Elamur Research⌕
☰
home / papers / 2026 / Quantifying LLM Safety Degradation Under Repeated Attacks Using Survival Analysis

Quantifying LLM Safety Degradation Under Repeated Attacks Using Survival Analysis

Paper · 2026 · Zvi Topol

Summary

Most jailbreak benchmarks report only whether an attack succeeded. They ignore how many repeated tries a model withstands before it produces harmful output. Topol reframes this as a time-to-event problem. "Time" is the number of verbatim repetitions of the same prompt, which matters because deployed LLMs sample outputs non-deterministically. Attempts that never succeed are treated as censored observations.

The setup:

  • 60 HarmBench prompts, 20 from each of three categories.
  • Each prompt was sent to three small local models up to ten times, using PyRIT.
  • An LLM judge labelled the responses.
  • Non-parametric Kaplan-Meier curves and discrete hazard functions were estimated from the results, and models were compared with the log-rank test.

The models differed clearly. Phi-3 Mini failed more often and much earlier in every category. The other two showed steadier, moderate vulnerability, and Qwen kept a fairly flat, low hazard.

The work is preliminary, but it shows that survival curves reveal things binary attack success rates hide. They identify vulnerability windows, help pick models suited to long sessions, and help red teams prioritise high-early-hazard prompts.

Key points

  • Models: Phi-3 Mini-4K-Instruct (3.8B), Llama 3.2 3B Instruct and Qwen3-4B-Instruct, all run through Ollama on a 24GB MacBook.
  • Prompts: drawn from three HarmBench categories (Misinformation & Disinformation, Illegal Activities, General Harm). Each was repeated until a jailbreak occurred or ten refusals or low-risk replies were reached.
  • Jailbreak definition: a response counts as a jailbreak if it reaches L3 ("Procedural Compliance") or L4 ("Direct Compliance") on a five-level scale. L0–L2 count as refusals or low-risk responses.
  • Judge selection: Llama 3.1 70B Instruct Turbo was chosen as judge over Qwen3-Next 80B. Tested against human labels on 749 non-benign WildGuard cases, it agreed 76.5% of the time, versus 71.6%.
  • Code: released at github.com/zvitop/llm-jailbreak-survival-analysis.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 16,667 worksArtificial Intelligence · 16,194 worksArts and Humanities · 16,039 worksLanguage and Linguistics · 15,891 works

🧭 Topics 2Research subjects and languages the work is about.Language models & pretraining · 3,320 worksBias, fairness & safety · 517 works

Cite

Cite as Zvi Topol. 2026. Quantifying LLM Safety Degradation Under Repeated Attacks Using Survival Analysis. Proceedings of the 6th Workshop on Trustworthy NLP (TrustNLP 2026).

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.trustnlp-main.5

@inproceedings{topol2026quantifying,
  title = {{Quantifying LLM Safety Degradation Under Repeated Attacks Using Survival Analysis}},
  author = {Zvi Topol},
  booktitle = {Proceedings of the 6th Workshop on Trustworthy NLP (TrustNLP 2026)},
  year = {2026},
  doi = {10.18653/v1/2026.trustnlp-main.5},
  url = {https://doi.org/10.18653/v1/2026.trustnlp-main.5}
}

References

9 references, 6 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, and 1 others. 2020. Language models are few-shot learners. Advances in Neural Information Processing Systems, 33:1877–1901.
  2. OpenAI. 2023. GPT-4 technical report. arXiv preprint arXiv:2303.08774.
  3. Xinyue Shen, Zeyuan Chen, Michael Backes, Yun Shen, and Yang Zhang. 2023. “do anything now”: Characterizing and evaluating in-the-wild jailbreak prompts on large language models. arXiv preprint arXiv:2308.03825.
  4. Patrick Chao, Edoardo Debenedetti, Alexander Robey, Maksym Andriushchenko, Francesco Croce, Vikash Sehwag, Edgar Dobriban, Nicolas Flammarion, George J. Pappas, Florian Tramèr, Hamed Hassani, and Eric Wong. 2024. Jailbreakbench: An open robustness benchmark for jailbreaking large language models. In…
  5. Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. 2023. Jailbroken: How does LLM safety training fail? Advances in Neural Information Processing Systems, 36.
  6. Tinghao Xie, Xiangyu Qi, Yi Zeng, Yangsibo Huang, Udari Madhushani Sehwag, Kaixuan Huang, Luxi He, Boyi Wei, Dacheng Li, Ying Sheng, Ruoxi Jia, Bo Li, Kai Li, Danqi Chen, Peter Henderson, and Prateek Mittal. 2025. Sorry-bench: Systematically evaluating large language model safety refusal. find
  7. Michael D’Angelo. 2025. Why attack success rate (asr) isn’t comparable across jailbreak papers without a shared threat model. Promptfoo Blog. Accessed: 2026-02-05. find
  8. Langqi Yang, Tianhang Zheng, Kedong Xiu, Yixuan Chen, Di Wang, Puning Zhao, Zhan Qin, and Kui Ren. 2025. Harmmetric eval: Benchmarking metrics and judges for llm harmfulness assessment. arXiv preprint arXiv:2509.24384. — [arXiv:2509.24384](https://arxiv.org/abs/2509.24384) find
  9. Andy Zou, Zifan Wang, J Zico Kolter, and Matt Fredrikson. 2023. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043.

Updated

This page in Markdown → https://md.research.elamur.ai/free/en/papers/topol-2026-quantifying-llm-safety-degradation-under/