Egida Safety Eval

---
name: egida-safety-eval
description: Evaluates the robustness of LLMs against jailbreaking attacks after safety alignment. It measures how well models refuse harmful prompts across diverse topics and attack styles, while also tracking unintended side effects like over-refusal and general capability degradation. Use when the user wants to benchmark on Egida, or asks about evaluating this task. Reports ASR.
metadata:
  skill_kind: dataset_eval
  source_arxiv: 2502.13603
  bibtex_key: [REDACTED]
  confidence: high
---

# egida-safety-eval

> Efficient Safety Retrofitting Against Jailbreaking for LLMs — Garcia-Gasulla et al. (2025) (arXiv:2502.13603, 2025)

## What this evaluates

Evaluates the robustness of LLMs against jailbreaking attacks after safety alignment. It measures how well models refuse harmful prompts across diverse topics and attack styles, while also tracking unintended side effects like over-refusal and general capability degradation.

## Datasets

- **Egida** — total ?; splits: train (-1), test (-1)

## Metrics

- `ASR` **(primary)** — range: percent
  - The percentage of jailbreak prompts that successfully elicit a harmful or unsafe response from the model. Calculated as (number of successful attacks / total prompts) × 100. Lower values indicate better safety.
- `Refusal Rate` — range: percent
  - The percentage of safe prompts that are incorrectly refused by the model, determined via keyword matching on the model's output.
- `ROUGE` — range: [0, 1]
  - N-gram overlap metric used to measure open-ended generation quality on general benchmarks. Sensitive to stylistic changes in model outputs.

## Input / output format

**Input**: Jailbroken or unsafe prompts, often augmented with specific jailbreaking templates and covering 27 safety topics and 18 attack styles.

**Output**: Natural language text responses generated by the LLM.

## Scoring recipe

```python
def compute_asr(prompts, responses):
    successful = 0
    for prompt, response in zip(prompts, responses):
        if is_unsafe(response):  # Typically via classifier or keyword match
            successful += 1
    return (successful / len(prompts)) * 100
```

## Common pitfalls

- ASR is reported as a percentage where lower is better; confusing it with accuracy leads to misinterpreting results.
- Keyword-based refusal detection can misclassify nuanced safe responses as refusals, inflating over-refusal rates.
- ROUGE scores on open-ended benchmarks may drop due to stylistic shifts (e.g., over-refusal) rather than actual capability loss.

## Evidence (verbatim from paper)

> Figure 3: Performance of the four models under study on the four evaluation safety benchmarks. Y axis shows performance in attack success rate (ASR, lower better), and X axis shows an increasing amount of data used for alignment.

## Citation

```bibtex
@misc{garcia-gasulla2025efficient,
  title={Efficient Safety Retrofitting Against Jailbreaking for LLMs},
  author={Garcia-Gasulla et al. (2025)},
  year={2025},
  note={arXiv:2502.13603}
}
```

- arXiv: 2502.13603