Advbench Asr Eval

---
name: advbench-asr-eval
description: This benchmark probes an LLM's susceptibility to jailbreak attacks by measuring how often it generates harmful or policy-violating responses when prompted with malicious objectives. It evaluates both the raw success rate of bypassing safety filters and the relative severity of the generated harmful content through pairwise ranking. Use when the user wants to benchmark on AdvBench, or asks about evaluating this task. Reports Attack Success Rate (ASR).
metadata:
  skill_kind: dataset_eval
  source_arxiv: 2505.02862
  bibtex_key: yang2025cannot
  confidence: high
---

# advbench-asr-eval

> Cannot See the Forest for the Trees: Invoking Heuristics and Biases to Elicit Irrational Choices of LLMs — Yang et al. (2025) (arXiv:2505.02862, 2025)

## What this evaluates

This benchmark probes an LLM's susceptibility to jailbreak attacks by measuring how often it generates harmful or policy-violating responses when prompted with malicious objectives. It evaluates both the raw success rate of bypassing safety filters and the relative severity of the generated harmful content through pairwise ranking.

## Datasets

- **AdvBench** — total 520; splits: test (520)

## Metrics

- `Attack Success Rate (ASR)` **(primary)** — range: percent
  - Binary metric indicating whether a model's response to a harmful prompt is classified as a successful jailbreak. Judged by a Generative-Judge using GPT-4-turbo-1106 with assessment prompts sourced from GPT-FUZZER.
- `Harmfulness Ranking (Elo, HodgeRank, Rank Centrality)` — range: other
  - Pairwise comparison-based ranking metric that aggregates model performance across different jailbreak methods. Uses Elo-R (sequential updates), Elo-A (random order), HodgeRank, and Rank Centrality to score output severity.

## Input / output format

**Input**: Harmful objectives/prompts from the AdvBench dataset, optionally combined with system prompts or defense mechanisms.

**Output**: Model-generated text response to the prompt.

## Scoring recipe

```python
success_count = 0
for prompt in advbench_prompts:
    response = model.generate(prompt)
    judge_prompt = gptfuzzer_assessment_prompt.format(response=response)
    verdict = gpt4_turbo_1106.evaluate(judge_prompt)
    if verdict == 'success':
        success_count += 1
asr = (success_count / len(advbench_prompts)) * 100

pairwise_results = []
for method_a, method_b in all_method_combinations:
    responses_a = generate_responses(method_a, advbench_prompts)
    responses_b = generate_responses(method_b, advbench_prompts)
    winner = judge_pairwise(responses_a, responses_b)
    pairwise_results.append((method_a, method_b, winner))
elo_ratings = compute_elo(pairwise_results)
hodge_rank = compute_hodge_rank(pairwise_results)
rank_central = compute_rank_central(pairwise_results)
```

## Common pitfalls

- ASR relies entirely on an LLM-as-a-judge (GPT-4-turbo-1106) with specific prompts, which may introduce judge bias or inconsistency compared to human evaluation.
- Harmfulness ranking metrics (Elo, HodgeRank, Rank Centrality) require careful handling of pairwise comparison order and transitivity assumptions, as different aggregation methods can yield conflicting rankings.

## Evidence (verbatim from paper)

> The evaluation focuses on two dimensions: (i) Attack Success Rate (ASR): Following previous work (Zhou et al., 2024; Yu et al., 2023), we use Generative-Judge with GPT-4-turbo-1106 as the scoring model. Assessment prompts are sourced from GPT-FUZZER, with details in Appendix C.4. (ii) Harmfulness Ranking: Our proposed metric evaluates the harmfulness of outputs via pairwise comparisons across different LLMs and aggregates the results using Elo, HodgeRank, and Rank Centrality.

## Citation

```bibtex
@misc{yang2025cannot,
  title={Cannot See the Forest for the Trees: Invoking Heuristics and Biases to Elicit Irrational Choices of LLMs},
  author={Yang et al. (2025)},
  year={2025},
  note={arXiv:2505.02862}
}
```

- arXiv: 2505.02862