ArXiv

How Jailbreak Attacks Inform Safety Alignment: A Defender-Centric, Shapley-Based Evaluation of Jailbreak Contributions

2026-07-19 · 09:18 UTC ·Yukai Zhou, Feiyang Lu, Xiaokai Mao... ·1 min read
Authors
Yukai Zhou, Feiyang Lu, Xiaokai Mao...
Categories
cs.CR, cs.CL
arXiv
https://arxiv.org/abs/2607.17152v1
PDF
https://arxiv.org/pdf/2607.17152v1

Brief

Zhou et al. (2026) propose A-MESS, a defender-centric, Shapley-based framework that computes AttackSHAP to attribute marginal utility of individual jailbreak attacks and to select compact red-teaming subsets under budget constraints. Experiments on controlled utility landscapes and real LLM safety settings show ASR poorly predicts safety gains, AttackSHAP is efficiently estimable with few utility queries, and optimized subsets yield larger downstream safety improvements than attacker-centric or attribution-only strategies.

Why it matters

Introduces A-MESS, a setting-agnostic framework that attributes and selects jailbreak attacks using AttackSHAP—a Shapley-based score—and selects compact attack subsets under user-specified budgets via greedy or surrogate-based optimization (Zhou et al., arXiv 2026-07-19).

Key details

  • Finds attacker-centric attack success rate (ASR) rankings are weakly aligned with defender-centric utility; AttackSHAP can be estimated accurately with limited utility queries, and directly optimizing subsets yields stronger safety improvements than ASR-based or attribution-only selection across controlled utility landscapes and real LLM safety settings.
  • Reframes jailbreaks as defensive resources for red-teaming: using A-MESS to pick attacks improves downstream safety training, suggesting evaluations should prioritize defender-centric utility (safety improvement) over raw ASR.
Source evidence

Abstract

Jailbreak attacks on large language models are usually evaluated by attacker-centric metrics such as attack success rate (ASR), yet an attack that breaks a model is not necessarily useful for improving its safety. We propose a defender-centric view of jailbreak evaluation, where attacks are evaluated by the downstream safety improvements they enable when used as red-teaming data for safety training. Building on this view, we introduce A-MESS (Minimal Effective Attack-Subset Selection), a setting-agnostic framework for attributing and selecting jailbreak attacks from black-box subset utility observations. A-MESS estimates AttackSHAP, a Shapley-based score that attributes marginal utility to individual attacks and selects compact attack subsets under user-specified budgets via greedy or surrogate-based optimization. Across controlled utility landscapes and real LLM safety settings, we find that ASR rankings are weakly aligned with defender-centric utility, that AttackSHAP can be estimated accurately with limited utility queries, and that directly optimizing subsets yields stronger safety utility than attacker-centric or attribution-only selection. These results suggest evaluating jailbreak attacks as resources for improving safety, not only as tools for breaking models.