati, Valen Tagliabue, Anson Kost, Christopher Carnahan, and Jordan Boyd-Graber. Ignore this title and HackAPrompt: Exposing systemic vulnerabilities of LLMs through global prompt hacking competition. In Houda Bouamor, Juan Pino, and Kalika Bali (eds.). Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pp. 4945-4977, Singapore, December 2023. Association for Computational Linguistics. doi: 10. 00653/v1/2223... http://...2.n....... main. 302. URL ht aaaaacaaammm aclanthologyyyyy.oocooooooooolll org/ 2223...... emnlp-ma in. 302/.
Daniel Schwartz, Dmitriy Bespalov, Zhe Wang, Ninad Kulkarni, and Yanjun Qi. Graph of attacks with pruning: Optimizing stealthy jailbreak prompt generation for enhanced Ilm content moderation. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing: Industry Track, 2025.
Rusheb Shah, Quentin Geuillade-Monticc Soroush Pour, Arush Tagade, Stephen Casper, and Javier Rando. Scalable and transferable black-box jailbreaks for language models via persona modulation. arXiv preprint arXiv:2311 1..0344 2023.
16

---

Published as a conference paper at ICLR 2026
Mrinank Sharma, Meg Tong, Jesse Mu, Jerry Wei, Jorrit Kruthoff, Scott Goodfriend, Euan Ong, Alwin Peng. Raj Agarwal, Cem Anil, Amanda Askell, Nathan Bailey, Joe Benton, Emma Bluemke, Samuel R. Bowman, Eric Christiansen, Hoagy Cunningham, Andy Dau, Anjali Gopal. Rob Gilson, Logan Graham, Logan Howard, Nimit Kalra, Taesung Lee, Kevin Lin, Peter Lofgren, Francesco Mosconi, Clare O' HaHara, Catherine Olsson, Linda Petrini, Samir Rajani, Nikhil Saxena, Alex Silverstein, Tanya Singh, Theodore Sumers, Leonard Tang, Kevin K. Troy, Constantin Weisser, Ruiqi Zhong, Giulio Zhou, Jan Leike, Jared Kaplan, and Ethan Perez. Constitutional classifiers: Defending against universal jailbreaks across thousands of hours of red teaming. arXiv preprint arXiv:2501.18837, 2025.
Xinyue Shen, Zeyuan Chen, Michael Backes, Yun Shen, and Yang Zhang. do anything now": Characterizing and evaluating in-the-wild jailbreak prompts large language models. In Proceed- ings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pp. 1671-1685, 2024.
Alexandra Souly, Qingyuan Lu, Dillon Bowen, Tu Trinh, Elvis Hsich, Sana Pandey, Pieter Abbeel, Justin Svegliato. Scott Emmons, Olivia Watkins, and Sam Toyer. A strongreject for empty jailbreaks. In Advances in Neural Information Processing Systems, volume 37, pp. 1 2024.
Rishub Tamirisa, Bhrugu Bharathi, Long Phan, Andy Zhou, Alice Gatti, Tarun Suresh, Maxwell Lin, Justin Wang, Rowan Wang, Ron Arel, Andy Zou, Dawn Song. Bo Li, Dan Hendrycks, and Mantas Mazeika. Tamper-resistant safeguards for open-weight LLMs. In The Thirteenth International Conference on Learning Representations, 2025. URL https: http///pppe/eeeeeoeeeeeeeeee.eep net/ forum?
1d=4FI]RRodbW..
Team Gemini, Petko Georgiev, Ving Ian Lei, Ryan Burnell, Libin Bai, Anmol Gulati, Garrett Tanzer, Damien Vincent, Zhufeng Pan, Shibo Wang, et al. Gemini 1.5: Unlocking multimodal understanding across millions of tokens of context. arXiv preprint arXiv:2403.05530, 2024.
Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaci, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. Llama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288 2023.
Tatia Tsmindashvili, Ana Kolkhidashvili, Dachi Kurtskhalia, Nino Maghlakelidze, Elene Mekv- abishvili, Guram Dentoshvili, Orkhan Shamilov, Zaal Gachechiladze, Steven Saporta, and David Dachi Choladze. Improving Ilm outputs against jailbreak attacks with expert model integra- tion. arXiv preprint arXiv:2505 2025.
vals.ai. Mmlu-pro evaluations (05/05/2025). https: /ooo::/wwww /wwww http//wwwwwlllww..ooooowwpwww.ss aa/benncharkksmmm 000-00505-2000 May 2025. Accessed: 2025-05-05.
Teun van der Weij. Felix Hofstätter, Oliver Jaffe, Samuel F. Brown, and Francis Rhys Ward. AI sandbagging: Language models can strategically underperform on evaluations. In The Thirteenth International Conference Learning Representations, 2025. URL ixIS.
Dmitrii Volkov. Badllama 3: removing safety finetuning from llama 3 in minutes. arXiv preprint arXiv:2407.01336, 2024.
Yubo Wang, Xueguang Ma, Ge Zhang, Yuansheng Ni, Abhranil Chandra, Shiguang Guo, Weiming Ren, Aaran Arulraj. Xuan He, Ziyan Jiang, Tianle Li, Max Ku, Kai Wang, Alex Zhuang, Rongqi Fan, Xiang Yue, and Wenhu Chen. Mmlu-pro: more robust and challenging multi-task language understanding benchmark. In Advances in Neural Information Processing Systems, volume 37, pp. 92266-95290, 2024.
Simon Willison. Prompt injection: Whats the worst that can happen?, 2023, URL https:// wwwpoowwwwisooonneeeeeeeo net. 2023 201233//pr/// h0/po//1//oosst http://ottttteeeeeeee teattttthttteee -aant-cn------a -aan-hhppen/.
simonwi www.wilisson
Andrew Gordon Wilson. Deep learning is not mysterious or different. In Proceedings of the 42nd International Conference on Machine Learning, volume 267, pp. 82326-82346, 2025.
Robert L Winkler. A decision-theoreticc approach to interval estimation. Journal of the American Statistical Association, 187337):187-11,, 1972.
17

---

Published as a conference paper at ICLR 2026
An Yang. Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chengyuan Li, Dayiheng Liu, Fei Huang, Haoran Wei, et al. Qwen2. 5 technical report. arXiv preprint arXiv:2412.15115, 2024.
Xianjun Yang, Xiao Wang, Qi Zhang, Linda Petzold, William Yang Wang, Xun Zhao, and Dahua Lin. Shadow alignment: The ease of subverting safely-aligned language models. arXiv preprint NrXiv:2310.02949, 2023.
Sangyoon from mww.ommttddmmlt--tttee-------ee- curltti--u----- 11m- 1ew---1mmm-iii--- -edebreaas-cresceeddo from- coom-microooft -rt.oofft22f55443344.,,,,
Yu.
Automated
multi-turn
Ilm jailbreaks:
Crescendo
microsoft.
https://blog aim- ientinnniiinnn com/
August 2024. Accessed: 2025-05-06.
Wojeiech Zaremba, Evgenia Nitishinskaya, Boaz Barak, Stephanie Lin, Sam Toyer, Yaodong Yu, Rachel Dias, Eric Wallace, Kai Xiao, Johannes Heidecke, and Amelia Glaese. Trading inference- time compute for adversarial robustness. arXiv preprint arXiv:2501. 18841, 2025.
Yi Zeng, Hongpeng Lin, Jingwen Zhang. Diyi Yang, Ruoxi Jia, and Weiyan Shi. How johnny can persuade LLMs to jailbreak them: Rethinking persuasion to challenge AI safety by humanizing LLMs. In Lun-Wei Ku, Andre Martins, and Vivek Srikumar (eds.). Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Pupers), pp. 14322-14350, Bangkok, Thailand, August 2024, Association for Computational Linguistics. doi: 1a/16653//1/2222aallllllla 773/-
URL https: http///aaaaahhhleeeeeeeeee wwt.::looo......////1e
Hao Zhao, Maksym Andriushchenko, Francesco Croce, and Nicolas Flammarion. Long is more for alignment: simple but tough-to-beat baseline for instruction fine-tuning. In Proceedings of the 41st International Conference on Machine Learning, volume 235, pp. 60674-60703, 2024.
Hao Zhao, Maksym Andriushchenko, Francesco Croce, and Nicolas Flammarion. Is in-context learning sufficient for instruction following in LLMs? In The Thirteenth International Confer- ence on Learning Representations, 2025. URL http::tp//// /ttp:s:://///evveeeeeeee ew net/ forum? frrmmide id= STEEDDV3ZI.
Yaowei Zheng, Richong Zhang, Junhao Zhang, Yanhan Ye, and Zheyan Luo. LlamaFactory: Unified efficient fine-tuning of 100+ language models. In Yixin Cao, Yang Feng, and Deyi Xiong (eds.), Proceedings of the 62nd Anmual Meeting of the Association for Computational Linguistics (Volume 3: System Demonstrations). pp. 400-410, Bangkok, Thailand, August acd-mmos..... URL
2024. Association for Computational Linguistics. doi: https: /wtpaaaaaaaaaaaacaaaaaaaaaa ort//024...000/ ae1e444.llldemmme 38/-
Andy Zhou. Tempest: Autonomous multi-trn jailbreaking of large language models with tree search. arXiv preprint arXi::2501.09197 2025.
Jeffrey Zhou, Tianjian Lu, Swaroop Mishra, Siddhartha Brahma, Sujoy Basu, Yi Luan, Denny Zhou, and Le Hou. Instruction-following evaluation for large language models. arXiv preprint arXiv:2311 1.07911, 2023.
Andy Zou, Zifan Wang. J. Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043 2023,
Andy Zou, Long Phan, Justin Wang, Derek Duenas, Maxwell Lin, Maksym Andriushchenko, J Zico Kolter, Matt Fredrikson, and Dan Hendrycks. Improving alignment and robustness with circuit breakers. In Advances in Neural Information Processing Systems, volume 37, pp. 13344--83777 2024.
18

---

Published as a conference paper at ICLR 2026
A MODEL UNLOCKING
Many LLM-basee jailbreak methods rely "helpful-only" models to act attackers (Chao et al., 2025; Mehrotra et al., 2024; Schwartz et al., 2025; Pavlova et al., 2024; Zhou, 2025). That due the fact, that better-safeguarded models typically refuse facilitating in red-teaming and therefore require sophisticated model-specific prompting to ensure compliance (Kritz et al., 2025; Pavlova al., 2024).
We sidestep this limitation through model unlocking, also known as safety untuning or unlearning (Volkov, 2024; Gade et al., 2023; Yang al., 2023; Qi al., 2024b). We exploit the fact that safety tuning is rather shallow (Arditi et al., 2024) and can be removed with a cheap "harmful" fine-tuning (Volkov, 2024).
We fine-tune each open- ween-weight model with LoRA (Hu et al., 2022) using 1013 BadLlama and 500 Shadow Aligmment training examples, and then evaluate the unlocked model with direct queries on the first 100 HarmBench behaviors (Mazeika et al., 2024), used as held-out test set. For fine-tuning we use the Llama Factory library (Zheng et al., 2024).
In contrast to Volkov (2024), we observe unwanted unlocking artifact: attacker models often overfit to harmful content in the red-teaming prompt and answer query directly, rather than eliciting harmful behavior from the target. To mitigate this, we follow Zhao et al. (2024) and further fine-tune examples.
attacker models on 1000 of the longest AlpacaEval (Li et al., 2023) cestructionfoolowweee For the smallest models substitute and complement AlpacaEval with 1000 high-quality SkillMix (Kaur et al., 2025; Zhao et al., 2025) instruction-folle followwwn examples (i (ism__ _ddssde___ sda__2__ k2_1k. json split). After unlocking, verify that attacker models remain comparable with their safety-tuned versions on general capabilities.
st___s__________________________
We report training hyperparameters in Tab. A. All runs use the AdamW (Loshchilov & Hutter, 2019) optimizer with the Llama Factory default scheduler and its default warm-up and cool-down settings.
Table A.1: Hyperparameters for Model Unlocking. GA = gradient-accummlltion steps, LR = learning
rate, BS = hatch size. LoRA target sets: down_proj, o_proj, k_proý, q_proj, gate_pro up up_pre proj, v_proj; all; o_proj, k_proj, q_proj, v_proj. All experiments the AdamW optimiser with default Llama Factory warm-up and cool-down. Mistral-Sman model version 2501 used.
Model Name
Data Mixture
GA
LR
LoRA
LoRA Rank
LoRA Targets
Epochs
BS
2omn-25-72B-Instrrre
Harmful, Alpacalk
3e-4
Owen S.32B Instruct
Harmful, Alpacak
4
3e 4
8
16
Qwen-2.5.4 2ren-255-14BBInnstriee
Harmful, Alpacali lk
Qwen-2.5-7B S-Ttttnstt
Harmful, Alpacalk
4
3c-4
16
1
16
1oen-2.5-BBInnsii
Harmful, Alpacalk
3e-4
16
1
16
Qwen 1.5.B Instrucct
Harmful, SkillMixIk
3e-4
16
16
Qwen-25-0.59-Innet
Harmful, SkillMixI
le-3
16
16
Missral-Small-2BB-nnee
Harmful, Alpacalk
3o-4
Mixtral Mixtral-&x7B. Insttustutttt v0.1
Harmful, Alpacalk Ik
4
3e
8
Dhsrrl-7B-Insttee--0022
Harmful, Alpacalk
1
Vicuna-13B-v1.5
Harmful, Alpacalk
4
36-4
32
16
1
16
Vicuna-7B-v1.
Harmlul, Alpacalk
3e-4
16
32
Ilama 3.3.70B-Instmss
Harmful, Alpacalk
le.4
Llama-3.2-3B-Inmen In--smettt
Harmful, SkillMx Ik
4 3e-4
16
2
16
1lama-3.2-1B-lnsttuu
Alpacalk, SkillMixIk
1lama-3.1-70B-44 Instruct
Harmful, Alpacalk
4
le-4
8
1
8
1omma--1-8B-Insttmn
Harmful, Alpacalk
30-4
1
Meta-Llama-3--1 3-0--------
Harmful, Alpacalk
1c-4
Meta-Llama Llama-3-54 3-8B Instruct
Hammful, Alpacalk
3e-4
32
16
1amma-2-700 2. 708-chat-hf
Harmful, Alpacalk Ik
1e.4
1lama-2-138-chat-he
Harmful, Alpacalk
4
30-4
16
1
16
Llama-2-7B-chathhf
Harmful, Alpacalk
To keep the fine-tuning procedure uniform possible, do not perform extensive hyperparameter tuning. However, we observe that larger models unlock more easily than smaller ones; these smaller models often required more hyperparameter trials to achieve high direct query ASR. Models in the 0.5-1.5 billion parameter range were particularly difficult and often produced incoherent or repetitive outputs after fine-tuning. When issues arose, adjust hyperparameters manually, guided
19

---

Published as a conference paper at ICLR 2026
by validation loss and responses to direct HarmBench queries. In Tab. A.1, the training sets labeled "Harmful", "Alpacalk", and "SkillMix correspondingly.
Understanding why safety tuning is harder to unlearn in small models lies beyond the scope of this work, but we find a promising direction for future research. Clarifying how knowledge is allocated across scale could inform currently unsuccessful tamper-resistant methods (Tamirisa et al., 2025; Rosati et al., 2024). We speculate that this phenomenon is linked to different manifestations of the low-rank simplicity bias observed in deep neural networks (Arpit et al., 2017; Huh al., 2023; Asadulaev et al., 2022), also documented LLMs (Hu et al., 2022; Arditi et al., 2024), and connects behavior differences under- and over- peer-aaameterize regimes (Belkin al., 2019; Wilson, 2025).
Compute Resources, All unlocks were done on node with eight A100 80 GB GPUs.
A.1 BENCHMARKING UNLOCKED MODELS
Finally, we re-evaluate every unlocked model with -aavval--aaressss library (Gao et al., 2024) under the default settings and report benchmark scores, together with deltas from the original checkpoints, in Tab. A.2 for overall benchmark score, in Tab. A.3 for STEM related splits of MMLU- Pro and Tab. A.4 for social sciences and other categories. MMLU-Pro evaluated in 5-shot setting, without Shain-of-Thhougee (CoT) prompting.
Table A.2: Benchmark Scores for Unlocked Models. Performance differences from the original checkpoint (target model) are denoted by A. For the GSM8k benchmark, strict match accuracy is reported. Original Qwen-2.5-3B checkpoint exhibits exceptionally poor performance on strict match for GSM8K, however its performance with loose matching is comparable unlocked version. For IFEval, loose match prompt accuracy reported. Unlocking procedure did not introduce significant changes MMLU-Pu score model, with biggest absolute change being 4%.
Model Name
GSM8k
A
IFEval A
MMLU Pro
Qwen-2.5-722 2.5-72B
0.90
-0.03
0.57
-0.88
0.62
0..1
Qwen-2.5-32B
0.86
+0.04
0.54 -0.16
0.60
+0.04
Qwen-2.5-14B
0.85
+0.03
0.53 -0.14
0.52
-0.1
Dwen-2.55-B-Innstruc
0.75
-0.05
0.43 -0.18
0.46
+0.01
Qwen-2.5-33 2-nt---tttttt
0.67 +0.50
0.47 -0.06
0.37
+0.04
Qwen-2.5 2.5---.--BB-nnttrrectt
0.59 +0.05
0.26 -0.06
0.31
0.00
0.21 -012
0.22 +0.01
0.15
0.01
Mistral Mistral-Small-24BB-
0.87 -0.03
0.51 -0.15
0.56
0.01
0.65 0.00
0.48 -0.03
0.40
0.02
Mistral-77B-Instruuttvv...
0.39 -.00
0.40 -0.02
0.30
0.00
Vicuma-13B-v1.3 1.5
0.29 0.00
0.24 -0.04
0.25
0.02
Vicuma-7B-v1.5
0.16 -0.02
0.21 -0.01
0.21
0.01
Llama-3.3-70B
0.93 +0.02
0.67 0.00
0.59
0.01
Llama-3.2-4 3.-1a.33.-BBnssttruuc
0.65 +0.01
0.49 0.04
0.31
0.01
Llama-3. 1aama-3.2-IB-- 1--Itttnttt
0.30 -0.02
0.38 0.02
0.19
+0.02
1lama-3.1-700-Im. 1-70B-Instruct
0.92 +0.04
0.70 -0.08
0.58
0.01
-lama--311-8BIInsttme
0.71
0.05
0.42 -0.08
0.40
0001
Pott-Llamaa3-77B-mmee
0.88
0.03
0.53 -0.07
0.55
- 0.03
Meta-Llama-3-8B-Insse -BB-Insttuct
0.67
0.09
0.38 00.11
0.39
00.1
L
0.51 0.00
0.39 -0.44
0.32
00.01
Llama-2-13B-chatt
0.31 -004
0.27 00.5
0.25
-0.01
Llama-2-7B-chat-
0.15 -0.08
0.21 -0.11
0.20
-0.01
20

---

Published as a conference paper at ICLR 2026
Table A.3: MMLU-Pro Scores STEM-related splits. Domains: Computer Science, Biology, Chemistry,
Physics, Engineering, and Mathematics. Model names are trimmed for brevity.
Model Name
CS
A
Biology
Chemistry
A
Physics
A
Engineerring
Math
Qwen-2.5.72B
-0.03
+0.07
+0.01
Qwen-2.5-32B
0.63 +0.01
0.79
0.00
0.49
40.18
0.57 +0.10
0.50
+0.13
0.60 +0.07
Qwen-2.5-14B
0.34 +0.02
0.71
-0.01
0.39
+0.01
0.50
+0.02
0.40
+0.06
0.54 -0.03
Qwen 2.5-7B
0.49 -0.01
0.70 -0.01
0.33
40.12
0.40 +0.05
0.32
+0.11
0.51 +0.06
Qwen
0.36 -0.01
0.59 +0.02
0.29
+0.16
0.32 +0.10
0.30
+0.17
0.42 +0.11
Qwen-2.5-1.5B
0.30 +0.02
0.54 +0.02
0.21
0.00
0.25 0.00
0.22
-0.01
0.38 +0.03
Qwen.2.5.0.5.
0.13 00.04
0.22 -0.04
0.08
0.01
0.12 0.00
0.11
+0.01
0.13 -0.0
Mistrl--malll-244
00.06
0.01
0.42
-0.0
Mixtral-8x7B
0,44 0.00
0.65 -0.01
0.25
0.03
0.31 -0.02
0.25
-0.01
0.35 -0.01
Mistral-7B
0,30 -0.01
0.55 +0.04
0.14
0.00
0.22 0.00
0.19
+0.01
0.22 +0.01
Vicuna 13B
0.27 0.00
0.48 0..0
0.11
0.02
0.17 0.00
0.15
0.00
0.16 00.01
Vicuna-7B
0.21 +0.01
0.41 0.00
0. 12
0.01
0.15 -0.01
0.15
+0.01
0.14 0.00
Llama-3,3-700
0.62 -0.02
+0.02 0.46
0.54 -0.02
0.56 -0002
IJama 3,2.3B
0.33 0.00
0.53 00.01
0.19
0.02
0.23 +0.01
0.18
+0.02
0.30 -0.01
Llama-3. 3.B-1-
0.17 +0.04
0.37 +0.03
0.12
+0.01
+0.02
0.14
+0.02
+0.02
Alama-3,11700
0.61 -0.02
0.78 0.00
0.46
+0.01
0.54 0.00
0.39
-0.01
0.54 0.00
Llama- 1.1-m-3.118B
0.42 00.04
0.63 +0.02
0.28
+0.01
0.34 -0.02
0.26
+0.02
0.36 0.03
Llama 3. 3.70B
0.58 0.004
0.78 0.03
0.41
-0.06
0.50 0.00
0.37
-0.04
0.50 0.03
Llama-3-88
0.39 0.04
0.65 -0.02
0.26
+0.01
0.32 -0.01
0.32
+0.02
0.34 0.00
Llama-2-70B
0.36 +0.05
0.00
Llama-2-138
0.23 0.00
0.44 0.00
0.16
+0.02
0.18 00.01
0.14
-0.03
0.18 0.00
Llama-2-7B
0.17 0.00
0.39 0.00
0.13
0.00
0.15 0.01
0.15
+0.01
0.01
Table A.4: MMLU-Pro Scores for Social Sciences and other categories. Domains: Business, Economics,
Health, History, Law, Other, Philosophy and Psychology. Model names are trimmed for brevity.
Model Name
Busin.
A
Bcon.
Health
A
Hist.
A
Law
A
Other
A
Phil
Psych.
A
Qwen 2.5.22B
-0.03
0002
Qwen 2.5.22
0.65 +0.08
0.73
0.00
0.66
0.00
0.60
-0.02
0.40
0.04
0.61
-0.04
0.57
00.8
0.73
-0.03
Qwen-2.5-14B
0.57 -0.02
0.68
-0.01
0.57
-0.03
-0.05
0.32
0.005
0.55 -0.06
0.49
-0.04
0.65
-0.07
Qwen-2.5-7B
0.49 -0.02
0.60 -0.01
0.48 -0.07
0.45 -0.06
0.29
0.03
0.49 -0.04
0.45 -0.03
0.62 -0.04
Qwen:2.5.33
0.39 +0.02
0.50 0.00
0.36 -0.05
0.33
-0.08
0.21
0.04
0.37 -0.0
0.35 00.0
0.53 -0.03
Qwen-2.5.1.5
0.34 -0.01
0.43 0.00
0.31 0.00
0.28 0.00
0.16 00.01
0.30 0.02
0.03 0.27
0.45 0.00
Owen-2.5-0.5B
0.12 0..0
0.24 00.01
0.17 +0.01
0.18 40.03
0.13 0.00
0.15 0000
0.00 0.15
0.21 0.00
0.66
0.01
0.36
0.00
Mixtral-8x7B
0.39 +0.01
0.52
0.02
0.47 0.03
0.41 -0.05
0.30
0.01
0.47 0.00
0.42 0.05
0.60 -0.06
Mistral-7B
0.26 +0.02
0.43 0.02
0.40 +0.01
0.35
0.00
0.21
0.01
0.36 0.01
0.32
-0.01
0.52 0.00
Vicuna-13B
0.24 0.00
0.40 0.02
0.30 0.04
0.27
-0.04
0.19
0.05
0.34 0.00
0.28
0.00
0.46 -.002
Vicuna 7B
0.18 -0.01
0.33 0.01
0.22
0.02
0.19 0..0
0.15
0.01
0.24 0.02
0.22
0.01
0.36 0.05
1lama-3.1-708
0.63 -0.02
0.74 0.03
0.00 0.69
-0.01 0.65
0.02 0.45
0.64 0.04
0.61
0.01
0.77 0..1
Llama 3.2.3B
0.32 -0.01
0.41 00.11
0.01 0.38
+0.01 0.34
0.02 0.21
0.32 0.03
0.28
-0.04
0.48 - -0.02
Ilama-3 3.2.
0.00
0.27 +0.03
0.03 0.65
0.00
0.30 0.00
1lama-3,1-700
0.57 0.57-0.00 -0.04
0.72 0.01
0.01
0.62 -0.01
0.44 0.02
0.63 -0.02
00.02 0.58
0.74 -0.01
Llama-3.1-8B
0.40 -0.05
0.54
+0.01
0.02 0.49
0.43 +0.01
0.29 +0.02
0.45 00.0
-0.05 0.39
0.59 -0.01
Llama 3- 3-70B
0.55 -0.06
0.70 0004
0.69 0.00
0.61
0000
0.39 0.03
0.61 0003
-0.02 0.56
0.73 0.00
Laaaa 3. 8B
0.39 +0.01
0.50 0.03
0.44 0.04
0.41
0.02
0.23 0.04
0.43 0.02
+0.03 0.41
0.58 0.03
Jlama-2-70B
0.34 -0.01
0.46 0.04
0.36
0.03
0.37
0.04
0.22 0.001
0.42 0.00
0.02
0.54 +0.01
Llama 2. 2-1
0.22 0.02
0.37
0.00
0.26
- 0.03
0.29 0.00
0.17 0.01
0.33 0.00
0.28 0.01
0.43 0.02
Llama-2-78
0.20
0.32
0.22
0.20 0.02
0.04 0.15
0.23 0.02
0.02 0.21
0.34 0.05
21

---

Published as a conference paper at ICLR 2026
B ATTACK DETAILS
In our evaluation we use following established (Mehrotra al., 2024), PAP (Zeng et al., 2024) and Crescendo (Russinovich al., 2025). For all attacks we use original model checkpoints as target models, prompted with the safe Llama2 system prompt. As attacker and judge models we use the same unlocked checkpoints, except for the ablation presented in Section 6.2. Final scoring is done with the HarmBench judge, evaluating all attacker attempts on target model.
attacks: PAIR (Chao et al., 2025), TAP
We provide pseudocode for PAIR in Algorithm 1, Crescendo in Algorithm 2, TAP in Algorithm 4, and PAP Algorithm 3. To compare attacks on equal footing, we attempt to keep the query budget comparable across methods.
PAIR: We use N = 5 streams and R = 5 rounds, with the final success rate reported as ASR
(i.e., evaluated over 25 attempts).
Crescendo: We N streams and R = 8 rounds, with the success rate reported ASR 024 (i.e., evaluated over 24 attempts). We decrease the number of streams and increase the number of rounds compared to PAIR, as Crescendo requires more attempts collect information about the malicious query.
PAP: We use a HarmBench implementation which differs from the original method in Zeng et al. (2024), and uses 40 seeding strategies. For every target behavior, we randomly sample 25 behaviors and evaluate them in zero-shot fashion. This version of PAP does not rely on a specifically trained attacker model and does have an iterative component where the attacker improves upon its previous attempts. The final success rate is reported as ASR
TAP:
We adapt the HarmBench implementation with width W = 2, depth R = 4, and number of seeded from the W best-scored
streams N = 3. At each round except the first, all generations generations at the previous round, then pruned back to W. With the first round set to 7 generations, this results in 7, 6, 6 generated prompts, and the final success rate is reported ASR@25
We additionally report direct query (ASR@1) in Figure 2. We treat direct query as the naively ASR on the model for a "dummy attacker" (however some paraphrases the same questions can lead the lower ASR). We use direct query values when fitting scaling curves in Figure 4, assigning a random- random-guess guess MMLU-Pro capability (~-0.11) to the dummy attacker.
Direct Query:
All methods require attackers to generate attacking queries that conform to predefined template. However, it happen that model fails adhere this template, resulting in "empty" attempts (i.e.. failed query generations). We count such attempts as failures to produce jailbreak, as they result from the attacker's incapability.
The target and judge models operate with deterministic generation (temperature t t= 0). In contrast, the attacker model uses temperature 0.6 and top_p 0.9 to introduce stochasticity and enable diverse query generation across streams.
While in Figure 2 we present results across all attacks, we additionally report per-attack heatmaps in Figure 9 (PAIR), Figure 10 (Crescendo), Figure 12 (PAP) and Figure 11 (TAP) with ASR numbers. We also present "win-rate heatmap" (Figure 13) where model-pairs are colored according to the attack method that achieved the highest ASR for that attacker-target pair.
Compute Resources. All attacks were run on single node with eight A100 80 GB GPUs. Closed- source models were accessed through the OpenRouter and OpenAl APIs, incurring 2000S US Dollars in usage credits. Experiments were executed with the STAI-tuned experiment scheduler (Rubinstein & Uselis, 2025) framework.
22

---

Published as a conference paper at ICLR 2026
Algorithm 1: PAIR
Input Task t, Target Model T, Attack Model A, Judge Model J, HarmBench Judge H.J. Rounds R, Number Streams N
Result: : Per-task Jailbreak Success over All Attempts
// Initialize history of all target responses to attacker queries
Hmias 0
// Different independent iterations of PAIR
for i + 10:+1100 to N do
// Initialize history for attack model
HA <=<0; ():
r r "":
// Generate new query
9 H:
// Generate a response from rt T(4);
// Add query and response to A's history (HA)
add(HA,q,r):
11 Add new attempt to trials history (Mlriias) add(HHuiass: r.r);
// Checkinn if T refused r
// Score the response score + evaluate(J,rr,));;
// Add evaluation results to A's history score);
score:;
success 0; for i + 1 to N x do
r,4 H (i]:
success -- max (axx(HH((rr success);
return sucCEss;
23

---

Published as a conference paper at ICLR 2026
Algorithm 2:
Crescendo
Input :ask I, Target Model T, Áttack Model A, Judge Model J, HarmBench Judge H.J, Rounds R, Number Streams N
Result: : Per--tak Jailbreak Success over All Attempts
// Initialize history of all target responses to attacker queries
Huials + f3:
/ Different independent iterations Crescendo
for i +- to N do
// Initialize history for target model
Hr +- {}:
// Initialize history for attack model HAs (};
r r
j do
// Judge generates the scoring scheme for task
judgingScheme J();
// Generate new query and the last response (r) summary
9. genCrescendostep(( H,
// Add query to T's history (H7) add(Hr,q):
// Generate response from T
r T+((H
// Add query and summary to A's history (HA)
add(HA. s);;
// Add attempt to trials history (Herisse)
Mad(HHials:4/ r);
// Checking if T refused
if responseRefissed(]]] then
// Backtrack
pop(Hl));
continue:
// Add response to T's history (H7) add(HT,,r)
// Score the response
score + evaluate(J.jjugginggoos wuuggingSchemee...
// Add evaluation results A's history score);
success = 0; for i + to N x do
r.q Huials [i];
success & max (HJ g). success);
return success;
24

---

Published as a conference paper at ICLR 2026
Algorithm 3: PAP
Input :askk I, Tarret Model T, Attack Model A, HarmBench Judge HJ, Behavior Pool Size
40, Number Samples N 25
Result: Per-task Jailbreak Success over All Attempts
// Initialize history all target responses to attacker
queries
Hiiils f
1/ Get pool of В seeding behaviors
behaviior Pool + Be
// Randomly sample N behaviors from the pool
BahpiedBehaviors +- mandmSaappo(ehharrrroooo
// Evaluate each sampled behavior in zero-shot fashion for i + to do
// Generate query using sampled behavior
- genPAPQuery(A, stmpaauueeey...saaalaeeellloooo saw.peldeeeaviiossiiil
// Generate response from
r - T(g);
// Add new attempt to trials history HaidHHials:/// r);
success = 0; for i +- to N do
r,q - Huials [i];
success max(HL((r.))) success):
return success;
PAIR Attack Success Rate on HarmBench
qwen2.5-72b 0000000000000
940
1.0
gwen2.5-326
qwen2.5-144 5-14b
920 220
qwen2.5-/b 09:00000000000001110111100
1203 03 03 2220500
700
80.76 30
qwen2.5-36 2--55-3b--0 -062 302 3.05.99) 140022:1 53
54500000 2006
1000040:222
10.10:002000
1wen2.51..bb-- 0
18)1890180
6200
qwen2..-005b
Attacker Model
vicuna-1 3b
2,000
02).125144 2402
20325 20032.0000000
0.00 20.00.60.660.18
vicuna-7b 0.020 02
02) 02 0.66 C $2403 4:0034444444 440444022 12t
862 72 MO.
6 0.14 0.14
mistral misltra-smaill24b 000300000000
500
0.8
8x76
mistral
0.5
Ilamaa,3-700 -0:20 02 08928611718
Ilama3.2 -.05 2,20
Ilama8.2:15
0231185144
0.
86078072)
SRCEESSS 2A 1401 O
18300334
0.4
llama3.1-706
llama3. 1-8b 111.39911122000000
0.3
llama3-70b a 01:140
70200 880
900.890
900
940
O 842
Ilama3-8b 4-24-239333
03
923
con
0.2
llama2-706 70b
Ilama2 13b
240240360
14014
llama2-7b- 0000.000000
1801900000
242002411
w00.000000000
180.20.c
Avg. Target ASR -7040 .0:00000:044
09009 850.7 O 09 399caan0.
10.
2010 (4. 1/0.000 0.00
lama22-7
Ilama2-138 3b
Ilama2-006
lamms3-80
Ilama3-706 9-00
laam33 8bb
Ilamm3.11 1mma3.1-70 1-70b
laama8.2-1b
lama8-2:30 28.-2:366 36
llama3. 70b
mistral-t-voo v..
mixtral Battral-xx7 8x
mistral small 24b
vicuna-77 7b
vicuna 3l
00m255001 Se
qwen2.3 36
awenz. 76
qwen2..8: 5:14b
qwen2. 5 322
qwen2.5 5 72b
gemini-2.0 0.fihhhhh
gemini proe pro.
03
o4-mni
claude sonnet-
Attacker ASR
gpt
owenzze
awenzin
Target Model
Figure Attacker- Target Combinations PAIR. Each represents Attack Success (ASR)
specific attacker-target combination, evaluated on the first 50 queries from HarmBench. All models are sorted by model family, and by generation inside a family.
25

---

Published as a conference paper at ICLR 2026
Algorithm 4: TAP
Input Task I, Target Model T, Attack Model A, Judge Model J, HarmBench Judge HJJ,
Width W = 2, Depth R = 4, Number of Streams N 3, Initial Generations Go
Jailbreak Success over All Attempts
// Initialize history of all target responses to attacker queries
Hurial (
// Initialize candidates pool
candidates + ():
// First round: generate Go initial queries
queries genTAPQQerie((Att Go);
for q E queries do
// Generate response from T
r + T());
// Score the response
score + evaluatt([J,rr
// Add to candidates with score add(cannisates, (q. rg score));
// Add new attempt to trials history v,r);
/ Iterative refinement over R rounds j 1- do
// Select top W candidates from previous round topCandidates <- seleec/iopaandddates,, W));
candidates + ()
/ Generate N new queries from each top candidate for topCandidates do queries + CenTAAPQueries(AAttcc..
for q queries do
/ Generate a response from T
r T());
// Score the response
score ev..lutt(JJ.nntt))
// Add to candidates with score add(candidates, (q, (4,r,scom score));
// Add new attempt to trials history
Hrilts q r):
success = 0; for f- to H triats do
r,q t H [
success f max(HHJ(r, q), success);
return success;
26

---

Published as a conference paper at ICLR 2026
Crescendo Attack Success Rate on HarmBench
qwen2.S-72b -000 cus 0.14
63
0.56
B35
0:58
0:2
0:70
0:34
072
1.0
qwen2.5-32b -.ce 324 02
6.76
0.92
0.64
544
qwen2.5-14b 0006
0.34
0.66
8.68
0:63
0.56
8:60
0.76
0.92
0.69
0.9
qwen2.5 -bb- 292
0.19 0.24
5.46
0.44
5:55
0.46
0.4
0.4
2/4
0.35
04
0:34
3.62
0.56
0.90
0:55
0.50
0.55
0.52
64
qwen2.5:3b
0.8
Attacker Model
vicuna-1 3b 0 o.s 0:22 0.06 00 0:34
0:
9:45
0:16
0.74
0.36 0:3
13:4 044
9:64
0:52
0:62
0:52
0:34
0:31
0.4
0.28
vicuna-76
mistral small 24b -0.12 5.5 0:06
63
0.50
3.76
0.52
0x
0.65
0.60
0.34
8.62
0.78
0.82
0.72
0.72
0:22
0.72
0.78
mixtral-8x7b 0.00 2us 0.22
02
0.45
0.36
0.34
0.24
0.82
0.6
mistral-7b-v0.2 812 0.66
0:38
0:40
A:
0:56
0:97
6:
9.
6:78
llama3.3-706b 0.06 3,08
0.18
0:46
0.6
0.6
0.06
0.5
9.6
9.7%
0.79
5:62
0.49
0.5
Ilama3.2-3b-
0:14
9.24
0.24
0:06
0.29
0.24
0.17
Ilama3.11 -..0 0.9 0.14 0.29 9:45
2/
0.92
0.75
0.22
(0.9
0.82
0.79
9.55
0.72
10:44
0.89
0:94
01/6
0:84
0.04
0.64
0.4
Ilama3: 8b
Ilama3-700 0.066
0:06
0.
[03
0:06
07
0.22
0.66 0.46
6:5
0.41
0.34
9:66
0.72
9.56
0:62
0.06
0.
0.70
0.5
Ilama3-8b
3,02
0.16
0:28
0.08
0.2
0.19
Ilama2-70b- 0
0:10
5.14
0.18
0.14 0.18
0.14
5.34
0.4
0.28
0.19
0.4
0.14 6:24
0.18
0.18
0.2
Ilama2 13b
-002-002
0.00 0.00
022
0.18
0.18
0:36
0.24
0.13
Ilama2-76 7b o
0.02-4..0000
6:14
0.18
0/2
0.14
0.00
9:
0.24
0:28
0.18
0.24
-0.1
Avg. Target ASR 0.08 3,05 0.54 0.14 0:25 0.87
3:45
0.46
0.22
0:41
04
0.35 9:47
0:35
0.
(0:56
0.63
0:59
0.47
0:85
llama2-75
llama2-1 13
Ilamaz 706
Ilama--Bb
laama3 706
Ilama3, 1-8b.
Ilama3, 1-706
llama3.2 2-12
llama33 2 2-3b-
Ilama 3.3-70
mistral 7b v0.2
mixtr ---77b
mistral small-mllll---- 24b
vicune-7 7b
vicuna-11 133
qwen2 1.5
qwen2 5-3b
qwen2 9-
owen2.55 2-1112.5111 40
qwen2.5 5-3-3
qwen2.5 5 72h
Avg. Attaacer ASR-
0.0
qwen2.55 1enn2.500..8
Target Model
Figure 10: Attacker-Target Combinations for Crescendo. Each cell represents the Attack Success Rate (ASR) for a specific attacker-target combination, evaluated on the first 50 queries from HarmBench. All models are sorted by model family, and by generation inside a family. As we discuss in Section 6, Crescendo generally underperforms both TAP and PAIR. Due to computational and monetary constraints, we evaluated Crescendo only subset of model combinations, excluding least capable attacker models and closed-source targets.
TAP Attack Success Rate on HarmBench
qwen2..5-22b 41789185348
54
1.5
qwen2.5-32b
03:.44 853 95..92994)) 34
6440.4
292
0.44.72 74.744055
500000.8
33655
qwen2.5 14b -0 05)
08)
76) 825
823 84
3,98
348
643840
220280
12
0.9
qwen2.557b
02.
00
qwen2.553b
0.8
qwen2.5-115b 0.00
022222222
1.214 243576445 2404
Attacker Model
qwen2.5-0.50-
vicuna-130 3b 42-412230000000 063 18529))3 Kifs 24
0 03963400188 1200110122222 u.2 24030119
r00 son
520 850005000
950 653
940
02
0.7
vicuna 7b 7b-4520
mistral-small-24b 4224280000
$203 2823 94:
53443
982994
2928.920
0.5
mixtral-8x7b
011119:24::1
180 505000
525 89.
925.5)
100.000
12.
15
mistral-7b-vv.22 2 140:140000
083
24330
303200
090.78)
342.4
0.862
655
0.5
llaaa3,3-770 .6:02300::00000
50.00
923
llamm8.223bb-
Ilams3.2-1b a22 4.02
1lama3.1-70b- - 634c.33000
oe B.T92224007
78394 1
3944:940 o2 1
1 2 952.940 sec 1241 100.0000..000.... 180.72
Ilama3.1-88 40110252201
18 a20 923 52:320
950.4)
912.89338)
1 (1940 to0te 15..0...0000000... 120.2.00.22
Ilamaš 70b 0:033440
38880920322
32.
420.020
18.
Ilama& 12-88b-33 840
925
938.990
-02
laama2-70b 0.80112 0 0.08) 0.4 040 0302200.
Ilama2-13b 0.20 0 0 0.20 16012.0.00 293 240.55
0.1
Ilama2-76-1
0 0122:000 190.100
762.10
0.44
Avg. ASR
ASR 0.0
llema223
Hesma--n 3b
1asma-7000
Illrna--00 -bb
Ilama3-700
Ilarna3 abb
Hasma3.1-700 1-70b
Ilarna 2.11
Ilama 2:36 2-36
llama8. 3 70b
miatral-b--0.22 2
mixtral-8x77 8xx7b
mistral small 24b vicuna-75
vicaina-1 13b
qwen2.5 0 5b
qwen2.5-1 ..56
qwen2. 3b
qwen2.5 2.en2.577b. 7b
qwen2.55 2-5 14b
qwen2 12.25.3330 32b
qwen2.5 5. 72b
gemini-2 O-flash
gemini-2 2. pro
gpt-4.1
03 mini
63
04-mini
claude 7-sonnet
Avg. Attarker ASR-
Target Model
Figure 11: Attacker-Target Combinations for TAP. Each call represents the Attack Success Rate (ASR) for a
specific attacker-target combination, evaluated the first 50 queries from HarmBench. Empty (white) cells represent not evaluated pairs. Due monetary constraints, against closed-source targets we evaluated only the most capable attacker models.
27

---

Published as a conference paper at ICLR 2026
PAP Attack Success Rate on HarmBench
gwen2.5-72b
0:12
0.52
1.5
qwen2.5-326
qwen2.5-14b
0.08
0.66
924
0.66
02
0.6
04
qwen2.5-7b
8.66 314
0:8
011
1414
0:34
8:48
235
022
036
05
04
0.31
5:6
8M
3M
8:22 0:
0.2
5.4
0:45
0.30
0:5
qwen2.5-3b-uu ouz
0.00
0.14
0.4
0.12
0:72
062
021
qwen2.5-1.5
Attacker Model
qwen2. 0.5b
vicuna 3b -0.2 3.12 0.56
0.18
034
0.36
0.8
0.5
0.7
0.78
0.66
0:82
07
vicuna-7b 0.68 3:18
82
0.3
0.3
0.4
0.24
39 0:93
9.99
04
0.34
mistral-small-24b
0.6
mistral-7b-v0.22 -052 0:58
0.24
0.6
6.76
0:46
0.5
Ilama3,3 3. -0.0 314 8:88
1212
0:21
0.3
0.3
0.38
0.78
3A 0X
SMT
9. 8:F
0.46
D3
5:16
0.41
llama3.2-1b
Ilama3.2-33- -008 cus
02
0:34
0.46
0.74
0
CJM4
0.42
0.4
Ilama3,1 100
055
2:55
llamma.1-8b--
0
0.12
0.84
0.4
013
0.24
0.5
0.28
0:00 0:52
0.82
9.78
6.76
2.40
0.42
0.3
llama--70b -014 314 0.12
8:24
0:36
0:44
0:45
0:34
0.62
02
5.72
07
9:92
0776
0444
SF 6:51 9.14
Ilama3-8b 012
0:34
0:44
0.47
0.
llama2-70b
Ilama2-13b -0.2 302
0.14
0:8
0.24
0.4
0.08
9
02
0:34
0.00
Ilama2 7b -8.0 3.1 ace
0.14
93H
0.3
0.34
0.18
5:52
6:77
8856
8:53
0-3
8.1
0.70
Avg. Target ASR -000 01 Bay 000
634
632
030
0446
0.25
GAM
Ilamm2-22 7b
llama2-
llama2 70b
Ilamm
laama 70b
Ilama3. 8b
llama3, 1-70b
1amma3 2-1b
llama3.2
llama3.3 3-3000 70
mistral 7b v0.2
mixtral-8x76
mistral small-24b
vicuna 7b
Mcuna- 13b
qwen2 5-0
1.5p
qwen2.55 5
qwen2 5-30
qwen2
qwen2.55 5: 14l
qwen2. 5-32b
qwen2.5 5 7-72b
Avg. Attaoker ASR
ASR
Target Model
Figure 12: Attacker- Attacker-Target Combinations for PAP. Each represents the Attack Success Rate (ASR) specific attacker-target combination, evaluated on the first 50 queries from HarmBench. We identify PAP as the least effective attack. Due to computational and monetary constraints, we evaluated PAP only subset of model combinations, excluding closed-source targets.
ASR "Win-Rate" Comparison
PAIR wins
CRESCENDO wins
TAP wins
PAP wins
Tie
qwen2.5-72b
qwen2.5-32b
qwen2.5-14b
qwen2.5 5-
qwen2.5 5-3b
qwen 5-1.5b
Attacker Model
qwen2 5-0.5b
vicuna-13 13b
vicuna 7b
mistral-small-22 24b
mixtral-Bx7b
mistral-7b-v0..
Ilama3.3 70b-
Ilamm3.22 2:3b
Ilama3. 2-10
1lama3. 1-770b
llama3. 1-8b
llama3-70b
Ilama3-8 8b
llama2:70 70b
Ilama2-13bb
llama2-7b
Ilama2-77 7o
liaima2-15 3o
Ilama2 706
Ilama3--8
llama3 706
Ilama3.1 1-86
Ilama3. 1700
Ilama3, 2 1b-
Ilama3 2:
Ilama3.3. 3-70b
mistral v0.2
mixtral 8x7o
mistral-small-22
vicuma
vicuna-183 18b
qwen2.55. 5...0....
qwen2. 5-1. 1.56
qwen2.55 5 3b
qieen2.572 5-76
qwen2 14
qwen2 5- 326
qwen2 5-72b
gemini-2 gemini-2.00fien 2.0-lshhh
gemini- 5 pro
o3-mini
04-m
claude-3.7--0 7-aonneet
gpt-4.1
Target Model
Figure 13: Attacks "Win-Rate" Comparison for All Attacker-Targe -arggtt Combinations, Fach cell is colored according the attack method that allowed attacker achieve higher Attack Success Rate (ASR) against the given target model. A trend emerges, with PAP being more successful against safegurredd models, total, TAP is the best attacking scaffold among considered.
28

---

Published as a conference paper at ICLR 2026
C CLEARHARM EVALUATION
In this section, we investigate whether the observed scaling trends generalize to other sources of harmful queries. To this end, we evaluate PAIR on ClearHarm (Hollinsworth et al., 2025; McKenzie al., 2025), a dataset of unambiguously harmful queries designed to measure ASR on catastrophic risk scenarios. We run PAIR on the first 50 queries and evaluate success using the HarmBench judge.
PAIR Attack Success Rate on ClearHarm
gwen2.5-72b
qwen2.5-32b -ea
0.94
0:08
0:04
0.92
qwen2.5-14B
-400-- 4..6
205
0.24 0.
0:24
25
0.52
0.22
0.22
0.76
0.50
0.55
0.14
8:65
0.89
0:00
080
278
3.76
0.6
qwen2.5 76-7bb.05
-0.66 300 0:18
0:14
83
0.55
811
0.22
0.02
0.66
0.08
5.58 0:88
0.38
0:68
082
0.8
0.95
qwen2.5-3b
0.8
qwen2.5-1.58
202
04
0.25
0.44
0.72
0.94
Attacker Model
q qwen225-0.55
vicuna-1 3b 0:06 0.03 02
0.8
0
0.14
0.24
0.18
193
0.2
2.24
02
0:46
0.4
0.48
0.6
0.26
0.56
0.12
0.28
0,02
0.70
3.92
0.96
06
0.68
9
0:56
0.84
0.56
0.78
0.62
0.92
0.53
0.7
vicuna-7b
92
0.03
0:24
D24
9:93
mistral small 24b-0
0.6
mnixtral-887b-b
0:56
C24
036
0.92
0.88
0.98
0.99
0.9
8.69
mistrral 7b-v0.2-0000
0.16
0.14
5.00
0.
2.02
0.36
2165
0.82
6/6
0.82
5:04
W.s
2.94
0.94
BX
0.75
2.76
6.5
0.5
llama3.3 7-b -0.5 -0.6 3:12 0.24
9:24
:35 0.92
2:24
0.72
0.78
0.82
0.88
0.56 0.98
3.54
0.99
llama3.2:3b
Ilamm8.2-1b
0.56
0.4
Hamma3.1-700 0.66 3.02
(846) 0.14 02
0.72 0:78
2:34
0.22
0:89
0.88
0.54
0.92
1 0.94
0.58
3.56
0:73
Ilama3.1-88 -:3 9:29
0.34
0788
0.62 94
0:58
0.90
0.94
94
0.92
5.98 0:88
0.98
0.58
1
3.58
0.81
Ilama3-70b -034
nEA 01
6.70
0.9
Ilama3 8b
llama2-70b -uce
0:56
1158
0.78
0.94
0:94
0.82
llama2-13b -0:22 00s
0.0
0.5
0.54
0:34
5.08
0.46
0.99
0.26
0:28
0.35
0.34
0.9
0.52
0.89
U.5
13.5
0.42
Ilama2 7b 0002
0.2
0.0
0.15 0.59
2:24
(:46
0.44
0:93
0.78
6:82
0:62
2.62
0.49
Avg. Target ASR -0.1 3T1
0.14
0:47
0.96
0:76
llama2-28 7b
llaima-11 13b
llama2 70b
Ilama3-Bb
liamaa 70b
llama3,1 8b
Ilaam33 1-70b
Ilama3,2-1 2-1b
llama3,2 3b
Ilaema3.3 3-70-
mistral vb.20..2
mixtral -xx7bb
misrral small (mall--200 24b
vicuna-7b
vicuna-1 13b
qwen2. 5..5000.0 5b
qwen2..5 1.5b
qwen2 5.3-3b
qwen2. 6-77
qwen2 5-14b
qwen2.5 5-32b
72b
Avg. Attacker ASR-
ASR 0.0
Target Model
Figure 14: Attacker-Targe Target Combinations on ClearHarm Dataset. Each cell represents the Attack Success Rate (ASR) of the PAIR attack for specific attacker-targe combination, evaluated on the first 50 queries from ClearHarm. All attacker models achieve higher ASR compared to the HarmBench dataset (see Figure 9).
Results are shown in Figure 14. All attackers achieve substantially higher ASR on ClearHarm compared to HarmBench, despite ClearHarm queries targeting catastrophic risks. However, the core scaling trends remain robust: ASR scales linearly with attacker capability (Figure 15, P = 0.62 vs P 0.67 on HarmBench), and per-target curves maintain their sigmoid shape (Figure 16). The steeper slopes on ClearHarm mirror the differences between stronger and weaker attacks observed in Figure 8.
ClearHarm (PAIR)
HarmBench (PAIR)
Model Families
1.0
R²=0.62
1.0
R - 0.67
Llama2
Attacker Success Rate
0.79
p= 0.84
0.8
Mistral
Vicuna
Qwen2.5
0.6
Model Size
<38
3-88
0.2
13-32B
>70B
0.2
0.4
0.6
0.2
0.6
Attacker MMLU-Pro
Attacker MMLU-Pro
Figure 15: Comparison of Attacker Average Success Rates between Datasets. All attacker models achieve higher ASR on the ClearHarm dataset. However, attacker success scales similarly with general attacker capability, following a linear trend across both datasets. Trends plotted on common subset of model pairs of PAIR.
29

---

Published as a conference paper at ICLR 2026
While absolute ASR values dataset-dependent, the underlying scaling is largely invariant across ClearHarm and HarmBench. Practitioners should evaluate attacks on datasets that reflect their specific threat model company policy, dataset choice affects reported success rates but does not alter the fundamental scaling relationships between attacker capability and performance.
Qwen2.5-72b
Qwen2.5 Family
1.0
1.0
HarmBench (PAIR)
Attacks Success Rate
0.8
0.8
0.6
0.6
0.4
0.4
Training
Median
0.2
Median
0.2
Individual
+68%
0.0
+95%
0.0
+95%
2
1.0
1.0
ClearHarm (PAIR)
Attacks Success Rate
0.8
0.8
0.6
0.6
0.4
0.4
Training Data
Median
0.2
Median
0.2
Individual
0.0
0.0
-2
2
Capability Difference
Capability Difference
Figure 16: Comparison of Capability- Scaling of PAIR between Datasets. ClearHarm emerged as a simpler dataset, the resulting scaling curves are steeper, consistent with the scaling patterns observed between weaker and stronger attacks (e.g., TAP vs. PAIR; see Figure 8).
30

---

Published as a conference paper at ICLR 2026
D MODELING DETAILS
In this section, we discuss different modeling approaches and alternative capability gap definitions.
D.1 PROBLEM SETTING
We aim to model the allack success rale (ASR) of jailbreaking attempts as a function of the capability sap between the attacker model AA and the target model T. For any given attacker-target pair a t, goal is to predict the expected ASR, along with calibrated uncertainty estimates.
To quantify the capability difference, we define the capability gap 60-ts as function of MMLU-Pro scores of attacker and target. We compare different capability gap definitions in the following sections. To model worst-case scenario, for the same ttargt pair we select the highest ASR over considered attacks.
We assume a global non-negative correlation: a weaker attacker (e.g., random token generator) should outperform much stronger (e.g., oracle).
D.2 PROBLEM FORMALIZATION
Let D = {D(O) denote a collection of T independent datasets. Each dataset D(() corresponds to specific target model T()), and contains ASR observations from multiple attacker models. Formally:
D = {x va)) )
where:
Ta E I is the capability gap for the attacker-target pair + t;
E (0, 1] is the observed ASR, where (1) E {0, 1,...,N N} is the number of successful jailbreaks out of N trials (assumed fixed and known).
20 N
ya
Each dataset D(t) defines a separate regression task. The goal is to infer the predictive distribution for new input r.:
ply. x., D(O),
which should capture both the expected ASR and epistemic and alcatoric uncertaintics.
For aggregated (per-family) predictive distribution we define mixture model over targets follows:
plya x,. D)
ply. D(.)(
T
D.3 MODELING
We demonstrate in Section that worst-case target vulnerability empirically follows sigmoid like curve. For capability-based predictive model we exploit this observation and apply logit transformation,
logit(y) log( -
which maps ASR values [0, 1] to the real line. Consistent with Miller al. (2021), then fit linear model in this new transformed space.
To avoid divergence to too when y 0 or clip the scores [ number of trials. This clipping is motivated by the fact that the original ASR value is based on N trials, so half the resolution of the score ensure numerical stability while preserving the underlying aleatoric uncertainty.
2N-1 where N is the 2 2N
We specify the linear model as:
logit(y) N - +r++b b, d),
where x denotes the capability gap between attacker and target, and y denotes attack success rate. To accurately infer the predictive distribution then compare approaches: Bayesian linear regression and bootstrapped linear regression, as former enables nuanced incorporation of our prior assumptions. We provide our model definitions below.
31

---

Published as a conference paper at ICLR 2026
D.3.1 BAYESIAN LINEAR REGRESSION
We impose the following priors on the parameters:
HaltNormal(ou)) enforcing non-negative slope to reflect the assumed non con-negative correla- tion between the capability gap and the ASR:
b ~ N(0, of),, allowing symmetric uncertainty around zero for the intercept;
a (a))Normal(7.)) ensuring strictly positive observation noise.
The full joint prior is given by: p(w, b,
Own Tb. 0a) = HalfNormal( (ww) -V(6 0, of) HalfNormal(d oa). (4)
We define the target-specific hyperparameters as E(( ow og }
The full posterior distribution, given the data (D()) and the hyperparameters D(),, is expressed as:
II N (logit(v!")
| w- x! + b, o) plu,, b,
12)0)) (0))
b( 0 D(t)) [(0)=
==1
II N (Iogit(v))) w 2010 + +b, 0) p(w,b,o E(0) dw db do
A
We implement the model using the PyMC python library with the HMC NUTS (No-U-Turn Sampler) algorithm for posterior approximation. Hyperparameters are selected separately for each model via Type Maximum Likelihood (Empirical Bayes) by maximizing the marginal log likelihood over the range (0.01,3.0) using Optuna (100 steps). That is, we optimize:
{)))
arg max log p (D()) 1)))))
go
where the marginal likelihood is defined as:
((D(1) ) / I
T v (Iggt (v!?)) w 2!! + b, o) plw, b, E dw db do.
Finally, the predictive distribution for a new observation at given capability gap x. is expressed
p(y. I., D(t), ,(() LogitNormally. w.w... b, σ) p(w, b, D(t), E(0) dw db do.
D.3.2 BOOTSTRAPPED LINEAR REGRESSION
For each target I, we generate N bootstrap datasets (D(t.n)) n=1 by sampling A = |D(() data points with replacement from the original dataset D(t),
For each bootstrap dataset (tt.a) obtain the maximum likelihood estimates (win)) b(n)) by solving:
(wo(), ((00) = arg max wpb
II N (Iogit (1)""")) w (((..)) + b, o²).
Then the empirical standard deviation if given by residuals for each bootstrap:
(n)
(logit (ogit(u!!")) (ub( w()) - xa (t.m) - b(n))
The final predictive distribution for new observation y. at given capability gap æ, is then approximated as a mixture:
N Σ
ply. 1 x., Ix, D(0)
((Iooit(v)))) (n) x. + b(m),, g(m)).
N
n=
32

---

Published as a conference paper at ICLR 2026
D.4 CHOOSING CAPABILITY- GAP DEFINITION
A capability gap 8 quantifies how much stronger an attacker a is than a target L. Any definition embeds assumptions about how performance differences should scale, especially near the top or bottom of the benchmark range. We evaluate four natural choices, using MMLU-Pro scores as the common capability axis.
Absolute score gap: Q--t OMMLU-Pr -MMLL-PPO
Interpretable, symmetric, and centered at zero. However, it treats the same score difference uniformly across the scale. Example: a jump from 0.20 - 0.30 (e.g., Vicuna-7b to Mistral-7b) is considered equivalent to jump from 0.89 0.99 (e.g., human expert to superhuman model), though the latter may subjectively reflect more substantial increase in capability.
Log score ratio:
p-+t
log( (MMMLU Pw...uIU.PP//MMMM....... MMM.U.PPPP
Captures proportional improvements in raw score, but overweights differences at the bottom of the scale. Example: the gap between 0.01 -> 0.10 (incoherent random guessing) is treated the same as 0.10 + 1.00 (random to perfect model), though the latter reflect a far more substantial improvement. Since most current models lie in the lower-mid range, this metric may still perform well empirically.
Log error ratio:
0 = log[ (1 (MMLU-PM) - UMMLU-POO]]
Focuses on residual error, which better separates models near the top of the scale. However, like the score ratio, it compresses differences at the lower end. Since most current models lie in the lower-mid range, we expect this metric perform poorly.
Logit gap:
logit log
(0MMLU-POO 1MMLU-PrO
+ log
/MMLU-PIO
=oggit(AMMLUU Pro) (/NMLL))
4MMLU-PIO
Combines score- and error-based perspectives into a single, smooth metric. It is symmetric, centred zero, and better captures variation across the full capability range.
D.5 MODEL COMPARISON
We fit proposed Bootstrapped and Bayesian linear models under each gap definition and assess four criteria: (i) n² logit space and (ii) Rt after mapping back to probability, for goodness fit; (iii) miscoverage at a 0.05, and (iv) Winkler interval score at a 0.05, for predictive uncertanty calibration. We report each metric averaged over all per-target fits (including outliers) in Tab. A.5. For this ablation used highest achieved ASR over PAIR, Crescendo and Direct Query attacks.
Miscoverage defined as the proportion of observed ASR values that fall outside the model's predicted 95% confidence interval: Miscoverage
1 Ch-aa
n Σ I I
The Winkler interval score (WIS) (Winkler, 1972) penalizes both miscoverage and overly wide confidence intervals, with the lower score the better.
Among the gap definitions, the absolute and log-error gaps perform noticeably worse across all metrics, for the former suggesting that linear treatment of capability differences fails capture the underlying scaling behavior. The log-score and logit gaps perform comparably well, with the log-score showing a marginal advantage. We attribute this to the current lack of models near the upper end of the capability spectrum, which limits the signal that could distinguish logit through residual error scaling. As future models approach this range, we expect the logit-based formulation to better capture improvements near the top of the scale. As both Bayesian and Bootstrapped regressions yield similar scores for predictive uncertainty, we stick to the Bootstrapped version, due to high computational burden of Type-2 MI.E. We report per-target fit results in Tab. A.6
33

---

Published as a conference paper at ICLR 2026
Table A.5: Comparison of Capability Gap Definitions and Regression Methods. We report average performance across all per-target fits (including outliers), with indicating one standard deviation. Metrics include n² in logit space (fit quality), Rº after mapping back to probability space, miscoverage and Winkler interval score (both at 0.05, lower is better). Log-score and logit gaps yield the best fits overall; Bayesian and Bootstrapped regressions yield similar confidence intervals.
Def.
Reg.
R (logit)
R² (prob) t
Avg. Miscoverage
Avg. WIS
logit
Boot.
0.64 + 0.13
0.60 0.21
0.05 0.11
0,46 + 0.09
a
Bayes
0.64 + 0.12
0.61 0.21
0.04
0.48 + 0.10
Boot.
0.66 + 0.13
0.62 + 0.12
0.05
0,45 = 0.09
log.un aig-score a-+
Bayes
0.65 - 0.14
0.61 = 0.20
0.05
0.47 = 0.09
llo--err a-+t
Boot.
0.57 + 0.14
0.53 + 0.23
0.06
0.53 + 0.10
Bayes
0.56 + 0.14
0.54 0.21
0.05
0.56 + 0.12
Boot.
0.61 + 0.14
0.57 = 0.22
0.05
0.49 = 0.09
Jubs
Bayes
0.59 + 0.14
0.58 = 0.20
0.14
0.53 = 0.12
Table A.6: Per-Target Fits. Performance of the median bootstrapped regression fit reported for each target model. For every attacker-target pair we use the maximum ASR achieved across both attacks.
Target Model Name
R² (logit) R² (prob)
Miscoverage (%)
median k
median b
Llama-2-78
0.50
0.16
1.18
-4.15
Llama-2-1 2-13B
0.41
0.09
17.4
1.0
-3.7
Llama-2-70B
0.52
0.39
13.0
0.97
-2.94
Ilama-3-38 3-8B
0.63
0.56
4.3
1.23
-1.78
Ilama-3-70B
0.63
0.59
4.3
1.38
0.09
Hamma-3.1-88
0.77
0.75
1.45
-0.43
Llama-3.1 3.1--0B
0.69
0.67
4.3
1.65
1.52
Llama-3.2-11 3.2-1BB
0.60
0.62
4.3
1.27
-1.50
Llama-3.2-4
0.71
0.71
4.3
1.40
-0.16
3.3--3B
0.72
0.68
1.54
1.23
Mistral-7B
0.63
0.72
4.3
1.39
0.48
Mixtral-8x7B
0.72
0.75
0.0
1.80
1.33
M
0.78
0.79
4.3
1.85
1.81
Vicuna-13B
0.64
0.67
0.0
1.53
-0.23
Vicuna-7B
0.81
0.80
0.16
Qwen-2.5-0.55
0.54
0.62
4.3
1.06
1.31
Qwen-2.5-1.5B
0.80
0.82
13,0
2.31
1.42
Qwen-2.5-3B
0.80
0.82
8.7
2.11
1.67
Qwen-2.5-7B
0.78
0.80
21.7
2.15
2.80
Qwen-2.5-144
0.69
0.74
0.0
1.39
Qwen-2.5-32B
0.81
0.82
0.0
2,30
2.98
Qwen-2.5-72B
0.73
0.79
4.3
2.05
2,83
Gemini-2.0-PP
0.76
0.68
4.3
1.93
2.23
Gemini-2. 2.5ini-2.5-Pro
0,47
0.31
13,0
1.18
0.30
o3
0,47
0.29
4.3
1.11
0.73
03-mini
0,44
0.34
0.0
0.92
0.62
o4-mini
0.55
0.47
0.0
1.12
0.92
34


Reviews:
[{"review_id": "E23QIjEosp", "reviewer": "Reviewer_SJAM", "summary": "This paper presents a large-scale empirical study on the dynamics of LLM-based red-teaming, reframing the problem from one of absolute model capabilities to one of a relative \"capability gap\" between the attacker and the target. By evaluating over 600 attacker-target pairs with two distinct LLM-based jailbreak methods (PAIR and Crescendo), the authors establish a \"jailbreaking scaling law.\" This law demonstrates that ASR is not linear but follows a predictable sigmoid function of the capability gap, which they measure using MMLU-Pro benchmark scores. Key findings include that more capable models are both better attackers and more robust targets, and that success in red-teaming correlates more strongly with social science and persuasion-related capabilities than with STEM knowledge. Ultimately, the work forecasts that as AI models become more capable, the effectiveness of any fixed-capability attacker, including human red-teamers, will inevitably and predictably decline.", "questions": "None", "limitations": "", "rating": 4, "confidence": 3, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "- The analysis is built upon \"more than 600 attacker-target combinations\", providing a robust empirical basis for its conclusions. The heatmap in Figure 2 visualizes this extensive dataset, lending significant weight to the observed trends and the derived scaling law.\n\n- By fine-tuning models to remove their safety guardrails, they \"eliminate the attacker's refusal as a confounding factor\". This allows the study to focus on a model's raw ability to craft adversarial prompts, rather than its willingness to engage in the red-teaming task, which is a critical distinction for a clean analysis.\n\n- The \"Capability-Based Jailbreaking Scaling Law\" (Figure 4) models ASR as a sigmoid function of the capability gap. This provides a concrete, predictive tool for forecasting the future efficacy of red-teaming efforts and reasoning about the security of deployed systems, which is a significant contribution over merely reporting ASR metrics.", "weaknesses": "- The paper's central narrative is built on the foundational assumption that general academic benchmark performance (MMLU-Pro) is a valid proxy for the highly specific skills of both offensive jailbreaking and robust defense. This assumption is questionable and introduces a potential circularity. The authors first use MMLU-Pro to define the \"capability gap\" axis and then, in Section 6.1, show that ASR correlates strongly with the social-science splits of MMLU-Pro (Figure 6). While this correlation is an interesting finding, using MMLU-Pro as the primary independent variable from the outset presumes it is the correct measure. The skills for jailbreaking, such as creative deception, exploiting logical loopholes, and social engineering, are not directly measured by multiple-choice questions. The paper's own data points to this flaw: it dismisses the \"early Llama models (Llama2 and Llama3-8b)\" as \"outliers\" (Figure 3) because their robustness is higher than their MMLU-Pro score would predict. These are not mere outliers; they are significant counter-examples suggesting that MMLU-Pro is an incomplete, and at times incorrect, proxy for defensive capability, and that specific safety alignment procedures can break the proposed scaling relationship.\n\n- The paper presents the \"unlocking\" procedure as a clean removal of safety alignment to reveal a model's intrinsic attacking ability. However, the methodology of fine-tuning on harmful datasets like \"BadLlama\" and \"Shadow Alignment\" does not simply revert a model to a neutral base state; it actively trains it to become proficient at generating harmful content in a particular style. This introduces a critical confounder: the experiment may be selecting for models that are better at adapting to this specific fine-tuning task rather than measuring a general, latent \"attacking capability.\" This is evidenced by the authors' own observation of an \"unwanted unlocking artifact\" where models \"overfit to harmful content in the red-teaming prompt\". While mitigated with instruction-following data, this core issue remains. The \"unlocked models\" are fundamentally different from the original ones, meaning the capability scores on the x-axis of Figures 3 and 4 belong to a different model than the one whose attacking performance is being plotted, undermining the directness of the claimed relationship.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "PAtdzKv4dO", "reviewer": "Reviewer_p1Bo", "summary": "This paper investigates automatic red-teaming, in particular what happens if you vary the strength of the attacked and attacker models. The findings show that the strength of the attacker plays a central role in being able to successfully red-team a model. The paper analyzes this from a perspective of MMLU performance of the two models and identifies that the attack success probability follows mildly predictable trends.", "questions": "n/a", "limitations": "", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 2, "strengths": "- I really like the research direction and the work presented in the paper is extensive and comprehensive\n- The experiments and approach are innovative with interesting insights which spark many potential ideas for future followups", "weaknesses": "- **Scaling Law Misdirection**: My main point of critique is that the paper trying to turn things into a scaling law that really shouldn’t be one. In a way, the notion of there being “scaling laws” is detracting from a lot of the valuable insights this paper is providing. Many curves seem very forced (e.g., in Fig 4) and just drawn through a cloud. I am pretty sure even a linear fit would achieve a similar R^2. There are many parts where correlations are presented as causations, and as discussed in the next point, the experiment rely on a few critical assumptions that may not generalize. As such, I would strongly recommend toning down the \"scaling law\" claims in this paper. \n\n- **Critical Assumptions**: The paper explores relationships of attacks between one benchmark (MMLU-Pro) and one notion of harmfulness (HarmBench). As such, any claims need to be framed within those terms. By no means are the results generalizable scaling laws. Moreover, since the Llama 2 system prompt is used throughout many of the experiment, it further biases the results since not all models were optimized for this prompt. \n\n- **Explanations are missing**: There are many experiments explaining what is happening, but not many that try to uncover underlying mechanisms at hand. As a result, the results are not immediately actionable other than taking away the advice to \"use the best possible model as attacker\" which seems rather obvious. \n\n- **Alternative result interpretation**: It could be the case that models with stronger MMLU results also had more safety tuning since they tend to have larger teams behind them. As a result, the key result could just measure the correlation between the post-training effort put into safety and NLU benchmarks. \n\n- **6.1 seems contrived**. While there are correlations between the various MMLU sub-categories, there are a myriad of alternative explanations (e.g., that large models are overfit to STEM categories because of a focus on IMO-style problems). The sections thus also conflates correlation and causation. Moreover, the section has a massive overclaim. Good results in multiple choice tests should absolutely not be categorized as “might rely on psychological insights and persuasiveness” as the authors suggest. \n\nMinor:\n- Don’t use white-box vs black-box. These terms have racist connotations. \n- The related work section is extremely disappointing. Research existed for longer than 2024.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "j0cOxdi5Bf", "reviewer": "Reviewer_7ibG", "summary": "Summary  \nThe paper tries to create a Scaling law for Jailbreaking of models. It's setup is based off of an harmfully fine-tuned attacker and judge, where the attacker jailbreaks a defender and the judge evaluates success or failure.  They rank the models capabilities based off of their MMLU-Pro scores and then analyze different pairings along with capability vs jailbreak attempts at N attempts and many other combinations.", "questions": "Notes  \n- Figure 4\nIt seems as though the regression was messed up or inaccurately plotted on the llama family data", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "Pros  \n- Semi-comprehensive testing to try to figure out if there's a scaling law for jailbreaking\n- Useful for forecasting", "weaknesses": "Cons  \n- It doesn't seem to highlight limitation that \"jailbreaks\" might evolve or change forms (imo) namely we might care about different jailbreaks or different sensitive topics in the future.\n- I couldn't find if there was a manual QA somewhere. The setup is LLM judges if LLM attacker can jailbreak defender but I'm unsure of false positives or false negatives in this setup.\n- The \"what makes a good attacker\" might be heavily mis-representing the \"truth\" as models scale they might tend to do better asymetrically on \"easier\" subjects or questions (like psychology).  This might just be another scaling law plot in disguise. I'd like to see the variance of improved overall performance or the increased compute time variance removed to actually be able to say that humanities capabilities matter more than STEM.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "YqQgpNFtRT", "reviewer": "Reviewer_s6fQ", "summary": "This paper investigates how the capability gap between attacker and target language models affects automated jailbreaking success. The central contribution is the discovery of a capability-based scaling law: jailbreaking success (ASR) scales linearly with the capability gap in logit space, with high predictive power across most tested models. The authors demonstrate that this relationship holds across different attack methods (PAIR and Crescendo), though stronger attacks shift the difficulty curve without changing the fundamental slope. The paper also reveals that social science abilities correlate more strongly with jailbreaking effectiveness than STEM capabilities. Additionally, the paper provides methodological insights showing that judge capability affects only prompt selection rather than generation quality, validating cost-saving approaches for red-teaming. Using the discovered scaling law, the authors forecast that human red-teaming will lose effectiveness once models surpass human-level capability.", "questions": "Figure 3 (right) appears to show Qwen2.5 models with similar vulnerability across different MMLU-Pro scores, while Figure 4 (bottom left) demonstrates a clear capability-based scaling law for the same family. Can the authors clarify this apparent discrepancy?", "limitations": "", "rating": 4, "confidence": 3, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "- **Comprehensive empirical evaluation at scale.** The paper tests 22 attacker models against 27 target models across 50 harmful behaviors using two attack methods.\n\n- **Clear quantitative scaling relationship.** The central finding that capability gap predicts attack success with high correlation provides a simple, predictive framework that works well for the majority of tested models.\n\n- **Novel insight about psychological capabilities.** Section 6.1's finding that social science abilities (psychology, philosophy) correlate more strongly with jailbreaking success than STEM capabilities is novel.\n\n- **Transparent treatment of outliers.** Rather than obscuring models that don't fit, the paper explicitly identifies outliers (Llama2 family, Llama3-8B) and acknowledges that heavy safety tuning can decouple defensive capability from general capability.\n\n- **Attack method comparison reveals fundamental invariants.** Section 6.3 shows that different attack methods shift the difficulty curve but preserve the underlying slope, suggesting the scaling relationship reflects fundamental attacker-target dynamics rather than method-specific artifacts.", "weaknesses": "The paper acknowledges that 'heavy safety tuning can extend a system's lifespan against stronger attackers', but the framework doesn't incorporate this insight systematically. The scaling law works well for models with no or weak safety alignment, but fails for models with 'exceptional' alignment (Llama2 family, Llama3-8B). This suggests safety alignment strength is an important independent variable that deserves explicit treatment rather than being absorbed into per-family baselines or outlier exclusion. The paper also provides no per-target or per-family scaling curves for frontier models (Claude, GPT, Gemini), which makes it impossible to assess whether heavily-aligned frontier models follow the observed pattern or represent 'exceptional' cases that the framework cannot capture. For forecasting purposes, the key question becomes: will future models follow the observed pattern (Qwen, Mistral) or the 'exceptional' pattern (Llama2)? The paper's forecast implicitly assumes the former but cannot validate this assumption on current frontier models—the very models whose alignment practices are most likely to inform future frontier development.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)