Jailbreak Foundry: From Papers to Runnable Attacks for Reproducible Benchmarking

2026-02-27 · Source: cs.CL updates on arXiv.org · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy · Depth: Expert, quick

Summary

Jailbreak Foundry (JBF) is a novel system designed to standardize and accelerate the benchmarking of large language model (LLM) jailbreak techniques. It addresses the challenge of rapidly evolving attacks making existing robustness evaluations quickly outdated and difficult to compare across research. JBF employs a multi-agent workflow to translate published jailbreak papers into executable modules, facilitating immediate evaluation within a unified harness. The system comprises JBF-LIB for shared utilities, JBF-FORGE for the paper-to-module translation, and JBF-EVAL for standardized evaluations. In testing, JBF successfully reproduced 30 attacks, demonstrating high fidelity with a mean attack success rate (ASR) deviation of +0.26 percentage points compared to reported results. It also significantly reduced attack-specific implementation code by over half, achieving an 82.5% mean reused-code ratio. This enables consistent AdvBench evaluation of all 30 attacks across 10 victim models using a GPT-4o judge, offering a scalable solution for living benchmarks.

Key takeaway

For AI Security Engineers or AI Scientists focused on LLM robustness, Jailbreak Foundry offers a critical tool to overcome benchmark drift. You can now integrate new jailbreak techniques from papers into a standardized evaluation harness, ensuring consistent and reproducible comparisons of LLM defenses. This system allows you to maintain living benchmarks that keep pace with evolving threats, significantly improving your ability to assess and enhance model security.

Key insights

Jailbreak Foundry standardizes LLM attack benchmarking by translating papers into executable modules for reproducible evaluation.

Principles

• Standardize attack implementation.
• Unify evaluation harnesses.
• Reduce code duplication for attacks.

Method

JBF uses a multi-agent workflow (JBF-FORGE) to translate jailbreak papers into executable modules. These modules leverage JBF-LIB for shared utilities and are evaluated via JBF-EVAL for standardized benchmarking.

In practice

• Integrate new jailbreak attacks.
• Compare LLM robustness consistently.
• Automate attack evaluation.

Topics

• LLM Jailbreaking
• AI Security
• Reproducible Benchmarking
• Multi-agent Systems
• Attack Success Rate
• AdvBench

Best for: Research Scientist, CTO, VP of Engineering/Data, AI Security Engineer, AI Scientist

Related on AIssential

• JailMeter: An Evidence-Based Evaluation Framework for Jailbreak Attacks on Large Language Models — JailMeter provides a rigorous, evidence-based framework to accurately evaluate LLM jailbreak attack success by filtering noise and confirming malicious intent.
• HarDBench: A Benchmark for Draft-Based Co-Authoring Jailbreak Attacks for Safe Human-LLM Collaborative Writing — LLMs are vulnerable to draft-based jailbreaks in co-authoring, necessitating specialized benchmarks and alignment for safety.
• Context-Fractured Decomposition Attacks on Tool-Using LLM Agents: Exploiting Artifact Provenance Gaps — Context-Fractured Decomposition (CFD) attacks exploit untracked artifact provenance in LLM agents, enabling delayed, multi-step jailbreaks.
• JailbreakOPT: Tool-Assisted Iterative Jailbreak Prompt Optimization — JailbreakOPT improves LLM jailbreaking by combining an atomic prompt library with contextual bandit-guided iterative optimization.
• Jailbreak Scaling Laws for Large Language Models: Polynomial-Exponential Crossover — Adversarial prompt injection transforms LLM jailbreaking success from polynomial to exponential scaling with inference-time samples.
• NeuroArmor: Safe-Variant-Guided Representation Consistency for Selective Re-Anchoring in Jailbreak Defense — NeuroArmor uses prompt-specific safe variants and hidden-state consistency for selective jailbreak defense, balancing safety and helpfulness.

See Counsel's argued verdicts on the open AI decisions leaders are weighing →

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by cs.CL updates on arXiv.org.