Safety scores fail to predict jailbreak success, new audit finds
A new arXiv paper challenges a core assumption in LLM safety evaluation: that internal harmfulness scores trained to distinguish malicious from benign prompts will reliably catch jailbreaks in practice. The authors argue this conflates two different problems. Prompt-level safety signals measure intent, not outcome. Jailbreak success depends on model behavior, decoding strategy, and downstream judges, none of which correlate cleanly with pre-generation scores. The work introduces Active Attention Probing to measure safety signals more accurately, suggesting current red-teaming and filtering pipelines may waste detection capacity on attacks that would fail anyway. This has direct implications for how labs validate safety mechanisms before deployment.
Modelwire context
ExplainerThe paper's core claim isn't that harmfulness scores fail in isolation, but that labs may be optimizing safety pipelines against the wrong signal entirely. A jailbreak can trigger high internal alarm bells yet still fail at execution, meaning detection resources get spent on attacks that wouldn't succeed anyway.
This connects directly to the pattern established in PragMatch and Avalon-ToM-Bench from earlier this month. Both papers exposed how models conflate surface-level pattern matching with genuine reasoning. Here, the authors argue safety evaluation commits a similar error: treating a model's internal confidence about harmfulness as predictive of actual harmful output, when the two are mechanically decoupled. The implication is sharper than prior work because it has immediate deployment consequences. If internal scores don't correlate with jailbreak success, then current red-teaming methodologies may be measuring the wrong failure mode.
If major labs (Anthropic, OpenAI, DeepSeek) publish updated safety validation protocols in the next six months that explicitly separate prompt-level filtering from behavior-level auditing, that confirms this work shifted practice. Conversely, if safety evaluations continue treating harmfulness scores as primary gates without downstream behavior validation, the paper remains academically interesting but operationally ignored.
Coverage we drew on
This analysis is generated by Modelwire’s editorial layer from our archive and the summary above. It is not a substitute for the original reporting. How we write it.
MentionsActive Attention Probing
Modelwire Editorial
This synthesis and analysis was prepared by the Modelwire editorial team. We use advanced language models to read, ground, and connect the day’s most significant AI developments, providing original strategic context that helps practitioners and leaders stay ahead of the frontier.
Modelwire summarizes, we don’t republish. arXiv cs.CL originally reported this story as “Measuring the Wrong Thing: Internal Harmfulness Scores Anti-Rank Successful Jailbreaks”. The full content lives on arxiv.org. If you’re a publisher and want a different summarization policy for your work, see our takedown page.