Beyond Attack Success Rate: Cost-Aware Metric for Evaluating Iterative LLM Jailbreaks
This work introduces $\mathrm{ASR}_{\mathrm{STEP}}$, which penalizes additional victim-model calls while retaining binary success judgments, and considers GCG, PAIR with a step budget, and a single-step PAP baseline on JailBreakBench across three model families.