Egida Safety Eval

egida-safety-eval

Efficient Safety Retrofitting Against Jailbreaking for LLMs — Garcia-Gasulla et al. (2025) (arXiv:2502.13603, 2025)

What this evaluates

Evaluates the robustness of LLMs against jailbreaking attacks after safety alignment. It measures how well models refuse harmful prompts across diverse topics and attack styles, while also tracking unintended side effects like over-refusal and general capability degradation.

Datasets

• Egida — total ?; splits: train (-1), test (-1)

Metrics

• ASR (primary) — range: percent
  • The percentage of jailbreak prompts that successfully elicit a harmful or unsafe response from the model. Calculated as (number of successful attacks / total prompts) × 100. Lower values indicate better safety.
• Refusal Rate — range: percent
  • The percentage of safe prompts that are incorrectly refused by the model, determined via keyword matching on the model's output.
• ROUGE — range: [0, 1]
  • N-gram overlap metric used to measure open-ended generation quality on general benchmarks. Sensitive to stylistic changes in model outputs.

Input / output format

Input: Jailbroken or unsafe prompts, often augmented with specific jailbreaking templates and covering 27 safety topics and 18 attack styles.

Output: Natural language text responses generated by the LLM.

Scoring recipe

def compute_asr(prompts, responses):
    successful = 0
    for prompt, response in zip(prompts, responses):
        if is_unsafe(response):  # Typically via classifier or keyword match
            successful += 1
    return (successful / len(prompts)) * 100

Common pitfalls

• ASR is reported as a percentage where lower is better; confusing it with accuracy leads to misinterpreting results.
• Keyword-based refusal detection can misclassify nuanced safe responses as refusals, inflating over-refusal rates.
• ROUGE scores on open-ended benchmarks may drop due to stylistic shifts (e.g., over-refusal) rather than actual capability loss.

Evidence (verbatim from paper)

Figure 3: Performance of the four models under study on the four evaluation safety benchmarks. Y axis shows performance in attack success rate (ASR, lower better), and X axis shows an increasing amount of data used for alignment.

Citation

@misc{garcia-gasulla2025efficient,
  title={Efficient Safety Retrofitting Against Jailbreaking for LLMs},
  author={Garcia-Gasulla et al. (2025)},
  year={2025},
  note={arXiv:2502.13603}
}

• arXiv: 2502.13603