The authors model a prompt's continuation distribution as a bounded tree of token prefixes, label terminal nodes as harmful or safe with the HarmBench-Mistral-7B semantic evaluator, and use exact probabilistic model checking to compute bounded harm reachability.
Attack success rate misses latent harmful continuations reachable after a refusal
The authors introduce bounded continuation analysis to quantify the probability that a model reaches harmful output, revealing hidden risk invisible to standard jailbreak metrics.
Independent
Parv Kapoor · Teresa Fortes · Claudia Mamede · Rui Abreu · Jonathan Aldrich · Eunsuk Kang
Research Digest··2 min read
The authors propose Bounded Continuation Analysis (BCA), which treats autoregressive generation as a stochastic process over token prefixes and computes the finite-horizon probability of reaching a harmful continuation.
§