ASR is the fraction of adversarial prompts that produced an unsafe output; pair it with benign-task pass rate, because refuse-everything trivially zeros ASR.
Picture grading a security guard by how many bad guys got through the door. If the only metric is bad guys blocked, the highest-scoring guard is the one who slams the door on everyone,including paying customers. To grade the guard fairly, you also count how many real customers got let in normally. Safety evaluations work the same way. Attack success rate tells you how often the bad prompts win. Benign pass rate tells you whether the system is still useful for everyone else. Either number on its own is gameable. Together they tell the true story.
Concept explanation~2 min read
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.
Concept explanation~2 min read
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.
Safety evaluation looks superficially like any other ML eval: build a suite, run the model, count failures. The trap is that the most natural-seeming metric,fraction of adversarial prompts that the model complied with,can be driven to zero by a model that refuses everything.
This turns the eval into a measurement of the wrong thing. The model that scores best on ASR alone is the model nobody wants to ship. The fix is not to invent a more sophisticated metric; it is to report ASR alongside a benign-task signal so the over-refusal regression is visible immediately.
What attack success rate measures
ASR is a ratio. The numerator is the count of adversarial prompts where the model produced an output that violates the policy. The denominator is the total adversarial prompts run. Lower is better.
Each term in that definition hides decisions. 'Adversarial prompt' depends on the suite,a 2023 jailbreak corpus and a 2026 multimodal-injection corpus will produce very different ASR numbers on the same model. 'Violates the policy' depends on the judge: a human rater applies the policy with high recall but low throughput; an LLM-as-judge applies it at scale but with measurable disagreement.
Report the numerator and denominator separately, not just the ratio. A 1% ASR on a 100-prompt suite is one incident, which could easily be a judge call. A 1% ASR on a 5,000-prompt suite is 50 incidents and a real failure mode.
Situations where this technique stops working.
2–4 min · Everything important, quickly.
| Metric | What it measures | Failure mode if reported alone |
|---|---|---|
| ASR | Fraction of adversarial prompts that produced unsafe output | Refuse-everything model scores zero and looks 'safe' |
| Benign pass rate | Fraction of on-policy prompts answered correctly | Says nothing about how the model behaves under attack |
| Refusal rate (benign) | Fraction of benign prompts the model refuses | Tells you over-refusal cost but not adversarial robustness |
Real products, models, and research that use this idea.
- Anthropic's responsible-scaling evals track adversarial ASR alongside MMLU-style benign capability so a safety tune does not silently degrade usefulness.
- MLCommons AILuminate v1.0 (2025) reports per-category attack-success rates paired with a benign refusal-cost metric to expose over-refusal.
What an interviewer would ask next. Try answering before peeking at the approach.
QHow would you decompose ASR across attack categories to make it actionable?
Talk about stratifying by category (persuasion, role-play, multimodal, indirect), reporting per-category intervals, and flagging the worst-mover category in change reviews.
Red flags & common mistakes
The phrases that signal junior thinking. Click to expand.
Red flags & common mistakes
The phrases that signal junior thinking. Click to expand.
Reporting ASR alone and calling it a safety win. A model fine-tuned to refuse 'how do I cook pasta' gets ASR near zero,and is useless in production.
60 second bullets to scan on the way to the call.
Define ASR precisely (numerator, denominator, judge)
Explain the refuse-everything degenerate case and why it requires a paired metric
Primary sources. Browse if you want the original framing.
Same topic, related formats. Practice these next.