Same Outcome, Different Evidence: Intent Recovery in LLM Safety Evaluation
Safety evaluations of large language models commonly summarize harmful-output behavior with attack success rate (ASR). Yet the same non-harmful outcome can arise for very different reasons. A model may recover a harmful task and refuse it, fail to recover the task, or respond to something else entirely. Distinguishing these cases becomes especially important under intent-obscuring prompts, where a low ASR does not reveal whether the evaluated task was actually engaged. To make this distinction explicit, we pair ASR with operative understanding rate (UR), which measures whether a response both identifies the evaluated task and treats it as the task to be answered. Across interfaces, this p...
| Authors | Haitong Jiang, Chunlin Liu, Sihan Tang et al. |
|---|---|
| Primary category | cs.CL |
| Published | 8 October 2026 |
| Last updated at source | 8 October 2026 |
Popularity, last 2 days
0 now. Counts as reported by the source, snapshotted daily by Silytics.
Connected in the knowledge graph
- ArthurTThomas/IRISDataset · cited by
Models and datasets referencing this paper
- ArthurTThomas/IRISDataset
Silytics shows public metadata from arXiv and links to the original. Information may be incomplete or out of date. Last refreshed 17 October 2026. Licenses and terms of the original apply to the work itself. Not financial, legal or professional advice.