Attack success rate (ASR)

Attack success rate (ASR) is the fraction of adversarial attempts against an AI system that achieve the attacker's goal, such as eliciting harmful content, leaking a secret or triggering an unauthorised tool call. It is the primary metric for red teaming and for measuring how well guardrails work.

Definition and confidence interval

With $n$ attack attempts of which $k$ succeed, the point estimate is

Because $n$ is often small and ASR often near zero, report a Wilson score interval rather than the normal approximation:

where $\hat{p}=k/n$ and $z=1.96$ for 95% confidence. The Wilson interval stays inside $[0,1]$ and behaves sensibly when $k=0$.

Worked example

Illustrative numbers: a red team runs 200 jailbreak attempts and 12 succeed: $\widehat{\text{ASR}}=6\%$, with a 95% Wilson interval of about 3.5% to 10.2%. If another run of 50 attempts has zero successes, the interval is 0% to 7.1%: "zero observed" is not "zero risk", and the upper bound is what a risk owner should read.

Choices that change the number

• What counts as success. A non-refusal is not the same as harmful output. Judge success with a calibrated classifier or human labels against a written rubric.
• Attempt budget. Per-attempt ASR $p$ and "success within $m$ tries" differ: the latter is $1-(1-p{)}^m$. At $p=5\%$ and $m=20$, that is about 64%. State which one you report.
• Attack set. ASR against a static list of known prompts measures memorisation of that list. Adaptive attacks that optimise against the specific system give a more honest upper estimate.
• Unit of analysis. Several attempts per behaviour are correlated, so compute intervals with clustering by behaviour.

Standardised harnesses such as HarmBench (Mazeika et al., 2024) fix the behaviour set, attack budget and success classifier, which is what makes ASR numbers comparable across models.

Why it matters

ASR is how security claims about AI systems become comparable and testable. On its own it is incomplete: a guardrail can reach 0% ASR by blocking everything. Always report it next to the false-positive rate on benign traffic, with confidence intervals and the attack budget stated.

Related terms

• AI red teaming
• Guardrail false-positive rate
• Jailbreak
• Prompt injection
• AI guardrails
• Adversarial robustness

Sources

1. Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, David Forsyth, Dan Hendrycks. HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal, 2024. arxiv.org
2. Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion. Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks, 2024. arxiv.org