Validity-Aware Jailbreak Evaluation for Large Language Models
The paper argues that jailbreak evaluation for LLMs is often too focused on whether a model appears to comply or gives semantically relevant harmful-looking text, and proposes SEAV, a framework that checks whether the response’s ordered steps are actually factual, coherent, and operationally useful for the harmful goal. Its main insight is that many “successful” jailbreaks are bogus once you validate their procedural correctness, so SEAV meaningfully lowers false positives and changes robustness conclusions; the tradeoff is that it depends on LLM judges, retrieval quality, and benchmark-specific notions of what counts as actionable validity.
Abstract
Jailbreak robustness has become central to large language model (LLM) safety evaluation, yet prevailing methodologies rely primarily on refusal behavior, semantic resemblance, and intent-matching heuristics that emphasize linguistic plausibility rather than correctness. We identify a key limitation in existing evaluations: many jailbreak intents depend on instructional validity rather than epistemic factuality, allowing realistic-looking responses to be labeled successful despite being factually or procedurally incorrect. To address this gap, we propose Sequential Epistemic and Action-Level Validation (SEAV), a verification-centric jailbreak evaluation framework that decomposes responses into ordered steps and evaluates both validity and correctness. SEAV combines LLM-as-a-judge mechanisms for semantic interpretation with retrieval-grounded verification using external knowledge sources, assessing whether generated content is factually correct, structurally consistent, and operationally capable of advancing harmful objectives. Empirically, SEAV cuts the false-positive rate on SD-A (a curated strategic-dishonesty diagnostic) by 14.9\,pp vs. the strongest baseline, and reclassifies 22.1\%--51.0\% of sampled prior-labeled successes as invalid across three of four public benchmarks. Together, these results show that enforcing correctness substantially reshapes measured robustness: many previously labeled jailbreak successes are reclassified as invalid, and results are stable across the tested search backends and evaluator models. Code and data are available at https://github.com/Ardor-Wu/SEAV.