TLDR: A new technical report introduces PRISM Eval’s Behavior Elicitation Tool (BET), an AI system that performs automated red-teaming to assess LLM robustness. It achieved a 100% Attack Success Rate against 37 of 41 state-of-the-art LLMs, demonstrating universal vulnerability. The report proposes a new, more granular metric that measures the average number of attempts needed to elicit harmful behaviors, revealing a 300-fold difference in attack difficulty across models. It also analyzes which jailbreaking techniques are most effective for specific hazard categories, highlighting context-dependent vulnerabilities.
A new technical report from PRISM Eval sheds light on the critical issue of Large Language Model (LLM) robustness, introducing a sophisticated AI system called the Behavior Elicitation Tool (BET). This tool performs automated red-teaming, a process of testing AI systems for vulnerabilities, and has achieved a remarkable 100% Attack Success Rate (ASR) against 37 out of 41 leading LLMs. This finding underscores a significant challenge: while LLMs are incredibly powerful, they are also widely susceptible to malicious attempts to elicit harmful behaviors.
Beyond Simple Success Rates: A Deeper Look at Vulnerability
The traditional method of evaluating LLM safety often relies on a binary Attack Success Rate (ASR) – essentially, whether an attack succeeded or failed. However, as the report highlights, this metric doesn’t tell the full story. It fails to capture how difficult or how many attempts it takes to compromise a model. A model that succumbs after hundreds of complex attempts presents a very different risk profile than one that breaks with a simple prompt.
To address this, PRISM Eval has developed a more nuanced robustness metric. This new metric estimates the average number of attempts a skilled attacker would need to elicit harmful behaviors. The results are eye-opening, revealing that the difficulty of attack can vary by over 300-fold across different models, even though all tested models eventually proved vulnerable. For instance, some models were compromised in as few as 2.0 attempts, while others required over 700 attempts.
How the Behavior Elicitation Tool (BET) Works
At the heart of this evaluation is BET, an AI system designed for automated red-teaming through Dynamic Adversarial Optimization. Imagine BET as an intelligent attacker that iteratively refines its strategies to find vulnerabilities. It operates through several key components:
-
Primitive Library: This is a vast collection of hundreds of known jailbreaking techniques, gathered from research and the online red-teaming community. These ‘primitives’ are like building blocks for attacks, ranging from linguistic manipulations (like translating requests into low-resource languages) to role-playing scenarios and logical manipulations.
-
Prompt Programming Language: This unique language allows BET to systematically combine these primitives into complex, multi-stage adversarial prompts. It treats LLM calls as computational steps, enabling dynamic and context-aware prompt generation.
-
Optimization Engine: Unlike other red-teaming tools that stop at the first vulnerability, BET’s engine aims to find as many ways as possible to bypass safety measures. It optimizes not just for success, but also for the diversity of attack vectors, creating a comprehensive map of a model’s weaknesses.
-
Evaluator: An LLM itself (specifically DeepSeek-R1) acts as a judge, scoring the target system’s responses to determine if harmful behavior was elicited. This LLM-based evaluation was validated against human assessments, showing a high agreement rate.
The system works by iteratively generating prompt ‘recipes’ from its primitive library, transforming them into adversarial inputs, evaluating the target LLM’s responses, and then using that feedback to refine its next generation of prompts.
Hazard Categories and Collaborative Evaluation
The models were tested against five critical hazard categories based on the AIluminate taxonomy: Indiscriminate Weapons (CBRNE), Violent crimes, Nonviolent crimes, Hate, and Defamation and misinformation. Each category included 20 to 40 distinct scenarios to ensure thorough testing.
To ensure fairness and impartiality, PRISM Eval implemented a novel collaborative evaluation protocol. Trusted third parties from the AI Safety Network, including the Singapore Infocomm Media Development Authority (IMDA), Canada AI Safety Institute (CAISI), and France Laboratoire national de métrologie et d’essais (LNE), provided anonymized access to models. This single-blind approach meant the PRISM Eval team didn’t know which specific model they were testing at any given time, enhancing the integrity of the results.
Key Findings and Implications
The study’s findings offer crucial insights into the current state of AI safety:
-
Universal Vulnerability: The near-universal 100% ASR demonstrates that even state-of-the-art LLMs are vulnerable to sophisticated adversarial optimization, challenging the idea that simply scaling models or improving reasoning capabilities inherently makes them safer.
-
Meaningful Robustness Differences: Despite universal vulnerability, the vast difference in attack difficulty (up to 300-fold) highlights that some models are significantly harder to exploit than others. This nuanced understanding is vital for deployment decisions and risk assessment.
-
Context-Dependent Vulnerabilities: The effectiveness of individual jailbreaking techniques varies significantly across different hazard categories. A primitive that works well for one type of harmful behavior might be ineffective or even counterproductive for another, suggesting that defenses need to be scenario-specific.
-
Scale and Reasoning Not Guarantees of Safety: The research indicates that increased model parameters or enhanced reasoning abilities (like Chain of Thought) do not consistently improve robustness against adversarial inputs.
Also Read:
- AI Security Flaws: GPT-5 Jailbroken, Zero-Click Attacks Threaten Cloud and IoT Systems
- Researchers Unveil Zero-Click Prompt Injection Vulnerabilities in AI Agents at Black Hat Conference
Looking Ahead
While this work represents a significant step forward in LLM robustness evaluation, the authors acknowledge limitations. The vulnerability graph explored by BET is not exhaustive, meaning the estimates are lower bounds on actual robustness. Future work will focus on validating these automated results against human red-teaming performance and extending the evaluation to multi-modal attacks and longer conversational contexts.
This research, detailed in the LLM Robustness Leaderboard v1 – Technical report, provides a foundational understanding for more nuanced safety assessments and highlights the urgent need for robust safety mechanisms that can withstand systematic adversarial optimization in the rapidly evolving landscape of AI.
