Define attack success rate and pair it with the metric you must track alongside

Attempt it

ASR is the fraction of adversarial prompts in your suite where the model produced an unsafe or off-policy output. Lower is better. Track refusal rate on a benign suite alongside: a model that refuses everything has ASR = 0% but is useless. The honest scoreboard is the Pareto frontier of ASR vs benign-task pass rate, evaluated at a fixed guardrail configuration. Improving ASR at the cost of benign-pass is not safety progress; it is over-refusal.

Your answer

Quick reference

TL;DR

ASR is the fraction of adversarial prompts that produced an unsafe output; pair it with benign-task pass rate, because refuse-everything trivially zeros ASR.

Memory aid

Sign in for the mnemonic that makes this stick. See Pro pricing.

Easy to grasp

Picture grading a security guard by how many bad guys got through the door. If the only metric is bad guys blocked, the highest-scoring guard is the one who slams the door on everyone,including paying customers. To grade the guard fairly, you also count how many real customers got let in normally. Safety evaluations work the same way. Attack success rate tells you how often the bad prompts win. Benign pass rate tells you whether the system is still useful for everyone else. Either number on its own is gameable. Together they tell the true story.

Key concepts

Safety and Guardrails LLM Evaluation

Quick scan · 2–4 min

Everything important, quickly.

8 min: define ASR, walk the refuse-everything trap, set up the Pareto-frontier framing, address judge variance and suite versioning, and close on launch-gate design.

Side-by-side

Metric	What it measures	Failure mode if reported alone
ASR	Fraction of adversarial prompts that produced unsafe output	Refuse-everything model scores zero and looks 'safe'
Benign pass rate	Fraction of on-policy prompts answered correctly	Says nothing about how the model behaves under attack
Refusal rate (benign)	Fraction of benign prompts the model refuses	Tells you over-refusal cost but not adversarial robustness

Real-world examples

Real products, models, and research that use this idea.

Anthropic's responsible-scaling evals track adversarial ASR alongside MMLU-style benign capability so a safety tune does not silently degrade usefulness.
MLCommons AILuminate v1.0 (2025) reports per-category attack-success rates paired with a benign refusal-cost metric to expose over-refusal.
OpenAI's o4 system card pairs harmful-output rates with over-refusal measurements on the WildGuardMix and XSTest suites.
DeepMind's frontier safety evaluations on Gemini 3.1 Pro publish refusal rates on benign prompts alongside attack success across the persuasion-taxonomy suite.

Interviewer follow-ups

What an interviewer would ask next. Try answering before peeking at the approach.

QHow would you decompose ASR across attack categories to make it actionable?

Sign in or go Pro to see the approach for this follow-up.

QWhat if your LLM-as-judge for ASR disagrees with human raters 20% of the time on a category?

Sign in or go Pro to see the approach for this follow-up.

60-second cheat sheet

The night-before-the-interview bullets. Scan these on the way to the call.

Sign in for 5 unlocks/day or go Pro for unlimited revision sheets. See Pro pricing.

References

Primary sources. Skim if you want the original framing.