Researchers Propose Compute-Aware Framework for Evaluating Adversarial Robustness in Language Models

A new preprint from arXiv introduces a framework for evaluating how difficult it is to jailbreak large language models (LLMs) by measuring adversarial effort in terms of computational cost—specifically cumulative floating-point operations (FLOPs)—rather than the conventional attack success rate (ASR) under a fixed query budget. The authors argue that existing metrics obscure true attacker effort because different attack strategies vary in cost by orders of magnitude. Their framework introduces 'risk-compute curves' and two summary metrics that map compute budgets to attack risk across models. Key findings include that alignment training has non-monotonic effects on robustness in compute space, that scaling model size reduces vulnerability to expensive gradient-based attacks but not to cheaper template-based ones, and that gradient-based attacks can transfer from surrogate to target models, lowering attacker costs. The study also found that computational cost to succeed varies by up to approximately five times across different harm categories within a single model, and that safety-aligned reinforcement learning raises aggregate attack cost while leaving certain harm categories disproportionately accessible. The researchers have released their framework publicly to support more rigorous, compute-aware safety evaluations.