Safety scores fail to predict jailbreak success, new audit finds
Source published ·Modelwire updated
Original coverage: arXiv cs.CL ↗·How Modelwire adds context
The development
A new arXiv paper challenges a core assumption in LLM safety evaluation: that internal harmfulness scores trained to distinguish malicious from benign prompts will reliably catch jailbreaks in practice. The authors argue this conflates two different problems. Prompt-level safety signals measure intent, not outcome. Jailbreak success depends on model behavior, decoding strategy, and downstream judges, none of which correlate cleanly with pre-generation scores. The work introduces Active Attention Probing to measure safety signals more accurately, suggesting current red-teaming and filtering pipelines may waste detection capacity on attacks that would fail anyway. This has direct implications for how labs validate safety mechanisms before deployment.
Modelwire’s AI-generated summary of coverage from arXiv cs.CL.
Modelwire analysis
ExplainerOur AI-generated reading of the wider context and the next developments to watch.
The paper's core claim isn't that harmfulness scores fail in isolation, but that labs may be optimizing safety pipelines against the wrong signal entirely. A jailbreak can trigger high internal alarm bells yet still fail at execution, meaning detection resources get spent on attacks that wouldn't succeed anyway.
This connects directly to the pattern established in PragMatch and Avalon-ToM-Bench from earlier this month. Both papers exposed how models conflate surface-level pattern matching with genuine reasoning. Here, the authors argue safety evaluation commits a similar error: treating a model's internal confidence about harmfulness as predictive of actual harmful output, when the two are mechanically decoupled. The implication is sharper than prior work because it has immediate deployment consequences. If internal scores don't correlate with jailbreak success, then current red-teaming methodologies may be measuring the wrong failure mode.
If major labs (Anthropic, OpenAI, DeepSeek) publish updated safety validation protocols in the next six months that explicitly separate prompt-level filtering from behavior-level auditing, that confirms this work shifted practice. Conversely, if safety evaluations continue treating harmfulness scores as primary gates without downstream behavior validation, the paper remains academically interesting but operationally ignored.
This interpretation is generated from the summary above and the archive coverage cited below. Our methodology · Report an error
Coverage behind this analysis
These archive entries ground the connection in our analysis. They are ordered by source publication date, with links to our coverage and the original sources.
·arXiv cs.CL
Vision-language models fail at sarcasm through shortcut learning, not reasoning
Researchers have exposed a critical blind spot in vision-language models: they often mistake simple image-text misalignment for genuine reasoning about incongruity. PragMatch, a new 3,000-pair benchmark, reveals that LVLMs rely on superficial shortcut cues rather than pragmatic understanding, particularly in sarcasm detection where context matters. This work matters because it challenges assumptions about multimodal reasoning…
MentionsActive Attention Probing
How this coverage is produced
Modelwire uses AI to generate summaries and context from source headlines, snippets, and selected archive coverage. Automated checks do not verify every claim, and items are not routinely reviewed by a person before publication. Zacaria Solis operates the site. Read the linked source for the full evidence and report errors through our corrections process.
Modelwire summarizes, we don’t republish. arXiv cs.CL originally reported this story as “Measuring the Wrong Thing: Internal Harmfulness Scores Anti-Rank Successful Jailbreaks”. The full content lives on arxiv.org. If you’re a publisher and want a different summarization policy for your work, see our takedown page.