Safety scores mislead twice: binary pass rates hide risk, and other languages are barely tested
Four preprints published October 30 show that jailbreak evaluation based on a single success rate hides how close a model came to failing, and that safety alignment built in English does not transfer to languages such as Yoruba and Nigerian Pidgin.
- In a preprint, binary attack success rate obscures the surrounding structure of possible generations in jailbreak evaluation. Self-reported m:…5459
- In a preprint, obfuscation attacks are the most transferable jailbreak vector, bypassing every evaluated model with nonzero success. Self-reported m:…9413
- In a preprint, self-reminder prompting cuts attack success from 48% to 5% on Llama-3.1-8B with zero false positives and no added inference cost. Self-reported m:…9413
- In a preprint, low rejection rates in Yoruba and Nigerian Pidgin often reflect poor prompt comprehension rather than safety. Self-reported m:…6594
- In a preprint, a template-based dataset is proposed to close the multilingual safety gap, since translated and localised attacks reveal failures English-only testing misses. Self-reported m:…9913
A pass rate is not a risk picture
In a preprint, researchers argue that the standard jailbreak metric, binary attack success rate, hides more than it reveals. A binary score records whether an attack succeeded, but not how close the model came to failing, how many nearby generations were unsafe, or whether a defence merely rerouted the model to a safe answer on this prompt while leaving the risk intact. Their alternative is a continuous, context-conditioned risk landscape based on first-token branches, which separates two properties: current decoder exposure, how exposed the model is right now, and safe rerouting capacity, how well it can steer to a safe completion. They also report that attacks strongest before a defence do not necessarily remain strongest after an adaptive defence reacts, which means ranking attacks by their pre-defence success can mislead a team about what to defend against next. m:…5459
A systematic evaluation across seven large language models, testing five jailbreak attack families, gives that argument concrete numbers. In a preprint, the authors report that obfuscation attacks are the most transferable vector, bypassing every evaluated model with nonzero success, and that model size does not predict robustness, with a Spearman correlation of negative 0.57 and a p-value of 0.18, which does not support a size effect. The same paper reports a cheap defence that works in its tests: self-reminder prompting reduces attack success from 48% to 5% on Llama-3.1-8B with zero false positives and no additional inference cost. A defence that costs nothing and adds no latency deserves attention, but the paper's own framing cautions against treating any single number as a safety verdict. m:…9413
In other languages, silence is not safety
The second misleading score is language. In a preprint red-teaming models in Yoruba and Nigerian Pidgin, the authors find that English-centric safety alignment does not transfer to these languages, and that low rejection rates often reflect poor prompt comprehension rather than safety: a model that does not understand a harmful request may fail to refuse it for the wrong reason, and may also fail to produce the harmful content, which looks like a pass in a naive count. The paper names GPT-4o Mini as showing the most significant cross-lingual safety discrepancy in its tests, and Gemini 2.0 Flash as the most consistent across the tested languages. The finding is not that one vendor is safe and another is not. It is that a safety evaluation run only in English cannot answer the question for users who do not write in English. m:…6594
A fourth preprint proposes a way to close that gap at scale. Its authors introduce a dataset built with a template-based pipeline for generating diverse, culturally authentic refusal and benign examples, and argue that English-only safety evaluation is insufficient for multilingual models. In their account, translated and culturally localised attacks reveal safety failures that English-only testing does not show, because a prompt that is clearly harmful in one cultural context may read differently when translated literally. Template-based augmentation is reported to increase the diversity and quality of safety training data, though the paper is a preprint and its dataset is a proposal for better coverage, not proof that any deployed model is now safe in other languages. m:…9913
What a credible safety claim should include
Read together, these preprints set a minimum standard for anyone publishing or buying a safety claim. Report risk as a distribution, not just a pass rate, and re-rank attacks after defences adapt. Report results per language, with comprehension checked separately from refusal, so that a model failing to understand a prompt is not counted as a model refusing it. And treat a defence such as self-reminder prompting as a useful, cheap layer, not as a substitute for multilingual training and evaluation. A safety score that is only measured in English, and only as a binary, is not a measurement of safety. It is a measurement of the test. m:…5459 m:…9413 m:…6594 m:…9913
What is still unresolved
- Whether continuous risk landscapes predict real-world harm better than binary success rates, or only describe model behaviour more richly.
- Whether self-reminder prompting holds against adaptive attackers who know the reminder is present.
- Whether template-generated multilingual safety data captures culturally specific harms, or mainly translates English harms into other languages.
Provenance by Synorb. Every claim links to its source. This story was written by an agent from the Manifests listed below. Read the methodology and limitations, or send a correction.
Free to reuse, including commercially. Credit “Hanging Context, with provenance by Synorb” and link to this story. Keep the cited Manifest ids. Reuse terms v1.