JailMeter: An Evidence-Based Evaluation Framework for Jailbreak Attacks on Large Language Models

2026-07-20

AI Summary

Current evaluations of jailbreak attacks on large language models lack a unified standard, leading to unreliable estimates of attack success rates. This work proposes JailMeter, a novel framework that introduces, for the first time, an evidence-driven evaluation paradigm grounded in information bottleneck theory. JailMeter employs a dual-feedback optimization mechanism to filter out irrelevant noise from model responses, retaining only content pertinent to malicious intent, thereby enabling rigorous determination of whether a jailbreak has genuinely succeeded. Furthermore, the evaluator is distilled into a lightweight small language model, significantly reducing computational overhead while maintaining high reliability. Evaluated on JailMeter-Eva—a benchmark comprising 330 human-annotated samples—JailMeter achieves an assessment accuracy of 97.27%, substantially outperforming existing methods.

Abstract

The assessment of jailbreak attacks against large language models currently suffers from inconsistent evaluation criteria and methods, leading to unreliable estimates of attack success rates. We propose JailMeter, an evidence-based evaluation framework designed to more faithfully measure jailbreak effectiveness. Inspired by the Information Bottleneck theory, JailMeter applies dual-feedback optimization to filter jailbreak noise from model responses while preserving content relevant to the original malicious question. This process produces concise evidence for a rigorous assessment under which an attack is validated only when the response captures the malicious intent and delivers a complete answer, thereby signaling a substantive bypass of model safety alignment. We evaluate JailMeter on JailMeter-Eva, a challenging benchmark containing 330 human-labeled, non-rejected jailbreak instances. JailMeter achieves an accuracy of 97.27%, substantially outperforming existing evaluation methods. To support large-scale evaluation, we further distill JailMeter into a small language model, JailMeter\textsubscript{SLM}, which maintains comparable reliability with significantly reduced computational costs. Code and dataset are available at https://github.com/Magi2B0y/JailMeter.

Problem

• jailbreak attacks
• evaluation framework
• large language models
• attack success rate
• safety alignment

Innovation

• evidence-based evaluation
• dual-feedback optimization
• Information Bottleneck
• jailbreak detection
• safety alignment