Abstract
The assessment of jailbreak attacks against large language models currently suffers from inconsistent evaluation criteria and methods, leading to unreliable estimates of attack success rates. We propose JailMeter, an evidence-based evaluation framework designed to more faithfully measure jailbreak effectiveness.
Design of JailMeter
Inspired by the Information Bottleneck theory, JailMeter applies dual-feedback optimization to filter jailbreak noise from model responses while preserving content relevant to the original malicious question. This process produces concise evidence for a rigorous assessment, validating an attack only when the response captures the malicious intent and delivers a complete answer, signaling a substantive bypass of model safety alignment.
Experimental Evaluation
We evaluate JailMeter on JailMeter-Eva, a challenging benchmark containing 330 human-labeled, non-rejected jailbreak instances. JailMeter achieves an accuracy of 97.27%, substantially outperforming existing evaluation methods.
Small Language Model
To support large-scale evaluation, we further distill JailMeter into a small language model, JailMeter_SLM, which maintains comparable reliability with significantly reduced computational costs.
Code and dataset are available at GitHub.
Blogger's Review: The introduction of JailMeter provides a more rigorous and systematic approach to assessing the safety of large language models. Its high accuracy and the design of a small model demonstrate the potential to optimize computational resources while ensuring evaluation reliability. Future research could explore how to enhance its adaptability across diverse attack scenarios.