The Fragility of Jailbreak Robustness Across Operational States

Abstract

Existing jailbreak evaluations typically characterize robustness using a single attack success rate (ASR) measured in a default configuration (the vanilla state). However, user-LLM interactions can induce diverse operational states beyond the vanilla state. In this work, we find that jailbreak robustness is highly fragile to operational-state variation: even when the attack remains fixed, changing only an ordinary system prompt not designed to affect safety can dramatically alter attack success

Categories

Framework mappings

Suggested from the entry's categories.

@misc{park2026fragility,
  title = {{The Fragility of Jailbreak Robustness Across Operational States}},
  author = {Yuna Park and Hwang Youn Kim and Yujin Kim and Won Woo Ro and Suhyun Kim and Jae-In Hwang},
  year = {2026},
  month = aug,
  eprint = {2608.30748},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2608.30748}
}