<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="park-etal-2026-fragility">
    <titleInfo>
        <title>The Fragility of Jailbreak Robustness Across Operational States</title>
    </titleInfo>
    <name type="personal">
        <namePart type="given">Yuna</namePart>
        <namePart type="family">Park</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Hwang</namePart>
        <namePart type="given">Youn</namePart>
        <namePart type="family">Kim</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Yujin</namePart>
        <namePart type="family">Kim</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Won</namePart>
        <namePart type="given">Woo</namePart>
        <namePart type="family">Ro</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Suhyun</namePart>
        <namePart type="family">Kim</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Jae-In</namePart>
        <namePart type="family">Hwang</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <originInfo>
        <dateIssued>2026-10</dateIssued>
    </originInfo>
    <typeOfResource>text</typeOfResource>
    <relatedItem type="host">
        <titleInfo>
            <title>Findings of the Association for Computational Linguistics: EMNLP 2026</title>
        </titleInfo>
        <name type="personal">
            <namePart type="given">Hung-Yi</namePart>
            <namePart type="family">Lee</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Sunipa</namePart>
            <namePart type="family">Dev</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Jessy</namePart>
            <namePart type="family">Li</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Desmond</namePart>
            <namePart type="family">Elliott</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <originInfo>
            <publisher>Association for Computational Linguistics</publisher>
            <place>
                <placeTerm type="text">Budapest, Hungary</placeTerm>
            </place>
        </originInfo>
        <genre authority="marcgt">conference publication</genre>
        <identifier type="isbn">979-8-89176-462-0</identifier>
    </relatedItem>
    <abstract>Existing jailbreak evaluations typically characterize robustness using a single attack success rate (ASR), implicitly assuming that the target model operates in its default configuration (the vanilla state). However, user–LLM interactions naturally induce diverse operational states beyond the vanilla state. In this work, we find that jailbreak robustness is highly fragile to operational-state variation: even when the attack remains fixed, changing only an ordinary, safety-irrelevant system prompt can dramatically alter attack success rates. We systematically investigate this phenomenon across seven aligned models and three representative jailbreak attacks, finding that in 18 of 21 model–attack combinations, at least one non-vanilla state yields a higher ASR than the vanilla state. In some case, ASR increases by up to 56 percentage points (2%→58%) solely due to a change in operational state. Remarkably, these gains emerge on top of attacks originally designed and optimized under vanilla-state evaluation. We further provide evidence that operational-state variation systematically shifts hidden representations along a refusal-related axis and that these shifts strongly predict jailbreak outcomes. Our results reveal that vanilla-state, single-point evaluations may overlook substantial robustness variation induced by operational states, motivating robustness evaluation that considers stability across operational states.</abstract>
    <identifier type="citekey">park-etal-2026-fragility</identifier>
    <identifier type="doi">10.18653/2026.findings-emnlp.1840</identifier>
    <location>
        <url>https://aclanthology.org/2026.findings-emnlp.1840/</url>
    </location>
    <part>
        <date>2026-10</date>
        <extent unit="page">
            <start>39277</start>
            <end>39298</end>
        </extent>
    </part>
</mods>
</modsCollection>

%0 Conference Proceedings
%T The Fragility of Jailbreak Robustness Across Operational States
%A Park, Yuna
%A Kim, Hwang Youn
%A Kim, Yujin
%A Ro, Won Woo
%A Kim, Suhyun
%A Hwang, Jae-In
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Findings of the Association for Computational Linguistics: EMNLP 2026
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-462-0
%F park-etal-2026-fragility
%X Existing jailbreak evaluations typically characterize robustness using a single attack success rate (ASR), implicitly assuming that the target model operates in its default configuration (the vanilla state). However, user–LLM interactions naturally induce diverse operational states beyond the vanilla state. In this work, we find that jailbreak robustness is highly fragile to operational-state variation: even when the attack remains fixed, changing only an ordinary, safety-irrelevant system prompt can dramatically alter attack success rates. We systematically investigate this phenomenon across seven aligned models and three representative jailbreak attacks, finding that in 18 of 21 model–attack combinations, at least one non-vanilla state yields a higher ASR than the vanilla state. In some case, ASR increases by up to 56 percentage points (2%→58%) solely due to a change in operational state. Remarkably, these gains emerge on top of attacks originally designed and optimized under vanilla-state evaluation. We further provide evidence that operational-state variation systematically shifts hidden representations along a refusal-related axis and that these shifts strongly predict jailbreak outcomes. Our results reveal that vanilla-state, single-point evaluations may overlook substantial robustness variation induced by operational states, motivating robustness evaluation that considers stability across operational states.
%R 10.18653/2026.findings-emnlp.1840
%U https://aclanthology.org/2026.findings-emnlp.1840/
%U https://doi.org/10.18653/2026.findings-emnlp.1840
%P 39277-39298

Markdown (Informal)

[The Fragility of Jailbreak Robustness Across Operational States](https://aclanthology.org/2026.findings-emnlp.1840/) (Park et al., Findings 2026)

• The Fragility of Jailbreak Robustness Across Operational States (Park et al., Findings 2026)

ACL

• Yuna Park, Hwang Youn Kim, Yujin Kim, Won Woo Ro, Suhyun Kim, and Jae-In Hwang. 2026. The Fragility of Jailbreak Robustness Across Operational States. In Findings of the Association for Computational Linguistics: EMNLP 2026, pages 39277–39298, Budapest, Hungary. Association for Computational Linguistics.