AI and the World's Hard Problems · Theoretical computer science · arXiv · 2026-10-19
Refusal Is Not Robustness: Measuring Harmful Reachability in Autoregressive Language Models
Jailbreak-based safety evaluations usually report attack success rate, which only looks at sampled outputs and misses harmful generation paths that remain probable beneath a safe response. The authors introduce bounded continuation analysis, which models generation as a stochastic process and computes the finite-horizon probability of reaching a harmful continuation using exact probabilistic model checking. Across four instruction-tuned LLMs and 100 JailbreakBench behaviors, it distinguishes models that look identical under ASR and helps direct red-teaming effort.