{
  "abstract": "Best-of-$N$ jailbreaking (BoN) bypasses safeguards of aligned models by drawing $N$ independent augmentations of an unsafe prompt and sampling $M$ completions of each. Previous works have shown that the attack success rate (ASR) seems to follow a power-law in $N$, which we challenge. The exponent drifts with $N$, with an exponential crossover which is a finite-size artifact of the adversarial dataset. Little work has been done to explore the entire two-budget ($N, M$) attack surface as well as its dependence on the generation temperature $T$. We introduce a simple barrier model where each prompt has a baseline safety level and each augmentation a random thermally activated barrier. Then four numbers, each backed by an interpretable safety mechanism, determine the entire ($N, M$) attack surface. They extrapolate predictions from $N \\leq 100$ to $N = 10^4$, collapse five distinct models on the same scaling function and predict ASR at different temperatures from the one they were fitted at.",
  "abstract_shown": true,
  "affiliations": [],
  "article_type": null,
  "arxiv": "2609.32116",
  "author_total": 1,
  "authors": [
    {
      "name": "Marco Biroli"
    }
  ],
  "bibtex": "https://research.draconitic.com/paper/0kxybpjr5jbyj.bib",
  "cited_by": 0,
  "doi": "10.48550/arxiv.2609.32116",
  "fulltext_url": null,
  "id": "0kxybpjr5jbyj",
  "issns": [],
  "landing_url": "https://arxiv.org/abs/2609.32116",
  "language": null,
  "licence": "CC-BY-4.0",
  "licence_label": "CC BY 4.0",
  "licence_source": "article",
  "licence_url": "http://creativecommons.org/licenses/by/4.0/",
  "metadata_licence": "CC0-1.0",
  "native_subjects": [
    [
      "arxiv",
      "cond-mat.stat-mech"
    ],
    [
      "arxiv",
      "cs.AI"
    ],
    [
      "openalex",
      "1702|Adversarial Robustness in Machine Learning"
    ]
  ],
  "openalex": "W7214806322",
  "pdf_url": "https://arxiv.org/pdf/2609.32116",
  "pmcid": null,
  "pmid": null,
  "published": "2026-09-26",
  "publisher": null,
  "ris": "https://research.draconitic.com/paper/0kxybpjr5jbyj.ris",
  "sources": [
    {
      "first_seen": "2026-10-30T12:25:12Z",
      "native_id": "2609.32116",
      "source": "arxiv",
      "url": "https://arxiv.org/abs/2609.32116"
    }
  ],
  "subjects": [
    {
      "field": "physics",
      "origin": "arxiv:cond-mat.stat-mech",
      "subfield": "statistical-nonlinear"
    }
  ],
  "title": "Escaping Alignment: A Physical Trap Model of Best-of-N Jailbreaking",
  "title_text": "Escaping Alignment: A Physical Trap Model of Best-of-N Jailbreaking",
  "type": "preprint",
  "updated_at": "2026-10-30T12:25:12Z",
  "url": "https://research.draconitic.com/paper/0kxybpjr5jbyj",
  "venue": "arXiv",
  "versions": []
}