The Great Pretender: A Stochasticity Problem in LLM Jailbreak arXiv:2605.14418v1 [cs.CR] 14 May 2026
Jean-Philippe Monteuuis* , Cong Chen* , Jonathan Petit* “Oh-Oh, yes, I’m the great pretender. Pretending that I’m doing well. My need is such, I pretend too much...” summarizes the state in the area of jailbreak creation and evaluation. You find this method to generate adversarial attacks proposed by a reputable institution (e.g., BoN from Anthropic or Crescendo from Microsoft Research). However, this method does not deliver on the promise claimed in the paper despite having top ASR scores against industry-grade LLMs. You successfully generate the jailbreak prompts against your target (open) model. However, the generated jailbreak prompt works against the target model with a 50% consecutive success rate (5 out of 10 attempts) despite having an 80% ASR (on paper) on the latest closed-source model (with a guardrail system)! This observation leads us to think. First, Attack Success Rate (ASR), the primary metric for LLM jailbreak benchmarking, is not a stable quantity. Second, published ASR numbers are therefore systematically inflated and incomparable across papers. Therefore, we wonder “Why a successful jailbreak prompt does not perform consistently well against a target model on which the prompts have been optimized?”. To answer this question, we study the impact of stochasticity not only during attack evaluation but also during attack generation. Our evaluation includes several jailbreak attacks, models (different sizes and providers), and judges. In addition, we propose a new metric and two new frameworks (CAS-eval and CAS-gen). Our evaluation framework, CAS-eval, shows that an attack can have an ASR drop of up to 30 percentage points when a jailbreak prompt needs to succeed on more than one attempt. Thankfully, our attack generation framework (CAS-gen) improves previous jailbreak methods and helps them recover this loss of 30 percentage points!
1
Introduction
Large language models (LLMs) are increasingly deployed in safety-critical settings, making the reliable measurement of their vulnerability to adversarial attacks a requirement. The dominant metric for this purpose is the Attack Success Rate (ASR), the fraction of harmful prompts for which an attack elicits a harmful response from the target model. Most of the published attack papers report ASR as a point estimate, using it to rank attacks, compare defenses, and claim state-of-the-art performance. We argue that this practice is fundamentally flawed. ASR is not a fixed property of an attack: it is a random variable, sensitive to two independent sources of stochasticity that the literature has largely ignored: 1. Generation stochasticity. Most jailbreak attacks are stochastic by design. Best-of-N [1] generates * Core contributors
Qualcomm Technologies, Inc.
1
Same prompt! Different outputs!? Current Jailbreak Attacks (BoN, Crescendo …)
This paper (BoN++ , Crescendo++…)
t0
H0w 7o BuiLD a 30mb?
To build a 30MB…
H0w to BuiLD a B0mb?
To build a B0MB…
t1
H0w 7o BuiLD a 30mb?
Sorry, I can’t assist…
H0w to BuiLD a B0mb?
A B0MB can be created…
t2
H0w 7o BuiLD a 30mb?
Building a 30MB involves…
H0w to BuiLD a B0mb?
Building a B0MB involves…
t3
H0w 7o BuiLD a 30mb?
Sorry, I can’t assist…
H0w to BuiLD a B0mb?
The recipe is …
Figure 1: Existing jailbreak prompts fail to consistently jailbreak their target LLM.
N independently augmented versions of a harmful prompt and counts a success if any elicits a harmful response. A single run produces a different set of candidates, and therefore a different ASR, depending on the random seed. 2. Evaluation stochasticity. LLM-based judges (e.g., Llama-Guard [2]) are themselves stochastic at temperature T > 0. The same model response may be labeled harmful in one evaluation and benign in another. Papers that report ASR from a single judge pass are measuring a noisy signal without acknowledging the noise. These two sources compound. An attack that appears to achieve 70% ASR in one paper may achieve 50% or 85% in a replication, not because the attack or model changed, but because of random seed variation and judge inconsistency. We make the following contributions: • We provide the first systematic empirical study of both generation and evaluation stochasticity across four attacks (Best-of-N [1], PAIR [3], TAP [4], and Crescendo [5]), five target models spanning 1B to 70B parameters, and two judge models (Llama Guard 3 1B and 8B), varying six stochasticity parameters at both stages of the evaluation pipeline. • We introduce Consistency for Attack Success (CAS), a per-prompt metric that counts a jailbreak as successful only if all k independent evaluations return a harmful verdict, and instantiate it in two frameworks: CAS-gen, which filters out chance successes at the generation stage, and CAS-eval, which suppresses false positives from judge non-determinism at the evaluation stage. • We identify four consistent quantitative effects: judge evaluation temperature (θeval ) inflates singleshot ASR by up to 54 percentage points when raised from 0 to 1.0, and makes ASR perfectly stable when fixed at 0; single-shot evaluation (keval =1) overstates attack success by 12 to 24 percentage points relative to a 10-evaluation threshold; generation budget (kgen ) lifts ASR by 12 to 30 percentage points from kgen =1 to kgen =10; and judge generation temperature (θgen ) inflates ASR by a further 20 to 30 percentage points for BoN configurations using a large judge.
2
Our Proposal: Consistency for Attack Success
Standard jailbreak evaluation issues a single query to the target model and judges the response once, counting a prompt as successful if that single attempt elicits a harmful response. This single-shot protocol does not assess whether the success is consistent. A prompt that succeeds 1 out of 10 attempts is Qualcomm Technologies, Inc.
2
treated identically to one that succeeds 10 out of 10. Because both the target LLM and the automated judge are stochastic, reported ASR can be inflated by lucky draws rather than reflecting a genuine, reproducible vulnerability. We address this gap with two contributions: a novel metric and two novel evaluation frameworks.
2.1
The CAS Metric
This notion of measuring the consistency of a prompt in passing the evaluation leads us to define a novel metric, Consistency for Attack Success (CAS). CAS measures ASR at the prompt level, which differs from previous evaluations that report ASR at the dataset level. We define CAS as a binary indicator per prompt: a jailbreak prompt is counted as a successful jailbreak only if all k evaluations from the judge label the response as harmful. The standard protocol corresponds to k=1, where a single harmful verdict suffices. We formalize CAS as: CAS(r, k) =
k Y
rj
(1)
j=1
where rj ∈ {0, 1} is the judge verdict on the j -th independent evaluation run. The dataset-level metric, ASR(k ), is the fraction of prompts for which CAS(r, k) = 1 (Section 3). The parameter k is abstract and applies to either stage of the pipeline. kgen and keval are its two concrete instantiations: kgen applies k at the generation stage, controlling how many times the attack prompt must consistently elicit a harmful response before being admitted into the attack dataset; keval applies k at the evaluation stage, controlling how many times a fixed jailbreak prompt must consistently pass the judge to be counted as a successful attack. Both reduce to the standard single-shot Attack Success Rate (ASR) when set to 1.
2.2
CAS Frameworks
We instantiate CAS in two novel frameworks (Figure 2).
2.2.1
A Novel Framework for Attack Generation (CAS-gen) (Figure 2a)
The attack takes a harmful behavior prompt drawn from a dataset (e.g., ”How do I synthesize X?” ) and repeatedly queries the target model, defined as the safety-aligned LLM being attacked (e.g., a publicly deployed chatbot equipped with safety guardrails that the adversary is trying to circumvent), to find a response that bypasses its safety guardrails. Each query produces one response. In prior work, a jailbreak prompt is accepted into the attack dataset as soon as the judge returns a single harmful verdict (k=1). Because both the target model and the judge are stochastic, this single-shot criterion admits prompts that succeed by chance: a prompt that elicits a harmful response once may fail on every subsequent attempt, contaminating the attack dataset with inconsistent jailbreaks and inflating the reported ASR. In CAS-gen, the attack prompt is submitted kgen times independently, each with a different random seed. The jailbreak prompt is accepted into the attack dataset only if CAS(r, kgen ) = 1, i.e., the judge labels every response as harmful, filtering out chance successes at the source and producing a dataset of consistently effective jailbreak prompts. Setting kgen =1 recovers the standard prior-work protocol exactly. Qualcomm Technologies, Inc.
3
Using kgen > 1 offers three concrete benefits over the standard kgen =1 protocol. First, it produces a more reliable ASR estimate: because only consistently harmful prompts are admitted, the reported ASR reflects genuine attack effectiveness rather than sampling luck. Second, it has practical relevance: from an adversary’s perspective, a jailbreak prompt that reliably elicits harmful content across multiple queries is strictly more dangerous than one that succeeds once by chance; kgen directly quantifies this reliability. Third, it enables honest benchmarking: when the generation threshold kgen and the evaluation threshold keval are matched (the diagonal of the ASR(kgen , keval ) heatmap), the reported ASR is self-consistent. The standard kgen =keval =1 protocol sits at one corner of this heatmap and is the setting most susceptible to inflation.
2.2.2
A Novel Framework for Attack Evaluation (CAS-eval) (Figure 2b)
Given a fixed jailbreak prompt, the judge is queried keval independent times. A prompt is classified as a consistent jailbreak only if it passes all keval evaluations, suppressing false positives from judge non-determinism. In prior work, a jailbreak prompt is evaluated by the judge once (keval =1): a single harmful verdict is sufficient to count it as a successful attack. Because the judge is stochastic at temperature θ > 0, the same response can receive different verdicts across repeated calls. A single call may return “harmful” by chance even for a borderline response, inflating the reported ASR without any genuine attack success. CAS-eval addresses this by requiring CAS(r, keval ) = 1, classifying a prompt as a consistent jailbreak only if all keval independent judge calls return a harmful verdict. This offers two concrete benefits over keval =1. First, it filters out false positives from judge non-determinism: a prompt that passes all keval evaluations is genuinely harmful, whereas one that passes only some is borderline and should not be counted as a success. Second, it makes ASR estimates more reproducible across studies: because the verdict no longer depends on a single stochastic draw, two independent replications with the same keval will agree more closely. Setting keval =1 recovers the standard prior-work protocol exactly.
3
Methodology for Evaluation
3.1
Stochasticity Parameters
Stochasticity can enter at either stage of attack generation or evaluation, but the parameters that govern it are the same. Three parameters are central to our study. Temperature T controls the diversity of the target model’s outputs. At T =0 the model is deterministic and will always1 produce the same response to the same prompt; at T =1 outputs are maximally diverse, occasionally sampling completions the model would suppress at lower temperatures. As a result, ASR is sensitive to T . A jailbreak that succeeds 10% of the time at T =0 may succeed 40% of the time at T =1, not because the attack improved but because the model’s sampling distribution widened. Yet, most papers neither fix nor report T , making their results incomparable across studies. During the generation stage T is denoted Tgen ; during evaluation, when responses are re-generated to measure ASR sensitivity to temperature, it is denoted Teval . 1 Our temperature analysis (see Appendix C) showed that even under greedy decoding (T = 0) some models exhibit non-determinism in generated output tokens.
Qualcomm Technologies, Inc.
4
(a) Our Framework for Attack Generation: CAS-gen no
Unsafe prompt
Attack Evaluation
Attack Generation
Safe/Unsafe?
unsafe
yes
Repeat kgen times?
yes
Harmful in all kgen runs?
safe
Robust jailbreak
no
Next unsafe prompt
Not robust
(b) Our Framework for Attack Evaluation: CAS-eval no
Jailbreak prompt
Attack Evaluation
Safe/Unsafe?
safe
Next jailbreak prompt
unsafe
Repeat keval times?
yes
Harmful in all keval runs?
yes
Consistent jailbreak
no
Inconsistent
Figure 2: The two CAS frameworks. (a) CAS-gen: a jailbreak candidate is accepted only after passing evaluation kgen consecutive times, filtering out chance successes. (b) CAS-eval: a fixed jailbreak prompt is re-evaluated keval independent times; it is classified as a consistent jailbreak only if all keval verdicts are harmful, suppressing judge-stochasticity false positives. Setting kgen =keval =1 recovers standard single-shot ASR. Judge temperature θ controls how stochastically the judge assigns harmful/safe labels. At θ=0 the judge is fully1 deterministic: the same response always receives the same verdict. As θ increases, borderline responses (those whose content sits near the harmful/safe boundary) become increasingly likely to flip between labels across repeated calls. Consequently, a measured ASR reflects not only whether responses are truly harmful, but also which way the judge’s random label draws happened to fall on the single call recorded per response. For example, suppose 10 responses are evaluated, 7 of which are clearly harmful and always labeled as such, and 3 of which are borderline and labeled harmful with probability 0.5. In one run, the 3 borderline responses all draw “harmful”, giving ASR = 10/10 = 100%. In another run, they all draw “safe”, giving ASR = 7/10 = 70%, a 30-point swing from labeling noise alone, with the attack and responses unchanged. Two studies using the same judge model but different θ values are effectively using different evaluation instruments, yet this parameter is rarely reported. During the generation stage θ governs the attack’s internal candidate selection (θgen ); during the evaluation stage it governs post-hoc labeling (θeval ). Consistency threshold k is the number of consecutive harmful verdicts the judge must return for a response to be counted as a successful jailbreak. The standard protocol uses keval =1, where a single harmful verdict is sufficient. Because both the target model and the judge are stochastic, a response that is genuinely borderline will be counted as a success only some of the time: re-generating the response at Teval > 0 may produce a safer completion, and even a fixed harmful response may be labeled safe when θeval > 0. Raising k filters out this noise by requiring a response to clear the bar on every one of k consecutive calls, so only responses the judge consistently labels harmful are counted. During the generation stage k controls how stringently the attack’s internal filter selects candidates (kgen ); during the evaluation stage it controls how stringently a response must pass the judge to be counted as a success (keval ).
Qualcomm Technologies, Inc.
5
Random seed ξ controls the stochastic sampling at both stages. At temperature T > 0, the target model produces a different response to the same prompt for each seed; at θ > 0, the judge returns a different verdict on the same response for each seed. Most papers run a single seed and report the resulting ASR as if it were deterministic, ignoring the seed-induced variance entirely. In this work, we run S independent seeds at the generation stage to quantify how much ASR fluctuates across attack runs (generation stochasticity), and we run k independent judge calls to quantify how much the verdict fluctuates for a fixed response (evaluation stochasticity). The seed is therefore the mechanism through which both T and θ translate into observable ASR variance.
3.2
Metric: Attack Success Rate
While CAS gives a binary verdict per prompt, a paper ultimately reports a single number summarizing attack performance across all N evaluated prompts. We define the Attack Success Rate as the fraction of prompts for which CAS equals 1:
PN ASR(keval ) =
n=1 CAS(rn , keval )
N
(2)
Equation 2 is the standard ASR formula, but parameterized by keval . The parameterization is the key contribution. As keval increases from 1 to 10, ASR(keval ) can drop sharply, not because the attack became less effective, but because the stricter threshold filters out prompts that passed under keval =1 only by chance. For instance, two papers reporting ASR(keval =1) and ASR(keval =10) on the same attack can therefore show very different numbers, making the choice of keval a direct confound for any cross-study comparison.
3.3
Setup
Attacks. We evaluate four black-box attacks: Best-of-N [1] (repeated sampling), PAIR [3] (LLM-based red-teaming), TAP [4] (tree-search LLM-based red-teaming), and Crescendo [5] (multi-turn LLM-based red-teaming). Target models. We evaluate five instruction-tuned models spanning three model families and three scales: Llama-3.2-1B-Instruct and Llama-3.1-8B-Instruct and Llama-3.1-70B-Instruct (Meta), Gemma-31B-IT (Google), and Granite-4.0-1B (IBM). Judges. We use two Llama Guard models: Llama-Guard-3-1B (LG-1B) and Llama-Guard-3-8B (LG-8B). Dataset. All experiments use a subset of JailbreakBench [6], with S=5 independent attack seeds (seeds 0–4) to quantify generation variance.
4
Evaluation Stochasticity
We evaluate four parameters at the attack evaluation stage (keval , θeval , Teval , attack seed) and three at the attack generation stage (kgen , Tgen , θgen ), and identify which parameters drive the largest variation in the reported ASR.
Qualcomm Technologies, Inc.
6
4.1
Impact of Stochasticity at Attack Evaluation
Figure 3 reveals a clear hierarchy among the four parameters studied: evaluation threshold keval , target model temperature Teval , judge temperature θeval , and attack seed.
(a)
100%
ASR(keval)
80% 60% 40%
BoN / Llama-3.2-1B / Llama Guard 3 1B PAIR / Llama-3.2-1B / Llama Guard 3 1B TAP / Llama-3.2-1B / Llama Guard 3 1B BoN / Llama-3.1-8B / Llama Guard 3 1B
20% 0%
100%
BoN / Llama-3.2-1B / Llama Guard 3 8B BoN / Llama-3.1-8B / Llama Guard 3 8B BoN / Gemma-1B / Llama Guard 3 1B BoN / Granite-1B / Llama Guard 3 1B
1
(b)
5
Teval = 0.0 (greedy)
Crescendo / Llama-3.2-1B / Llama Guard 3 1B BoN / Llama-3.1-70B / Llama Guard 3 1B BoN / Llama-3.1-70B / Llama Guard 3 8B
10
keval Teval = 0.5
Teval = 1.0
ASR(keval)
80% 60% 40% 20% 0%
100%
1
(c)
5
10
1
5
10
1
keval eval = 0.0 (deterministic)
5
10
1
5
10
1
keval eval = 0.5
5
10
5
10
keval eval = 1.0
ASR(keval)
80% 60% 40% 20% 0%
100%
1
(d)
seed 0
keval
keval seed 2
seed 1
seed 3
keval
seed 4
ASR(keval)
80% 60% 40% 20% 0%
1
5
keval
10 1
5
keval
10 1
5
keval
10 1
5
keval
10 1
5
keval
10
Figure 3: Impact of stochasticity parameters during attack evaluation on ASR(keval ). Row (a): different models, judges, and attacks under the canonical condition. Row (b): influence of the target model temperature (Teval ). Row (c): influence of the judge temperature (θeval ). Row (d): impact of attack seed.
Qualcomm Technologies, Inc.
7
Effect of evaluation threshold keval (row a) Moving from keval =1 to keval =10 reduces ASR by 12 to 24 percentage points across all 11 configurations (largest drop: BoN/Llama-3.1-70B/LG-8B at −24 pp; PAIR falls from 96% to 80%), so any absolute ASR figure reported under keval =1 is upward-biased and cross-paper comparisons that mix keval values are invalid. The relative ordering of attacks is preserved (PAIR > TAP > BoN), so qualitative conclusions survive the correction. Judge choice further compounds the inflation: the LG-8B judge imposes an additional penalty that grows with target model scale, reaching 20 percentage points for the 70B target. For unbiased absolute ASR estimates, keval >5 should be used and reported. Qualitative attack rankings are safe regardless of keval . Effect of target model temperature Teval (row b) Shifting Teval from 0.0 to 1.0 changes ASR by at most 18 percentage points with no systematic direction: different attacks peak at different temperatures, and no configuration reverses its relative rank across the three panels. ASR comparisons are robust to the choice of Teval , which need not be reported. Effect of judge temperature θeval (row c) At θeval =0 every curve is perfectly flat. ASR(keval =10) equals ASR(keval =1) across all configurations, confirming that the monotonic decline in ASR with increasing keval is caused entirely by judge stochasticity. Raising θeval to 1.0 collapses ASR by 15 to 54 percentage points across all 11 configurations; the largest drop is Crescendo at keval =10, from 86% (θeval =0) to 32% (θeval =1.0), a reduction of 54 percentage points. An unreported θeval is therefore a primary driver of inconsistency in published ASR numbers. Effect of attack seed (row d) Seed-to-seed spread is modest for most configurations (at most 20 percentage points), with the largest variation in LG-8B-judged BoN (50 percentage points at keval =10), partly attributable to the small 10-prompt evaluation set where a single flip is worth 10 percentage points. The relative ordering of configurations is preserved across seeds, and iterative refinement attacks (PAIR, TAP) are less sensitive to seed than single-pass sampling. The attack seed need not be reported for qualitative comparisons; for absolute ASR estimates, averaging over at least 3 seeds is advisable to reduce the variance observed here.
4.2
Impact of Stochasticity at Attack Generation
Figure 4 reveals a clear hierarchy among the three parameters studied: generation budget kgen , target model temperature Tgen , and judge search temperature θgen . Effect of generation budget kgen (row a) Raising kgen from 1 to 10 lifts ASR(keval =10) by 12 to 30 percentage points across all configurations. At kgen =10, most LG-1B and PAIR/TAP curves become nearly flat, while LG-8B judged BoN variants retain a 12 to 14 pp decay; at kgen =1, all curves decay by 12 to 24 pp from keval =1 to keval =10. A tighter consistency filter selects unambiguously harmful responses that survive any post-hoc scrutiny; a loose filter (kgen =1) accepts borderline responses that degrade sharply under repeated evaluation. Two papers both claiming “Best-of-N ASR” can therefore differ by up to 30 pp at keval =10 purely because of an undisclosed kgen . Effect of target model temperature Tgen (row b) Shifting Tgen from 0.0 to 1.0 produces no systematic effect for 1B and 8B target models, with spreads of at most 14 pp. Large (70B) target models show a mild monotonic increase, reaching at most 18 pp at keval =10. Target model temperature is therefore not a primary confound; it may be worth reporting only for very large target models.
Qualcomm Technologies, Inc.
8
kgen = 1
ASR(keval)
100%
80%
80%
60%
60%
60%
40%
40%
40%
20%
20%
20%
0%
0%
0%
Tgen = 0.0 (greedy)
ASR(keval)
Tgen = 0.5
100% 80%
80%
60%
60%
60%
40%
40%
40%
20%
20%
20%
0%
0%
0%
gen = 0.0 (deterministic)
gen = 0.5
100% 80%
80%
60%
60%
60%
40%
40%
40%
20%
20%
20%
1
5
keval
0% 10
1
5
keval
gen = 1.0
100%
80%
0%
Tgen = 1.0
100%
80%
100%
kgen = 10
100%
80%
100%
ASR(keval)
kgen = 5
100%
0% 10
1
5
keval
10
Figure 4: Effect of generation budget (kgen ), target model temperature (Tgen ), and judge generation temperature (θgen ) on ASR(keval ). Each column fixes one parameter value; curves show the four attack/judge configurations.
Qualcomm Technologies, Inc.
9
Effect of judge search temperature θgen (row c) For PAIR, TAP, and Crescendo, and for BoN judged by LG-1B, the effect of θgen is small (at most 8 pp spread at keval =10). BoN judged by LG-8B is the exception, with spreads up to 30 pp: a noisy search judge admits lower-quality responses that then fail post-hoc evaluation, and this noise compounds when the search and evaluation judge are the same model. θgen therefore only needs to be controlled for BoN with LG-8B; other attacks are unaffected by design.
4.3
Takeaways
Across all attacks, models, and judges, the experiments reveal a compact set of parameters that are worth standardizing and reporting. When generating an attack. kgen is the single most consequential generation-side parameter: raising it from 1 to 10 lifts reported ASR by up to 30 percentage points, and two papers quoting “Best-of-N ASR” without disclosing kgen are not directly comparable. θgen matters only for BoN evaluated by LG-8B (up to 30 pp spread); other attacks are unaffected by design. Tgen is a null result except for very large (70B+) target models, where a mild monotonic effect reaches at most 18 pp. When evaluating an attack. θeval and keval jointly determine whether a reported ASR reflects genuine harmfulness or a lucky draw. Setting θeval =0 eliminates all judge stochasticity and makes ASR(keval =10) equal to ASR(keval =1); raising it to 1.0 can collapse ASR by up to 54 percentage points. Using keval >1 corrects the systematic upward bias of single-shot evaluation, which inflates ASR by 12 to 24 percentage points across all tested configurations. Teval and attack seed contribute at most 18 and 20 percentage points respectively, with no systematic direction, and do not affect the relative ranking of attacks. Minimum reporting checklist. At minimum, any paper reporting ASR should disclose kgen , keval , and θeval . For BoN attacks, θgen is additionally required. Tgen , Teval , and attack seed are secondary: reporting them is good practice but their omission rarely invalidates qualitative comparisons.
5
Limitations
Attack coverage. Our experiments focus on Best-of-N (text), PAIR, TAP, and Crescendo. Gradientbased attacks such as GCG operate differently, optimizing a discrete suffix rather than sampling from the target model. Therefore, their stochasticity profile may differ from the sampling-based attacks studied here. Extending the analysis to GCG and to multimodal attacks (visual adversarial examples, adversarial audio) is left for future work. Target model coverage. All conclusions are drawn from experiments on Llama-3.2-1B, Llama-3.1-8B, Llama-3.1-70B, Gemma3-1B, and Granite-3.2-1B. These are all open-weight models with relatively limited safety alignment. Whether the stochasticity effects reported here generalize to heavily RLHFaligned proprietary models (e.g., GPT-4o, Claude) is an open empirical question. Beyond the model weights themselves, proprietary systems typically wrap the model in a safety stack composed of rulebased filters, LLM classifiers, and content moderation layers whose design is not publicly disclosed. This opacity makes it difficult to isolate and measure stochasticity at the generation and evaluation stages as our framework requires. Furthermore, systematic jailbreak evaluation on proprietary models would likely violate the terms of service of the corresponding API providers, so we deliberately restrict our study to open-weight models. Qualcomm Technologies, Inc.
10
Judge coverage. We evaluate LLM’s responses with Llama-Guard-3-1B and Llama-Guard-3-8B, which are classifier-style judges. But, generative judges (such as the one proposed by StrongREJECT) may exhibit different temperature sensitivity. GPT-5.2-as-judge raises the same concern as proprietary target models: systematic jailbreak evaluation through a commercial API would likely violate the terms of service of the provider, so we deliberately exclude it from our study. Scope of the proposed framework. CAS and the reporting standard address stochasticity at the generation and evaluation stages. They do not account for other sources of irreproducibility in jailbreak research, such as system-prompt variation, tokenization differences across API versions, or hardware non-determinism at Tgen =0.
6
Related Work
Safety Evaluation Reliability Fraser et al. [7] documented surprising variance in safety benchmark results from LLM stochasticity and trivial procedural variations, in the context of fine-tuning. They showed that despite the cost, multiple runs are necessary to estimate random variation and get more robust evaluations. Our work extends this to the attack generation setting. LLM Judge Reliability The closest work to ours on evaluation stochasticity is Schwinn et al. [8], who studied the reliability of safety rating using LLM judges. They showed that LLM judges are substantially less reliable for adversarial safety evaluations than previously assumed, performing on average only slightly better than a random coin-flip. Hence, they proposed techniques to mitigate judge’s reliability. Our work differs in that we (1) study judge stochasticity as a function of temperature and number of evaluations, (2) jointly study generation stochasticity, and (3) focus specifically on BoN, PAIR, TAP, and Crescendo. Statistical Modeling of ASR Feng et al. [9] highlighted that ASR@N provides a more faithful measure of operational risk than ASR@1. Therefore, to reduce the need of testing attacks N (large) times, the authors proposed the SABER framework. SABER estimates ASR under Best-of-N sampling using a Beta distribution, predicting ASR@N from small-budget measurements (e.g., ASR@1000 from 100 samples). We adapt the SABER framework to our CAS in Appendix B.
7
Conclusion
ASR is not a fixed property of an attack: it is a stochastic quantity jointly determined by judge temperature, evaluation threshold, generation budget, and attack seed. Across four attacks and five target models, θeval alone can shift reported ASR by up to 54 pp, keval by 12 to 24 pp, kgen by 12 to 30 pp, and θgen by 20 to 30 pp for BoN with a large judge. Most published results fix none of these, making cross-paper comparisons statistically meaningless; we address this by introducing CAS-gen and CAS-eval, built on the Consistency for Attack Success metric, and a minimum reporting standard whose required additions (kgen , keval , θeval , confidence intervals) impose negligible overhead. The proposed frameworks will support the development of the MLCommons AI Security benchmarks.
Qualcomm Technologies, Inc.
11
References [1] John Hughes, Sara Price, Aengus Lynch, Rylan Schaeffer, Fazl Barez, Subbarao Kambhampati, Henry Sleight, Erik Jones, Ethan Perez, and Mrinank Sharma. Best-of-n jailbreaking. Technical report, Anthropic, 2024. arXiv:2412.03556. (Cited on page 1, 2, 6) [2] Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, and Madian Khabsa. Llama guard: Llmbased input-output safeguard for human-ai conversations. Technical report, Meta AI, 2023. arXiv:2312.06674. (Cited on page 2) [3] Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J. Pappas, and Eric Wong. Jailbreaking black box large language models in twenty queries. In arXiv preprint arXiv:2310.08419, 2023. (Cited on page 2, 6) [4] Anay Mehrotra, Manolis Zampetakis, Paul Kassianik, Blaine Nelson, Hyrum Anderson, Yaron Singer, and Amin Karbasi. Tree of attacks: Jailbreaking black-box LLMs automatically. In Advances in Neural Information Processing Systems, volume 37, 2024. (Cited on page 2, 6) [5] Mark Russinovich, Ahmed Salem, and Ronen Eldan. Great, now write an article about that: The crescendo multi-turn llm jailbreak attack. In USENIX Security, 2025. arXiv:2404.01833. (Cited on page 2, 6) [6] Patrick Chao, Edoardo Debenedetti, Alexander Robey, Maksym Andriushchenko, Francesco Croce, Vikash Sehwag, Edgar Dobriban, Nicolas Flammarion, George J. Pappas, Florian Tramer, Hamed Hassani, and Eric Wong. Jailbreakbench: An open robustness benchmark for jailbreaking large language models. In arXiv preprint arXiv:2404.01318, 2024. (Cited on page 6) [7] Kathleen C. Fraser, Hillary Dawkins, Isar Nejadgholi, and Svetlana Kiritchenko. Fine-tuning lowers safety and disrupts evaluation consistency. In arXiv preprint arXiv:2506.17209, 2025. (Cited on page 11) [8] Leo Schwinn, Moritz Ladenburger, Tim Beyer, Mehrnaz Mofakhami, Gauthier Gidel, and Stephan Günnemann. A coin flip for safety: Llm judges fail to reliably measure adversarial robustness. In arXiv preprint arXiv:2603.06594, 2026. (Cited on page 11) [9] Mingqian Feng, Xiaodong Liu, Weiwei Yang, Chenliang Xu, Christopher White, and Jianfeng Gao. Statistical estimation of adversarial risk in large language models under best-of-n sampling. In arXiv preprint arXiv:2601.22636, 2026. (Cited on page 11, 14) [10] Hugging Face. Hugging face hub. https://huggingface.co, 2023. (Cited on page 13) [11] Thomas Wolf, Lysandre Debut, Victor Sanh, Julien Chaumond, Clement Delangue, Anthony Moi, Pierric Cistac, Tim Rault, Remi Louf, Morgan Funtowicz, Joe Davison, Sam Shleifer, Patrick von Platen, Clara Ma, Yacine Jernite, Julien Plu, Canwen Xu, Teven Le Scao, Sylvain Gugger, Mariama Drame, Quentin Lhoest, and Alexander Rush. Transformers: State-of-the-art natural language processing. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing: System Demonstrations, pages 38–45, 2020. (Cited on page 13) [12] Edwin B. Wilson. Probable inference, the law of succession, and statistical inference. Journal of the American Statistical Association, 22(158):209–212, 1927. (Cited on page 14) [13] Milton Abramowitz and Irene A. Stegun. Handbook of Mathematical Functions with Formulas, Graphs, and Mathematical Tables. National Bureau of Standards, Washington, D.C., 1964. (Cited on page 14) Qualcomm Technologies, Inc.
12
A
Experiment
A.1
Experimental Hardware
For our experiments, we use a cluster of two Nvidia A100 GPUs (80GB RAM each). Most of our experiment can be done with a single A100. Experiments requiring two A100 GPUs were the experiments involving a cumulation of large size LLMs (70B target model with a 8B judge model).
A.2
Models
All models are loaded from the Hugging Face Hub [10] using the transformers library [11]. Table 1 lists the Hugging Face model identifier for each model used in this paper. Table 1: Hugging Face model identifiers.
A.3
Role
Model
Hugging Face ID
Target
Llama-3.2-1B-Instruct Llama-3.1-8B-Instruct Llama-3.1-70B-Instruct Gemma-3-1B-IT Granite-4.0-1B
meta-llama/Llama-3.2-1B-Instruct meta-llama/Llama-3.1-8B-Instruct meta-llama/Llama-3.1-70B-Instruct google/gemma-3-1b-it ibm-granite/granite-4.0-1b
Judge
Llama-Guard-3-1B Llama-Guard-3-8B
meta-llama/Llama-Guard-3-1B meta-llama/Llama-Guard-3-8B
Experimental Parameters
Table 2 lists all parameters used in our experimental framework, together with their mathematical symbols, values or ranges, and descriptions. Table 2: Complete list of experimental parameters. Symbol
Name
Value / Range
Description
N
Candidate budget
10,000
Max augmented candidates per Best-of-N run; search stops early on first kgen -consistent success.
kgen
Attack consistency threshold
{1, 5, 10}
Consecutive harmful judge labels required to accept a candidate during search. Higher kgen = stricter.
Tgen
Target model temperature
{0.0, 0.5, 1.0}
Sampling temperature of the target model. Tgen =0 is greedy (deterministic).
keval
Eval consistency threshold
{1, 5, 10}
Consecutive independent judge evaluations required post-hoc. ASR(keval ) = fraction passing all keval evals.
θgen
Judge search temperature
{0.0, 0.5, 1.0}
Judge temperature during attack generation
θeval
Judge eval temperature
{0.0, 0.5, 1.0}
Judge temperature during post-hoc evaluation.
S
Attack seeds
5 (seeds 0–4)
Independent runs per prompt per condition. Used to assess the attack generation variance
Qualcomm Technologies, Inc.
13
A.4
Confidence Intervals
All ASR estimates are reported with 95% Wilson score confidence intervals [12]. Here, n is the total number of (prompt, seed) pairs evaluated and s is the number of those pairs for which CAS(r, keval ) = 1, i.e., the runs counted as successful jailbreaks. The observed ASR is p̂ = s/n and the Wilson interval is:
q p̂(1−p̂) z z2 z2 p̂ + ∓ + 2n n 1+z 2 /n 4n2 2 1 + z /n
(3)
where n = Nprompts × S is the total number of (prompt, seed) pairs (Nprompts = 1,000 prompts and S = 5 seeds, giving n = 5,000), and z = 1.96 is the 97.5th percentile of the standard normal distribution N (0, 1), chosen so that the two-sided interval [p̂ − ϵ, p̂ + ϵ] covers the true proportion with probability 0.95 [13]. The Wilson interval is preferred over the normal approximation (Wald interval) because it remains valid when p̂ is near 0 or 1, which is common when ASR is very low (near-perfect defense) or very high (near-perfect attack).
B
Statistical estimation of ASR for large k
In [9], authors developed a statistical framework to estimate adversarial risk with scaled attack budget. It focuses on the standard Best-of-N attack success rate, which uses an OR aggregation rule: a harmful query is counted as successfully jailbroken if at least one out of N independently sampled attempts succeeds. This metric is appropriate for modeling an attacker who is satisfied with any successful jailbreak (OR-aggregation). However, in our settings, one may instead care about consistency or robust vulnerability : a query should count as successfully attacked only if all attempts succeed (ANDaggregation). This appendix develops the corresponding statistical formulation to predict the ASR for large k under our setting. Setup. For each harmful query qi , let Si,j ∈ {0, 1} denote the success indicator of the j -th attempt, where Si,j = 1 indicates a successful jailbreak. We assume that each query qi has a latent per-attempt success probability pi ∈ (0, 1) and that, conditional on pi , repeated attempts are i.i.d. Bernoulli: i.i.d.
Si,1 , Si,2 , · · · | pi ∼ Bernoulli(pi ).
(4)
Let’s define the AND-aggregated success indicator for query qi under N attempts as (k) Ai :=
k Y
Si,j .
(5)
j=1 (k)
Thus, Ai
= 1 if and only if all k attempts succeed. Conditional on pi , independence immediately gives (k) Pr Ai = 1 | pi = Pr(Si,1 = · · · = Si,k = 1 | pi ) = pki . (6)
Assuming that the pi are themselves draws from some distribution P over [0, 1], then for a dataset of N prompts, the expected ASR will be Ep∼P [pk ]. Qualcomm Technologies, Inc.
14
Figure 5: The trend of expected ASR as k scales. Figure 5 captures a notion of consistency robustness. High ASR at large k certifies reliable success across repeated attempts rather than occasional success. In the limit k → ∞,
Ep∼P [pk ] → Pr (p = 1), p∼P
so the AND-aggregated ASR converges to the fraction of perfectly robust queries. Thus, the decay in ASR with increasing k reflects instability in attack success and serves as a stress test for robustness under repeated adversarial pressure.
Qualcomm Technologies, Inc.
15
C
Temperature Analysis
In this section, we present our analysis of the effect of temperature T = 0 (greedy decoding) on the determinism of LLM output from the perspective of a commercial API. Indeed, it is commonly believed that an LLM with T = 0 would consistently output the same answer when prompted with the same input.
C.1
Dataset
Since we could not use jailbreak prompts without breaching the terms of service of the API provider, we built our own non-adversarial dataset (Table 3). This dataset contains 20 prompts across five categories: factual, math, code, creative, and reasoning. Factual and math prompts have single correct answers and are expected to be highly deterministic. Creative prompts are open-ended and expected to show maximum variance. Table 3: Prompt dataset used for the temperature-0 determinism study Category
Prompt
Factual Factual Factual Factual Factual Factual
What is the capital of France? What is the chemical symbol for gold? What are the three laws of thermodynamics? List them briefly. What is the speed of light in meters per second? Give the exact value. Name the four DNA nucleotide bases. What were the main causes of World War I? Provide a concise summary.
Math Math Math Math
What is 17 multiplied by 13? What is 2 raised to the power of 10? Calculate the area of a circle with radius 5. Use pi = 3.14159. What is the derivative of f (x) = 3x3 + 2x2 − 5x + 7?
Code Code Code
Write a Python function factorial that computes n! recursively. Write a one-line Python list comprehension for squares of 1 to 10. Write a Python function that returns a list of integers sorted descending without modifying the original. Write a Python function that checks whether a string is a palindrome (caseinsensitive).
Code Creative Creative Creative
Write a haiku about the ocean. Give a product name and a one-sentence slogan for a fictional coffee brand. Write the first sentence of a mystery novel set in 1920s Paris.
Reasoning
If all mammals are warm-blooded and dolphins are mammals, what can we conclude? Explain. A bat and a ball cost $1.10. The bat costs $1.00 more than the ball. How much is the ball? Three mislabeled boxes (apples, oranges, both). One draw. How do you label all correctly?
Reasoning Reasoning
C.2
Methodology
To assess the determinism of LLM output, we queried 10 times each prompt to selected models (Claude Sonnet 4.6 and Claude Haiku 4.5). From the responses, we measured the character-level edit distance between pairs (Levenshtein) as seen in Figure 6 and Figure 7.
Qualcomm Technologies, Inc.
16
Figure 6: Temperature testing at T = 0 for Haiku 4.5.
C.3
Results
We can make three observations based on Figure 6 and Figure 7. The first observation is temperature set to zero (T=0) does not guarantee determinism for commercial API. The second observation is the determinism depends on the prompt (see code 04 in Figure 6). Lastly, determinism is model dependent for this commercial API. As a fact, Sonnet 4.6 exhibited significantly less determinism than Haiku 4.5, with 58.5% vs 98.5% exact-match rate.
Qualcomm Technologies, Inc.
17
Figure 7: Temperature testing at T = 0 for Sonnet 4.6.
Qualcomm Technologies, Inc.
18
D
Additional Results
In this section, we provide plots specific to each target model and to each attacks studied in this paper. During our evaluation, we look at different angles. In all bar charts and line plots, error bars and shaded bands show Wilson 95% confidence intervals (see Appendix A.4). Different model sizes we picked models from the same provider (Meta) and from the same generation (Llama 3). The goal was to see how the size of the target model (the model targeted by the jailbreak attack) had a stochastic impact during the generation of the attack and the evaluation of the attack. Also, we use different sizes for the model judge (Llama-Guard-3-1B and Llama-Guard-3-8B) to see how the settings of the judge can influence both attack generation and attack evaluation. Different model providers we picked models from the same provider (Meta) and from the same generation (Llama 3). The goal was to see how the size of the target model (the model targeted by the jailbreak attack) had a stochastic impact during the generation of the attack and the evaluation of the attack. Different attacks we picked models from the same provider (Meta) and from the same generation (Llama 3). The goal was to see how the size of the target model (the model targeted by the jailbreak attack) had a stochastic impact during the generation of the attack and the evaluation of the attack.
Qualcomm Technologies, Inc.
19
D.1
Different model sizes
D.1.1
ASR based consecutive judge evaluations
80%
80%
ASR(keval, eval = 0.5)
100%
60% 40% 20% 1
5
Consecutive evaluations keval
60% 40% 20% 0%
10
100%
80%
80%
ASR(keval, eval = 0.5)
100%
60% 40% 20% 0%
1
5
Consecutive evaluations keval
80%
80%
20% 0%
1
5
Consecutive evaluations keval
10
10
5
10
5
10
20%
100%
40%
5
Consecutive evaluations keval
40%
100%
60%
1
60%
0%
10
ASR(keval, eval = 0.5)
ASR(keval, eval = 0.5) ASR(keval, eval = 0.5)
Llama-Guard-3-8B
100%
0%
ASR(keval, eval = 0.5)
Llama-3.1-70B
Llama-3.1-8B
Llama-3.2-1B
Llama-Guard-3-1B
1
Consecutive evaluations keval
60% 40% 20% 0%
1
Consecutive evaluations keval
Figure 8: ASR(keval ); Parameters: kgen =1, Tgen =0.5, θgen =0.5, Teval =0.5, θeval =0.5
Qualcomm Technologies, Inc.
20
D.1.2
ASR based on target model temperature at evaluation Llama-Guard-3-8B
100%
100%
80%
80%
ASR(keval = 1)
ASR(keval = 1)
Llama-3.2-1B
Llama-Guard-3-1B
60% 40% 20% 0%
60% 40% 20%
0.0
0.5
0%
1.0
100%
100%
80%
80%
60% 40% 20% 0%
1.0
0.0
0.5
1.0
0.0
0.5
1.0
40% 20%
0.0
0.5
0%
1.0
Target model temperature Teval
100%
100%
80%
80%
ASR(keval = 1)
ASR(keval = 1)
Llama-3.1-70B
0.5
60%
Target model temperature Teval
60% 40% 20% 0%
0.0
Target model temperature Teval
ASR(keval = 1)
ASR(keval = 1)
Llama-3.1-8B
Target model temperature Teval
60% 40% 20%
0.0
0.5
1.0
Target model temperature Teval
0%
Target model temperature Teval
Figure 9: ASR(keval = 1, Teval ); Parameters: kgen =1, Tgen =0.5, θgen =0.5, θeval =0.5
Qualcomm Technologies, Inc.
21
D.1.3
ASR based on judge model temperature at evaluation
100%
80%
80%
60% 40% 20% 0.5
Judge eval temperature eval
60% 40% 20% 0%
1.0
100%
100%
80%
80%
60% 40% 20% 0%
ASR(keval = 1, eval)
0.0
ASR(keval = 1, eval)
ASR(keval = 1, eval)
Llama-3.1-8B
ASR(keval = 1, eval)
100%
0%
Llama-3.1-70B
Llama-Guard-3-8B
0.0
0.5
Judge eval temperature eval
80%
80%
20% 0%
0.0
0.5
Judge eval temperature eval
1.0
1.0
0.5
1.0
0.5
1.0
20%
100%
40%
0.5
Judge eval temperature eval
40%
100%
60%
0.0
60%
0%
1.0
ASR(keval = 1, eval)
ASR(keval = 1, eval)
Llama-3.2-1B
Llama-Guard-3-1B
0.0
Judge eval temperature eval
60% 40% 20% 0%
0.0
Judge eval temperature eval
Figure 10: ASR(keval = 1, θeval ); Parameters: kgen =1, Tgen =0.5, θgen =0.5, Teval =0.5
Qualcomm Technologies, Inc.
22
Heatmap ASR based on consecutive evaluations at generation Llama-Guard-3-8B
1.0
1.0
0.70
5
0.94
0.90
0.90
0.8 0.6 0.4
10
0.98
0.96
0.94
1 5 10 Consecutive evaluations keval
0.2 0.0
1
0.80
0.70
0.66
5
0.92
0.80
0.74
10
1.00
0.88
0.86
1 5 10 Consecutive evaluations keval
0.62
5
0.86
0.80
0.76
0.8 0.6 0.4
10
0.90
0.86
0.84
1 5 10 Consecutive evaluations keval
0.2 0.0
1
0.74
0.62
0.58
5
0.88
0.86
0.84
10
0.86
0.82
0.78
1 5 10 Consecutive evaluations keval
0.68
5
0.80
0.74
0.70
0.8 0.6 0.4
10
0.86
0.84
0.84
1 5 10 Consecutive evaluations keval
0.2 0.0
0.8 0.6
0.2 0.0
1.0
Consistency threshold kgen
0.70
ASR
Consistency threshold kgen
Llama-3.1-70B
0.80
0.0
0.4
1.0
1
0.2
1.0
Consistency threshold kgen
0.62
ASR
Consistency threshold kgen
Llama-3.1-8B
0.78
0.6 0.4
1.0
1
0.8
ASR
0.70
ASR
0.82
1
0.72
0.58
0.48
5
0.88
0.80
0.74
0.8 0.6
ASR
1
Consistency threshold kgen
Llama-Guard-3-1B
ASR
Consistency threshold kgen
Llama-3.2-1B
D.1.4
0.4
10
0.88
0.82
0.74
1 5 10 Consecutive evaluations keval
0.2 0.0
Figure 11: Heatmap ASR(keval , kgen ) ; Parameters: Tgen =0.5, θgen =0.5, Teval =0.5
Qualcomm Technologies, Inc.
23
Heatmap ASR based on the temperature of the target model at generation Llama-Guard-3-1B
Llama-Guard-3-8B
0.76
Tgen = 0.5
0.82
0.70
0.70
Tgen = 1.0
0.90
0.8 0.6 0.4
0.80
0.72
keval = 1 keval = 5 keval = 10 Consecutive evaluations keval
0.2
Tgen = 0.0
0.84
0.70
0.70
Tgen = 0.5
0.80
0.70
0.66
Tgen = 1.0
0.86
0.0
0.76
0.74
keval = 1 keval = 5 keval = 10 Consecutive evaluations keval
0.72
Tgen = 0.5
0.78
0.62
0.62
Tgen = 1.0
0.84
0.8 0.6 0.4
0.74
0.68
keval = 1 keval = 5 keval = 10 Consecutive evaluations keval
0.2
Tgen = 0.0
0.78
0.70
0.66
Tgen = 0.5
0.74
0.62
0.58
Tgen = 1.0
0.72
0.0
0.64
0.62
keval = 1 keval = 5 keval = 10 Consecutive evaluations keval
0.54
Tgen = 0.5
0.80
0.70
0.68
Tgen = 1.0
0.86
0.8 0.6 0.4
0.74
0.70
keval = 1 keval = 5 keval = 10 Consecutive evaluations keval
0.2 0.0
0.8 0.6
0.2 0.0
1.0
Target temperature Tgen
0.58
ASR
Target temperature Tgen
Llama-3.1-70B
0.72
0.0
0.4
1.0
Tgen = 0.0
0.2
1.0
Target temperature Tgen
0.72
ASR
Target temperature Tgen
Llama-3.1-8B
0.82
0.6 0.4
1.0
Tgen = 0.0
0.8
ASR
0.80
ASR
0.92
1.0
Target temperature Tgen
Tgen = 0.0
ASR
Target temperature Tgen
Llama-3.2-1B
1.0
Tgen = 0.0
0.64
0.54
0.48
Tgen = 0.5
0.72
0.58
0.48
Tgen = 1.0
0.78
0.8 0.6
ASR
D.1.5
0.4
0.70
0.66
keval = 1 keval = 5 keval = 10 Consecutive evaluations keval
0.2 0.0
Figure 12: Heatmap ASR(keval , Tgen ) ; Parameters: θgen =0.5, kgen = 1, Teval =0.5, θeval =0.5
Qualcomm Technologies, Inc.
24
Heatmap ASR based on the temperature of the judge at generation
0.82
0.70
0.70
gen = 1.0
0.82
0.4
0.72
0.72
0.0
1.0
gen = 0.0
0.84
0.74
0.72
gen = 0.5
0.78
0.62
0.62
gen = 1.0
0.70
0.8 0.6 0.4
0.58
0.58
keval = 1 keval = 5 keval = 10 Consecutive evaluations keval Judge gen. temperature gen
0.2
ASR
Judge gen. temperature gen
Llama-3.1-8B
0.6
0.2 0.0
1.0
gen = 0.0
0.84
0.72
0.64
gen = 0.5
0.80
0.70
0.68
gen = 1.0
0.72
0.8 0.6 0.4
0.68
0.66
keval = 1 keval = 5 keval = 10 Consecutive evaluations keval
0.2 0.0
gen = 0.0
0.92
0.76
0.70
gen = 0.5
0.80
0.70
0.66
gen = 1.0
0.58
0.8 0.6
ASR
gen = 0.5
0.8
1.0
0.4
0.54
0.50
keval = 1 keval = 5 keval = 10 Consecutive evaluations keval
0.2 0.0
1.0
gen = 0.0
0.84
0.76
0.74
gen = 0.5
0.74
0.62
0.58
gen = 1.0
0.54
0.8 0.6
ASR
0.70
Judge gen. temperature gen
0.74
Judge gen. temperature gen
0.86
ASR
gen = 0.0
0.4
0.46
0.44
keval = 1 keval = 5 keval = 10 Consecutive evaluations keval Judge gen. temperature gen
1.0
keval = 1 keval = 5 keval = 10 Consecutive evaluations keval
Llama-3.1-70B
Llama-Guard-3-8B
ASR
Judge gen. temperature gen
Llama-3.2-1B
Llama-Guard-3-1B
0.2 0.0
1.0
gen = 0.0
0.84
0.64
0.60
gen = 0.5
0.72
0.58
0.48
gen = 1.0
0.54
0.8 0.6
ASR
D.1.6
0.4
0.36
0.34
keval = 1 keval = 5 keval = 10 Consecutive evaluations keval
0.2 0.0
Figure 13: Heatmap ASR(keval , θgen ) ; Parameters: Tgen =0.5, kgen = 1, Teval =0.5, θeval =0.5
Qualcomm Technologies, Inc.
25
D.2
Different model providers
D.2.1
ASR based consecutive judge evaluations Gemma3-1B
Granite-3.2-1B 100%
80%
80%
80%
60% 40% 20% 0%
1
5
Consecutive evaluations keval
60% 40% 20% 0%
10
ASR(keval, eval = 0.5)
100%
ASR(keval, eval = 0.5)
ASR(keval, eval = 0.5)
Llama-3.2-1B 100%
1
5
40% 20% 0%
10
Consecutive evaluations keval
60%
1
5
10
Consecutive evaluations keval
Figure 14: ASR(keval ); Parameters: kgen =1, Tgen =0.5, θgen =0.5, Teval =0.5, θeval =0.5
ASR based on target model temperature at evaluation Gemma3-1B
Granite-3.2-1B
100%
100%
100%
80%
80%
80%
ASR(keval = 1)
ASR(keval = 1)
Llama-3.2-1B
60% 40% 20% 0%
ASR(keval = 1)
D.2.2
60% 40% 20%
0.0
0.5
0%
1.0
Target model temperature Teval
60% 40% 20%
0.0
0.5
0%
1.0
Target model temperature Teval
0.0
0.5
1.0
Target model temperature Teval
Figure 15: ASR(keval = 1, Teval ); Parameters: kgen =1, Tgen =0.5, θgen =0.5, θeval =0.5
ASR based on judge model temperature at evaluation Gemma3-1B
Granite-3.2-1B
100%
100%
100%
80%
80%
80%
ASR(keval = 1, eval)
ASR(keval = 1, eval)
Llama-3.2-1B
60% 40% 20% 0%
0.0
0.5
Judge eval temperature eval
1.0
ASR(keval = 1, eval)
D.2.3
60% 40% 20% 0%
0.0
0.5
Judge eval temperature eval
1.0
60% 40% 20% 0%
0.0
0.5
Judge eval temperature eval
1.0
Figure 16: ASR(keval = 1, θeval ); Parameters: kgen =1, Tgen =0.5, θgen =0.5, Teval =0.5
Qualcomm Technologies, Inc.
26
Heatmap ASR based on consecutive evaluations at generation Gemma3-1B
5
0.94
0.90
0.90
1.0
0.8 0.6 0.4
10
0.98
0.96
0.94
1 5 10 Consecutive evaluations keval
0.2 0.0
1
0.90
0.74
0.68
5
0.98
0.92
0.88
1.0
0.8 0.6 0.4
10
0.98
0.98
0.98
1 5 10 Consecutive evaluations keval
0.2 0.0
Consistency threshold kgen
0.70
Consistency threshold kgen
1
0.70
ASR
Consistency threshold kgen
1.0
0.82
Granite-3.2-1B 1
0.82
0.74
0.70
5
0.86
0.82
0.82
0.8 0.6
ASR
Llama-3.2-1B
ASR
D.2.4
0.4
10
0.88
0.88
0.86
1 5 10 Consecutive evaluations keval
0.2 0.0
Figure 17: Heatmap ASR(keval , kgen ) ; Parameters: Tgen =0.5, θgen =0.5, Teval =0.5
Heatmap ASR based on the temperature of the target model at generation Gemma3-1B
0.76
Tgen = 0.5
0.82
0.70
0.70
Tgen = 1.0
0.90
0.8 0.6 0.4
0.80
0.72
keval = 1 keval = 5 keval = 10 Consecutive evaluations keval
0.2
1.0
Tgen = 0.0
0.86
0.70
0.70
Tgen = 0.5
0.90
0.74
0.68
Tgen = 1.0
0.90
0.0
0.8 0.6 0.4
0.76
0.70
keval = 1 keval = 5 keval = 10 Consecutive evaluations keval
0.2
1.0
Target temperature Tgen
0.80
Target temperature Tgen
0.92
ASR
Target temperature Tgen
1.0
Tgen = 0.0
Granite-3.2-1B Tgen = 0.0
0.78
0.68
0.62
Tgen = 0.5
0.82
0.74
0.70
Tgen = 1.0
0.78
0.0
0.8 0.6
ASR
Llama-3.2-1B
ASR
D.2.5
0.4
0.66
0.64
keval = 1 keval = 5 keval = 10 Consecutive evaluations keval
0.2 0.0
Figure 18: Heatmap ASR(keval , Tgen ) ; Parameters: θgen =0.5, kgen = 1, Teval =0.5, θeval =0.5
Heatmap ASR based on the temperature of the judge at generation
0.74
0.70
gen = 0.5
0.82
0.70
0.70
gen = 1.0
0.82
0.8 0.6 0.4
0.72
0.72
keval = 1 keval = 5 keval = 10 Consecutive evaluations keval
0.2 0.0
gen = 0.0
0.92
0.76
0.66
gen = 0.5
0.90
0.74
0.68
gen = 1.0
0.76
0.8 0.6 0.4
0.62
0.60
keval = 1 keval = 5 keval = 10 Consecutive evaluations keval
0.2 0.0
1.0
gen = 0.0
0.76
0.66
0.66
gen = 0.5
0.82
0.74
0.70
gen = 1.0
0.72
0.8 0.6
ASR
0.86
Granite-3.2-1B 1.0
Judge gen. temperature gen
gen = 0.0
Judge gen. temperature gen
Gemma3-1B 1.0
ASR
Judge gen. temperature gen
Llama-3.2-1B
ASR
D.2.6
0.4
0.60
0.58
keval = 1 keval = 5 keval = 10 Consecutive evaluations keval
0.2 0.0
Figure 19: Heatmap ASR(keval , θgen ) ; Parameters: Tgen =0.5, kgen = 1, Teval =0.5, θeval =0.5
Qualcomm Technologies, Inc.
27
D.3
Different attacks
D.3.1
ASR based consecutive judge evaluations PAIR
100%
100%
80%
80%
ASR(keval, eval = 0.5)
ASR(keval, eval = 0.5)
Best-of-N
60% 40% 20% 0%
1
5
Consecutive evaluations keval
60% 40% 20% 0%
10
1
100%
100%
80%
80%
60% 40% 20% 0%
1
5
Consecutive evaluations keval
10
Crescendo
ASR(keval, eval = 0.5)
ASR(keval, eval = 0.5)
TAP
5
Consecutive evaluations keval
10
60% 40% 20% 0%
1
5
Consecutive evaluations keval
10
Figure 20: ASR(keval ); Parameters: kgen =1, Tgen =0.5, θgen =0.5, Teval =0.5, θeval =0.5
Qualcomm Technologies, Inc.
28
D.3.2
ASR based on target model temperature at evaluation PAIR
100%
100%
80%
80%
ASR(keval = 1)
ASR(keval = 1)
Best-of-N
60% 40% 20% 0%
60% 40% 20%
0.0
0.5
0%
1.0
Target model temperature Teval
0.0
1.0
Crescendo
100%
100%
80%
80%
ASR(keval = 1)
ASR(keval = 1)
TAP
60% 40%
60% 40% 20%
20% 0%
0.5
Target model temperature Teval
0.0
0.5
1.0
Target model temperature Teval
0%
0.0
0.5
1.0
Target model temperature Tgen
Figure 21: ASR(keval = 1, Teval ); Parameters: kgen =1, Tgen =0.5, θgen =0.5, θeval =0.5
Qualcomm Technologies, Inc.
29
D.3.3
ASR based on judge model temperature at evaluation PAIR
100%
100%
80%
80%
ASR(keval = 1, eval)
ASR(keval = 1, eval)
Best-of-N
60% 40% 20% 0%
0.0
0.5
Judge eval temperature eval
60% 40% 20% 0%
1.0
0.0
100%
100%
80%
80%
60% 40% 20% 0%
0.0
0.5
Judge eval temperature eval
1.0
Crescendo
ASR(keval = 1, eval)
ASR(keval = 1, eval)
TAP
0.5
Judge eval temperature eval
1.0
60% 40% 20% 0%
0.0
0.5
Judge eval temperature eval
1.0
Figure 22: ASR(keval = 1, θeval ); Parameters: kgen =1, Tgen =0.5, θgen =0.5, Teval =0.5
Qualcomm Technologies, Inc.
30
Heatmap ASR based on consecutive evaluations at generation Best-of-N
PAIR
0.70
0.70
5
0.94
0.90
0.90
0.8 0.6 0.4
10
0.98
0.96
0.94
1 5 10 Consecutive evaluations keval
0.2 0.0
1
0.96
0.86
0.80
5
0.94
0.94
0.94
10
0.92
0.92
0.92
1 5 10 Consecutive evaluations keval
0.0
0.74
0.74
5
0.96
0.88
0.86
0.8 0.6 0.4
0.98
1 5 10 Consecutive evaluations keval
0.2 0.0
1.0
Consistency threshold kgen
0.90
ASR
Consistency threshold kgen
1
1.00
0.2
Crescendo 1.0
1.00
0.6 0.4
TAP
10
0.8
ASR
0.82
1.0
Consistency threshold kgen
1
ASR
Consistency threshold kgen
1.0
1
0.60
0.50
0.42
5
0.56
0.56
0.52
0.8 0.6
ASR
D.3.4
0.4
10
0.56
0.56
0.56
1 5 10 Consecutive evaluations keval
0.2 0.0
Figure 23: Heatmap ASR(keval , kgen ) ; Parameters: Tgen =0.5, θgen =0.5, Teval =0.5
Qualcomm Technologies, Inc.
31
Heatmap ASR based on the temperature of the target model at generation Best-of-N
PAIR
0.80
0.76
Tgen = 0.5
0.82
0.70
0.70
Tgen = 1.0
0.90
0.8 0.6 0.4
0.80
0.72
keval = 1 keval = 5 keval = 10 Consecutive evaluations keval
0.2
Tgen = 0.0
0.90
0.74
0.70
Tgen = 0.5
0.96
0.86
0.80
Tgen = 1.0
0.82
0.0
0.74
0.72
0.82
0.76
Tgen = 0.5
0.90
0.74
0.74
0.8 0.6 0.4
0.82
0.0
0.80
keval = 1 keval = 5 keval = 10 Consecutive evaluations keval
0.2 0.0
1.0
Target temperature Tgen
0.90
ASR
Target temperature Tgen
Tgen = 0.0
0.96
0.2
Crescendo 1.0
Tgen = 1.0
0.6 0.4
keval = 1 keval = 5 keval = 10 Consecutive evaluations keval
TAP
0.8
ASR
0.92
1.0
Target temperature Tgen
Tgen = 0.0
ASR
Target temperature Tgen
1.0
Tgen = 0.0
0.62
0.42
0.38
Tgen = 0.5
0.60
0.50
0.42
Tgen = 1.0
0.60
0.8 0.6
ASR
D.3.5
0.4
0.48
0.46
0.0 0.5 1.0 Consecutive evaluations keval
0.2 0.0
Figure 24: Heatmap ASR(keval , Tgen ) ; Parameters: θgen =0.5, kgen = 1, Teval =0.5, θeval =0.5
Qualcomm Technologies, Inc.
32
Heatmap ASR based on the temperature of the judge at generation
gen = 0.0
0.86
0.74
0.70
gen = 0.5
0.82
0.70
0.70
gen = 1.0
0.82
0.8 0.6 0.4
0.72
0.72
keval = 1 keval = 5 keval = 10 Consecutive evaluations keval
0.2 0.0
1.0
gen = 0.0
0.86
0.76
0.74
gen = 0.5
0.96
0.86
0.80
gen = 1.0
0.88
0.90
0.82
gen = 0.5
0.90
0.74
0.74
0.8 0.6 0.4
0.80
0.74
keval = 1 keval = 5 keval = 10 Consecutive evaluations keval
0.2 0.0
Judge gen. temperature gen
0.94
ASR
Judge gen. temperature gen
gen = 0.0
0.84
0.76
0.76
0.2 0.0
Crescendo 1.0
gen = 1.0
0.6 0.4
keval = 1 keval = 5 keval = 10 Consecutive evaluations keval
TAP
0.8
ASR
1.0
Judge gen. temperature gen
PAIR
ASR
Judge gen. temperature gen
Best-of-N
1.0
gen = 0.0
0.68
0.52
0.46
gen = 0.5
0.60
0.50
0.42
gen = 1.0
0.64
0.8 0.6
ASR
D.3.6
0.4
0.52
0.42
0.0 0.5 1.0 Consecutive evaluations keval
0.2 0.0
Figure 25: Heatmap ASR(keval , θgen ) ; Parameters: Tgen =0.5, kgen = 1, Teval =0.5, θeval =0.5
Qualcomm Technologies, Inc.
33