Escaping Alignment: A Physical Trap Model of Best-of-N Jailbreaking
Abstract
Best-of-N jailbreaking (BoN) bypasses safeguards of aligned models by drawing N independent augmentations of an unsafe prompt and sampling M completions of each. Previous works have shown that the attack success rate (ASR) seems to follow a power-law in N, which we challenge. The exponent drifts with N, with an exponential crossover which is a finite-size artifact of the adversarial dataset. Little work has been done to explore the entire two-budget ($N, M$) attack surface as well as its dependence on the generation temperature T. We introduce a simple barrier model where each prompt has a baseline safety level and each augmentation a random thermally activated barrier. Then four numbers, each backed by an interpretable safety mechanism, determine the entire ($N, M$) attack surface. They extrapolate predictions from N ≤ 100 to N = 104, collapse five distinct models on the same scaling function and predict ASR at different temperatures from the one they were fitted at.
Related
- Escaping Solar Capture: Majoron mediated Elastic Dark Matter for the LZ 248~keV Event
- Asymptotic behaviour for escaping an interval by Lévy flights under stochastic resetting
- Escaping the Composite Fermi Sea: An Incompressible State at Half Filling in Graphene's Lowest Landau Level
- Increase of Magnetic Trap Loading Efficiency for 39K Bose--Einstein Condensation Experiments
- Cell Reproduction in a Dark Optical Trap
BibTeX
@misc{biroli2026escaping,
title = {{Escaping Alignment: A Physical Trap Model of Best-of-N Jailbreaking}},
author = {Marco Biroli},
howpublished = {arXiv},
year = {2026},
month = sep,
doi = {10.48550/arxiv.2609.32116},
eprint = {2609.32116},
archivePrefix = {arXiv},
url = {https://arxiv.org/abs/2609.32116},
note = {CC BY 4.0},
}
RIS
TY - UNPB
TI - Escaping Alignment: A Physical Trap Model of Best-of-N Jailbreaking
AU - Marco Biroli
PY - 2026
DA - 2026/09/26
PB - arXiv
DO - 10.48550/arxiv.2609.32116
UR - https://arxiv.org/abs/2609.32116
AB - Best-of-N jailbreaking (BoN) bypasses safeguards of aligned models by drawing N independent augmentations of an unsafe prompt and sampling M completions of each. Previous works have shown that the attack success rate (ASR) seems to follow a power-law in N, which we challenge. The exponent drifts with N, with an exponential crossover which is a finite-size artifact of the adversarial dataset. Little work has been done to explore the entire two-budget ($N, M$) attack surface as well as its dependence on the generation temperature T. We introduce a simple barrier model where each prompt has a baseline safety level and each augmentation a random thermally activated barrier. Then four numbers, each backed by an interpretable safety mechanism, determine the entire ($N, M$) attack surface. They extrapolate predictions from N ≤ 100 to N = 10^4, collapse five distinct models on the same scaling function and predict ASR at different temperatures from the one they were fitted at.
ER -