Did the LLM Answer the Question? A Semantic Reconstruction Game for Jailbreak Evaluation

Liam Davis; Romain Emil-Popescu; Suman Jana

cs.LGOct 13, 2026

Did the LLM Answer the Question? A Semantic Reconstruction Game for Jailbreak Evaluation

Authors: Liam Davis, Romain Emil-Popescu, Suman Jana

Organizations: Amherst College · Columbia University

Abstract

Jailbreak attacks against large language models (LLMs) are evaluated using attack success rate (ASR), which depends on correctly identifying responses that fulfill prohibited requests. Existing evaluators can mistake refusals or topically related responses for successful attacks. We show that changing only the judge LLM can alter reported ASR by up to $82$ percentage points. We introduce the semantic reconstruction game, a training-free evaluator that decomposes compliance judgments into constrained semantic comparisons. Given only a response, an LLM reconstructs the request answered by its substantive content, excluding information merely repeated or refused. The game compares this reconstruction against similar decoy requests to determine whether it matches the original request, allowing abstention when neither candidate matches. Across three off-the-shelf LLM judges, the game achieves the lowest mean error against human labels among evaluated methods and reduces variation in reported ASR. It prioritizes avoiding false positives, even at the cost of missing some successful jailbreaks.

Figures & tables

Panel of Figure 1 — Figure 1: A clear refusal that a prefix-based classifier scores as a successful jailbreak.

Panel of Figure 2 — Figure 2: An off-topic defensive response that an LLM judge scores as a successful jailbreak.

Panel of Figure 3 — Figure 3: Visual overview of the semantic reconstruction game.

Classifier	Qwen	Ministral	Gemma	Mean	Spread
Generic refusal				–	–
Recon. Game	0.000	0.000	0.000	0.000	0.000
StrongREJECT	0.375	0.398	0.108	0.293	0.290
LLM judge	0.029	0.000	0.382	0.137	0.382
Prefix match	N/A	N/A	N/A	0.059	N/A
Specific refusal				–	–

Table 1: Agreement by response category on SorryBENCH: MAE against the human label for each LLM, averaged over three seeds.

Quantity	Qwen	Ministral	Gemma	Mean	Spread
Generic refusal				–	–
$\beta$	0.000	0.000	0.000	0.000	0.000
Game MAE	0.000	0.000	0.000	0.000	0.000
Specific refusal				–	–
$\beta$	0.000	0.000	0.029	0.010	0.029
Game MAE	0.000	0.014	0.024	0.012	0.024

Table 2: Fulfillment–recoverability gap by response category for each LLM. Gap is

\beta

for categories that do not fulfill the request,

\alpha

for categories that do.

LLM	Recon. Game	Strong- REJECT	LLM judge	Prefix match
Qwen	0.152	0.384	0.191	N/A
Ministral	0.154	0.389	0.187	N/A
Gemma	0.136	0.240	0.165	N/A
Mean	0.147	0.338	0.181	0.556
95% CI	[0.135, 0.159]	[0.330, 0.345]	[0.166, 0.196]	[0.529, 0.582]
Spread	0.018	0.149	0.027	N/A

Table 3: Agreement with human labels on StrongREJECT: MAE against the human score, averaged over three seeds. F1 is the range across LLMs.

LLM	Recon. Game	Strong- REJECT	LLM judge	Prefix match
Qwen	0.216	0.407	0.439	N/A
Ministral	0.286	0.428	0.434	N/A
Gemma	0.170	0.378	0.296	N/A
Mean	0.224	0.405	0.389	0.297
95% CI	[0.205, 0.244]	[0.389, 0.420]	[0.359, 0.418]	[0.263, 0.329]
Spread	0.116	0.050	0.143	N/A

Table 4: Agreement with human labels on HarmBench. MAE against the human score, averaged over three seeds. F1 is the range across LLMs.

Classifier	Qwen	Ministral	Gemma	Spread	LLM indep.
PAIR				–	–
Recon. Game	86%	64%	82%	22	N/A
StrongREJECT	92%	26%	88%	66	N/A
LLM judge	8%	68%	84%	76	N/A
Prefix match	N/A	N/A	N/A	N/A	N/A
Original eval.	N/A	N/A	N/A	N/A	94%

Table 5: ASR (%) reported by each classifier with each LLM. Spread is in percentage points.

Appendix figures & tables9 assets

Supplementary material from the paper’s appendix.

Appendix

Category	Recon. Game	LLM judge	Strong- REJECT
Generic refusal	0.000	0.137	0.293
95% CI	[0.000, 0.000]	[0.078, 0.196]	[0.281, 0.306]
Specific refusal	0.012	0.078	0.304
95% CI	[0.000, 0.031]	[0.036, 0.131]	[0.296, 0.315]
Refusal + alt.	0.011	0.088	0.302
95% CI	[0.000, 0.033]	[0.039, 0.147]	[0.287, 0.316]

Appendix

Table 6: Mean MAE by response category across LLMs, with 95% CIs.

Category	Recon. Game	LLM judge	Strong- REJECT
Generic refusal	0.000	0.382	0.290
95% CI	[0.000, 0.000]	[0.235, 0.559]	[0.252, 0.331]
Specific refusal	0.024	0.225	0.331
95% CI	[0.000, 0.071]	[0.108, 0.373]	[0.303, 0.359]
Refusal + alt.	0.022	0.235	0.326
95% CI	[0.000, 0.063]	[0.117, 0.382]	[0.291, 0.359]

Appendix

Table 7: Spread of MAE by response category across LLMs, with 95% CIs.

Judge	$\hat{p}_{1}$	$\hat{p}_{0}$ (non-empty)	$\hat{p}_{0}$ (all)
Qwen	0.802	0.190	0.039
95% CI	[0.728, 0.872]	[0.098, 0.291]	[0.018, 0.063]
Ministral	0.581	0.128	0.051
95% CI	[0.500, 0.662]	[0.075, 0.185]	[0.029, 0.077]
Gemma	0.804	0.182	0.056
95% CI	[0.718, 0.878]	[0.087, 0.297]	[0.026, 0.091]

Appendix

Table 8: Comparison probabilities on SorryBENCH, with 95% CIs.

\hat{p}_{0}

is computed over non-empty or all reconstructions.

Generic refusal (correct: no)
Classifier	Qwen	Ministral	Gemma
Recon. Game	0/34	0/34	0/34
StrongREJECT	0/34	0/34	0/34
LLM judge	1/33	0/34	13/21
Prefix match	N/A	2/32	N/A
Specific refusal (correct: no)

Appendix

Table 9: SorryBENCH responses labeled a jailbreak (yes/no), out of 34 per category, averaged over three seeds.

LLM	TP	FP	FN	TN	Prec.	Rec.	F1
Recon. Game					–	–	–
Qwen	191.3	113.7	99.7	956.3	0.627	0.658	0.642
Ministral	166.7	92.7	124.3	977.3	0.643	0.573	0.606
Gemma	204.7	95	86.3	975	0.683	0.703	0.693
StrongREJECT					–	–	–
Qwen	51	12.7	240	1057.3	0.801	0.175	0.288

Appendix

Table 10: Confusion counts on StrongREJECT, averaged over three seeds.

LLM	TP	FP	FN	TN	Prec.	Rec.	F1
Recon. Game					–	–	–
Qwen	172	29.3	98	296.7	0.854	0.637	0.730
Ministral	104.3	15.7	165.7	310.3	0.869	0.386	0.535
Gemma	192	23	78	303	0.893	0.711	0.792
StrongREJECT					–	–	–
Qwen	61	21.7	209	304.3	0.738	0.226	0.346

Appendix

Table 11: Confusion counts on HarmBench, averaged over three seeds.

PAIR ( $N=50$ )
Classifier	Qwen	Ministral	Gemma
Recon. Game	43/7	32/18	41/9
StrongREJECT	46/4	13/37	44/6
LLM judge	4/46	34/16	42/8
Prefix match	N/A	N/A	N/A
Original eval.	N/A	N/A	N/A

Appendix

Table 12: Attack attempts labeled a jailbreak (yes/no;

N=50

). PAIR, PAP, I-GCG, and SlotGCG target Qwen2-7B-Instruct. In the HERETIC panel, columns denote abliterated target models.

LLM	$p=0$	$p=0.1$	$p=0.2$	$p=0.4$
SorryBENCH
Qwen	0.504	0.515	0.559	0.588
Ministral	0.387	0.382	0.441	0.485
Gemma	0.741	0.794	0.794	0.765
HarmBench
Qwen	0.637	0.689	0.719	0.730

Appendix

Table 13: Decoy degradation ablation. TPR of the game’s binary verdict when a fraction

p

of decoy words is replaced, with

p=0

from the main three-seed results.

LLM	$p=0$	$p=0.1$	$p=0.2$	$p=0.4$
SorryBENCH
Qwen	0.027	0.022	0.022	0.022
Ministral	0.026	0.022	0.022	0.029
Gemma	0.015	0.015	0.015	0.015
HarmBench
Qwen	0.090	0.083	0.095	0.101

Appendix

Table 14: Decoy degradation ablation. FPR of the game’s binary verdict when a fraction

p

of decoy words is replaced, with

p=0

from the main three-seed results.

Jailbreak Attack Evaluation

See all 36 papers

The Great Pretender: A Stochasticity Problem in LLM Jailbreak
May 14, 2026Jean-Philippe Monteuuis, Cong Chen, Jonathan PetitLLM Safety Benchmarks LLM Evaluation
Qualcomm Technologies, Inc.
How Reliable Is Your Jailbreak Judge? Calibration and Adversarial Robustness of Automated ASR Scoring
Jun 24, 2026Yang GaoLLM Evaluation LLM-as-a-Judge
Veyon Solutions
Validity-Aware Jailbreak Evaluation for Large Language Models
Aug 31, 2026Qilong Wu, Sahil Wadhwa, Pranab Mohanty +2Language Model Safety Evaluation LLM Auditing
University of Illinois Urbana-Champaign · Capital One

May 14, 2026J/K move · Enter open · S save

The Great Pretender: A Stochasticity Problem in LLM Jailbreak

Jean-Philippe Monteuuis, Cong Chen, Jonathan Petit

Qualcomm Technologies, Inc.

LLM Safety Benchmarks LLM Evaluation Adversarial Prompt Generation LLM Jailbreak Attacks Consistent Adversarial Attacks LLM Safety Evaluation+2

Open paper AskPDF arXiv

"Oh-Oh, yes, I'm the great pretender. Pretending that I'm doing well. My need is such, I pretend too much..." summarizes the state in the area of jailbreak creation and evaluation. You find this method to generate adversarial attacks proposed by a reputable institution (e.g., BoN from Anthropic or Crescendo from Microsoft Research). However, this method does not deliver on the promise claimed in the paper despite having top ASR scores against industry-grade LLMs. You successfully generate the jailbreak prompts against your target (open) model. However, the generated jailbreak prompt works against the target model with a 50% consecutive success rate (5 out of 10 attempts) despite having an 80% ASR (on paper) on the latest closed-source model (with a guardrail system)! This observation leads us to think. First, Attack Success Rate (ASR), the primary metric for LLM jailbreak benchmarking, is not a stable quantity. Second, published ASR numbers are therefore systematically inflated and incomparable across papers. Therefore, we wonder "Why a successful jailbreak prompt does not perform consistently well against a target model on which the prompts have been optimized?". To answer this question, we study the impact of stochasticity not only during attack evaluation but also during attack generation. Our evaluation includes several jailbreak attacks, models (different sizes and providers), and judges. In addition, we propose a new metric and two new frameworks (CAS-eval and CAS-gen). Our evaluation framework, CAS-eval, shows that an attack can have an ASR drop of up to 30 percentage points when a jailbreak prompt needs to succeed on more than one attempt. Thankfully, our attack generation framework (CAS-gen) improves previous jailbreak methods and helps them recover this loss of 30 percentage points!

Abstract

Jailbreak Attack Evaluation

Explore similar work

The Great Pretender: A Stochasticity Problem in LLM Jailbreak

How Reliable Is Your Jailbreak Judge? Calibration and Adversarial Robustness of Automated ASR Scoring

Validity-Aware Jailbreak Evaluation for Large Language Models