The safety exam is being gamed from both sides

Reframe the request as virtuous

The most unsettling jailbreak in this week's batch does not exploit a token trick — it exploits morality. In a preprint, the authors of Moral Combat built a multi-agent framework grounded in Moral Foundations Theory that diagnoses a prompt violation and reframes the harmful request through an alternative moral lens, presenting it as virtuous. The reported result: high single-trial jailbreak success rates across models, with success increasing under repeated attempts. The mechanism is social engineering aimed at the model's alignment training itself — the same moral reasoning the safety tuning installed becomes the attack surface. m:…9708

The paper's second finding is arguably more important than the attack: current safety benchmarks are imbalanced in the moral foundations they violate, concentrating on foundations toward which models already exhibit biases. That means the benchmarks are systematically testing the attacks models are already best defended against, while leaving other moral framings unexamined — a blind spot the attackers just walked through. This suggests safety benchmark coverage should be audited the way test coverage is: not by how many tests pass, but by which attack surfaces are never exercised. m:…9708

Ask the judge how to attack

A second preprint makes automated jailbreaking dramatically more efficient by upgrading the feedback signal. The JSB framework replaces binary success-or-failure feedback with multi-dimensional probabilistic feedback from a judge, which the authors report provides superior guidance for prompt optimization. The result: an average 89.8% attack success rate on HarmBench across ten open-source settings, within a budget of just 10 queries. The paper further reports that existing filtering mechanisms in LLMs are vulnerable to Jev-based output filtering — the judge infrastructure itself can be turned into an oracle for the attacker. m:…3381

Ten queries to an 89.8% success rate changes the economics of red-teaming and of attacking alike. Binary feedback forced attackers to grope in the dark; a judge that scores along multiple dimensions hands them a gradient to climb. The implication for defenders is uncomfortable: every evaluation harness that returns rich diagnostic feedback is also, potentially, an attack aid. Teams running judge-based safety filters should assume adversaries get the same signal quality their own red teams do, and rate-limit or coarsen judge feedback exposed to untrusted inputs. m:…3381

The judge refuses to judge

The third preprint attacks confidence from the other direction: the evaluator itself is unreliable. In a study of Manaca-1B, a 1.72B-parameter model aligned for Brazilian Portuguese, DPO training for safety produced negative outcomes — reward margins reached 1.0 without changing free generation behavior, meaning the optimization metric said 'aligned' while the model did not change. Worse, the LLM-judge evaluation on MT-Bench-PT exhibited a silent failure mode: the judge refused to score specific safety items regardless of the response. The alignment signal was broken in both directions — the training objective lied, and the evaluator abstained. m:…6494

Put the three together and the safety measurement loop looks compromised on every side: attackers exploit moral framings the benchmarks ignore, attackers exploit judge feedback to optimize jailbreaks in ten queries, and the judge itself can silently refuse to score the very items it exists to evaluate. This suggests that 'passing the safety eval' is a weaker statement than the industry treats it as. The honest posture for executives: ask what the eval covers, what the judge abstains on, and whether anyone has checked. A safety program whose measuring instruments fail silently is not a program — it is a dashboard. m:…9708 m:…3381 m:…6494