2026 Under Submission
Jailbreak attacks on large language models are usually evaluated by attacker-centric metrics such as attack success rate (ASR), yet an attack that breaks a model is not necessarily useful for improving its safety. We propose a defender-centric view of jailbreak evaluation, where attacks are evaluated by the downstream safety improvements they enable when used as red-teaming data for safety training. Building on this view, we introduce A-MESS (Minimal Effective Attack-Subset Selection), a setting-agnostic framework for attributing and selecting jailbreak attacks from black-box subset utility observations. A-MESS estimates AttackSHAP, a Shapley-based score that attributes marginal utility to individual attacks and selects compact attack subsets under user-specified budgets via greedy or surrogate-based optimization. Across controlled utility landscapes and real LLM safety settings, we find that ASR rankings are weakly aligned with defender-centric utility, that AttackSHAP can be estimated accurately with limited utility queries, and that directly optimizing subsets yields stronger safety utility than attacker-centric or attribution-only selection. These results suggest evaluating jailbreak attacks as resources for improving safety, not only as tools for breaking models.
01
A safety setting defines a black-box utility function \(v_\theta(S)\) over attack subsets. The value of a subset is measured after it is used inside a defense workflow and evaluated on held-out jailbreak and over-refusal tests.
02
Attacks are treated as players in a cooperative game. AttackSHAP assigns each attack an average marginal utility contribution across subset contexts, making contribution setting-specific rather than purely attack-centric.
03
A-MESS solves the budgeted subset-selection problem with two complementary solvers: a direct greedy search over true marginal gains, and a surrogate search over a learned utility landscape \(\hat v_\theta\).
AttackSHAP Attribution
\[ \phi_i^\theta = \mathbb{E}_{\pi} \left[ v_\theta(P_i^\pi \cup \{a_i\}) - v_\theta(P_i^\pi) \right] \]
Budgeted Selection
\[ S_k^\star = \arg\max_{S \subseteq \mathcal{A},\, |S|=k} v_\theta(S) \]
0.215
No-defense ASR and singleton ICD utility are weakly correlated in the real setting, with Spearman ρ = 0.215 and Kendall τ = 0.190.
0.828
On real Qwen2.5-7B adversarial-training utilities, the surrogate reaches R^2 = 0.828 with 150 training subsets.
82.69%+
On synthetic landscapes, A-MESS-GREEDY recovers at least 82.69% of the oracle improvement gap for nontrivial budgets.
0.9397
In the Ministral-3 ICD setting, both A-MESS solvers select {1, 2, 3, 6} for k = 4 and reach utility 0.9397.
| Method | Selected subset | Utility | Normalized gain |
|---|
Horizontal view of how no-defense attack success and defender-side singleton ICD utility rank the same jailbreak attacks differently.
Synthetic evaluation of A-MESS-SURROGATE: panel 3a evaluates surrogate utility prediction, panel 3b compares full-vector AttackSHAP estimation, and panel 3c measures top-k overlap with reference AttackSHAP.
Table 4 reports synthetic subset selection results by normalized utility gain across 90 utility landscapes.
Table 5 reports real ICD subset selection on Ministral-3 for k = 2 and k = 4.
Reframing. Jailbreak attacks are evaluated as resources for improving safety alignment, not only as tools for breaking an undefended model.
Attribution. AttackSHAP uses Shapley-style marginal contribution to assign setting-specific credit to individual jailbreak attacks.
Selection. A-MESS turns attribution into a practical subset decision by selecting compact attack sets that maximize downstream defense utility.
@misc{zhou2026jailbreakattacksinformsafety,
title={How Jailbreak Attacks Inform Safety Alignment: A Defender-Centric, Shapley-Based Evaluation of Jailbreak Contributions},
author={Yukai Zhou and Feiyang Lu and Xiaokai Mao and Jinfei Liu and Wenjie Wang},
year={2026},
eprint={2607.17152},
archivePrefix={arXiv},
primaryClass={cs.CR},
url={https://arxiv.org/abs/2607.17152},
}