{"id":"1d76dc1e-0876-480f-910b-4228c5ec37e2","arxiv_id":"2501.01335","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"A new 12,662-prompt cybersecurity jailbreak benchmark and an obfuscation-based jailbreak method that reportedly outperforms prior methods on AdvBench.","lead":"This paper introduces CySecBench, a dataset of 12,662 cybersecurity prompts for testing whether large language models can be jailbroken into producing attack code. The authors also present a jailbreak method and report success rates of 65% for ChatGPT, 88% for Gemini, and 17% for Claude, plus 78.5% on the AdvBench benchmark.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The 'higher than state-of-the-art' claim is not established: Table VI compares SRs from different judges, target models, and subsets, and the GPT-4o-mini judge itself is unvalidated; Section III-B and Table IV also disagree on subset size.","rationale":"The reader's conditional verdict is sound, and the identified concerns about the unvalidated GPT-4o-mini judge and the non-random subset are real. My stress-test elevates a related but distinct load-bearing issue: even if the judge were perfectly calibrated, Table VI would still not support the 'higher than state-of-the-art' claim because the prior methods' SRs were obtained under different rubrics, target models, and evaluation subsets. The paper concedes this comparability problem in Section III-D but then proceeds to make the superiority claim anyway. The internal 100-vs-50 prompt inconsistency (Section III-B vs. Table IV) further undermines reproducibility of the reported rates. The dataset contribution itself is substantial and publicly released, with a clear generation and filtering methodology, so the benchmark part of the paper can stand. The appropriate verdict remains CONDITIONAL: the authors should either re-run baselines under a common protocol or soften the superiority claim. This does not change the reader's verdict.","tokens_in":16725,"tokens_out":4232,"duration_ms":41605,"concrete_test":"Run a controlled head-to-head benchmark: download the released CySecBench and AdvBench subsets, fix the subset size (100 or 50 per category as actually used), and re-run the proposed method and the baseline methods from Table VI (ArtPrompt, PAIR, ReNeLLM, WordGame if available) on the same target models and the same GPT-4o-mini judge with the Figure 5 rubric. Independently, have a human rater score a blind sample of at least 100 judge decisions to measure judge-human agreement (e.g., Cohen's kappa). If the re-run SOTA SRs overlap the 78.5% result or the judge-human agreement is weak (kappa < 0.6), the superiority claim should be withdrawn or explicitly qualified as setup-dependent.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The headline claim that the obfuscation/refinement method achieves an SR of 78.5% on AdvBench, 'higher than the state-of-the-art methods,' is not supported by the comparison in Table VI. Those numbers come from different experimental setups: ReNeLLM, ArtPrompt, WordGame, and PAIR used different target models, different subsets of AdvBench or other datasets, and different evaluation criteria (e.g., ReNeLLM uses a binary harmfulness classifier), while the 52.5%/78.5% results were generated with the authors' GPT-4o-mini judge that requires executable code for a rating of 5 (Figure 5). The paper itself acknowledges in Section III-D that 'comparing jailbreaking methods is inherently challenging due to the absence of standardized evaluation metrics,' yet the abstract and conclusion present the cross-paper SR comparison as evidence of superiority. Without re-running the prior methods under the same judge, same target model, and same subset, the 'higher than SOTA' claim is preliminary. Compounding this, the judge has not been validated against human raters for cybersecurity harmfulness; the MT-Bench reference supports general quality judgment, not this safety-critical rating rule. The judge's code-required criterion may systematically favor the authors' code-focused attack, making the domain-specific gap partly an artifact of the rubric. There is also an internal inconsistency in the evaluation subset: Section III-B states 100 prompts per category (1,000 total), while Table IV states 50 prompts per category (500 total). The denominators underlying the reported SRs are therefore ambiguous.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces CySecBench, a dataset of 12,662 close-ended cybersecurity prompts in 10 attack-type categories for evaluating LLM jailbreaking. It describes a GPT-based generation and filtration pipeline, proposes a jailbreaking method based on MECE question decomposition, solution generation, and refinement, and reports Success Rate (SR) and Average Rating (AR) for ChatGPT, Gemini, and Claude on subsets of CySecBench and on AdvBench. The authors claim superior performance, reporting a 78.5% SR on AdvBench with the refined method, higher than prior state-of-the-art jailbreak methods.","tokens_in":17044,"tokens_out":4146,"duration_ms":36562,"significance":"If the dataset is valid, it fills a genuine gap: it is large, domain-specific, close-ended, and publicly released, and the generation/filtration methodology is adaptable to other domains. The paper also provides a concrete, reproducible artifact on GitHub and includes an explicit limitations section, which is commendable. However, the experimental evaluation and the headline SOTA comparison rest on an unvalidated judge, a non-random evaluation subset, and an internal inconsistency in subset size, so the performance claims cannot be accepted as currently stated.","major_comments":[{"comment":"The manuscript states that a subset of 'the first 100 prompts from each of the 10 previously presented categories, resulting in a total of 1,000 malicious prompts' is used (Section III-B), but Table IV reports results on a subset of '50 prompts from each category.' These are inconsistent. If the actual subset is 50 per category, all SR and AR numbers in Table IV (e.g., 65.40%, 88.40%, 17.40%) are computed on 500 prompts, not 1000; if it is 100, Table IV's caption is wrong. The discrepancy must be resolved because it changes the denominator and the confidence in every reported performance figure.","section":"Section III-B vs Table IV"},{"comment":"The GPT-4o-mini judge that produces the ground-truth jailbreak ratings is not validated for the cybersecurity harmfulness rubric. The judge instruction explicitly states that a rating of 5 requires executable code for cybersecurity responses (Figure 5); no human agreement study is reported for this rule, and the cited reference [36] (MT-Bench) validates judge alignment for general helpfulness, not for safety-critical cyber harm. Because SR (Eq. 1) is defined as the fraction of rating-5 responses, a systematic bias in the judge (e.g., penalizing correct but non-code answers, or rewarding any code regardless of actual harmfulness) would directly invalidate all reported SRs and the headline 78.5% AdvBench result. The authors should either validate the judge against human raters for this task or report the sensitivity of the results to alternative rating thresholds.","section":"Section III-B and Figure 5"},{"comment":"The claim of 'higher than the state-of-the-art methods' is not supported by Table VI. The SRs for ReNeLLM, ArtPrompt, WordGame, and PAIR come from different target models, different evaluation criteria (e.g., ReNeLLM uses a binary harmfulness classifier), and possibly different subsets of AdvBench, while the authors' 78.5% is produced by their own GPT judge with the code-required rule. The paper itself acknowledges that cross-method comparison is problematic (Section III-D), yet the abstract and conclusions treat the cross-paper numbers as evidence of superiority. To support the claim, the authors should either run the comparison methods through the same judge, target model, and subset, or explicitly reframe the 78.5% as 'our SR under our evaluation protocol' rather than a SOTA comparison.","section":"Section III-D, Table VI"},{"comment":"The evaluation subset consists of the first 50 (or 100) prompts per category, taken in textual order from the generated dataset. No evidence is provided that these leading prompts are representative of the full category distributions, and the paper's own manual quality check used a random sample (Section II-B). Because prompt ordering may correlate with generation order or topic clustering, the reported SRs could be biased upward or downward relative to the full CySecBench. The authors should use a random (or stratified) sample and, ideally, report variance across multiple samples or confidence intervals.","section":"Section III-B"}],"minor_comments":[{"comment":"The sentence in Section III-A ends mid-clause: 'resulting in responses that.' It appears that a description of the responses was omitted.","section":"Section III-A"},{"comment":"The appendix heading is misspelled 'Appenidx' in Section III-C (first paragraph after Table V), and the reference to 'Figures 13, 14 and 15' appears in the text.","section":"Appendix A"},{"comment":"Reference [35] for the MECE principle points to a CNBC article on ChatGPT's one-year anniversary, which is not an appropriate source for this concept. A proper citation to the MECE principle (e.g., original consulting literature or a standard text) should be added.","section":"References"},{"comment":"Table III lists sample sets of 50, 200, and 600 prompts per category, but the evaluation subset described in Section III-B (100 per category) does not correspond to any of these formats. Clarify how the 100-prompt subset relates to the documented sample sets.","section":"Table III and Section II-B"},{"comment":"The dataset improvement paragraph reports that running GPT-o1 on 200 prompts cost $32.87 and extrapolates to $2,151 for 12,662 prompts, but it is unclear whether the extrapolation is linear and whether the 200-prompt test set was representative of the full filtering workload; a brief note on the assumptions would improve reproducibility.","section":"Section IV"}],"recommendation":"major_revision","confidential_remarks":"This is an arXiv preprint that would benefit from peer review. The dataset release is a positive contribution, but the experimental evaluation needs the fixes described in the major comments before the claims of superiority can be accepted. The paper's framing as 'first comprehensive dataset of its type' is strong, but the absence of human validation of the judge and the internal inconsistency in subset sizes are significant. I would ask the authors to address these points in a revision."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"CySecBench is worth having. A 12,662-prompt, 10-category, domain-specific jailbreak dataset with close-ended prompts is a genuine gap-filler, and the authors release it publicly and describe their generation and filtering pipeline clearly enough to adapt. That alone justifies reading the paper. The jailbreak method itself is a reasonable combination of decomposition, obfuscation, and refinement, and the paper is honest that it is simple. Credit where due: the authors manually reviewed 500 prompts to estimate the fraction of non-malicious or nonsensical entries (about 5.8%), and they explicitly flag that comparing jailbreak methods across papers is hard because evaluation criteria differ. That is more candor than most benchmark papers show.\n\nThe soft spots are all in the evaluation, and they are load-bearing for the headline numbers. The SRs (65%, 88%, 17%, 78.5%) come from a GPT-4o-mini judge that has not been validated against human raters for this task, and the rubric requires executable code for a rating of 5. That criterion will systematically favor code-centric attacks, so the 'domain-specific gap' may be partly baked into the judge. Second, the paper says the CySecBench evaluation used 100 prompts per category (1,000 total) but Table IV says 50 per category (500 total). The denominator for the reported SRs is ambiguous. Third, the 'higher than state-of-the-art' claim in the abstract is based on Table VI, where the comparison numbers come from different target models, different subsets, and different judges. The authors acknowledge this in Section III-D, then proceed to use the numbers anyway. That is an overclaim. Add no error bars and you have a reliable dataset attached to an unreliable evaluation.\n\nNone of this sinks the dataset. The evaluation issues can be fixed in revision: validate the judge against humans, pick one subset and stick to it, report confidence intervals, and either re-run baselines under the same protocol or downgrade the superiority claim. As it stands, treat the SR figures as preliminary, and treat CySecBench as a useful benchmark asset.\n\nThis paper deserves a serious referee. The artifact is valuable, the writing is clear, and the limitations are honestly stated. The right outcome is major revision, not desk rejection.","headline":"The dataset is the real contribution here; the jailbreak results are not yet trustworthy.","tokens_in":17572,"tokens_out":2266,"would_cite":true,"duration_ms":21312,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"CySecBench introduces a 12,662-prompt, domain-specific benchmark for evaluating LLM jailbreaks in cybersecurity, and a prompt-obfuscation jailbreak method that reaches a 78.5% success rate on AdvBench, higher than previously reported…","keywords":["CySecBench","LLM jailbreaking","cybersecurity prompts","dataset generation","prompt obfuscation","LLM safety evaluation","MECE decomposition","attack categorization"],"falsifier":"Take a random sample of the recorded prompt-and-response pairs, have three independent human cybersecurity experts rate them with the paper's 1-5 rubric, and measure agreement with the GPT-4o-mini judge; low agreement would mean the reported SRs are not trustworthy measures of jailbreak success.","tokens_in":16538,"feed_emoji":"🔐","tokens_out":9539,"duration_ms":84602,"temperature":0.7,"pith_summary":"CySecBench is a new benchmark of 12,662 machine-generated, filtered prompts designed to test whether large language models can be jailbroken into producing offensive cybersecurity code. The prompts are grouped into ten attack categories and written to be close-ended, so that a response can be scored on a fixed scale rather than left open to interpretation. The paper pairs the benchmark with a jailbreak method that disguises a malicious request as a university exam: one LLM decomposes the request into ten structured exam questions and a second LLM writes a solution sheet, with an optional word-reversal and refinement stage. The authors report 65.4% success with ChatGPT, 88.4% with Gemini, and 17.4% with Claude on a CySecBench subset, and a 78.5% success rate on AdvBench with refinements, which they claim exceeds published state-of-the-art methods. The underlying argument is that domain-specific, close-ended evaluation data gives a more consistent and honest picture of LLM security than broad open-ended prompt sets.","feed_headline":"CySecBench: a 12,662-prompt security benchmark for LLM jailbreaks","feed_subtitle":"A simple obfuscation-and-refinement attack hits 78.5% on AdvBench and reveals big model gaps.","key_machinery":"The engine of the jailbreak is the exam-framed decomposition: a malicious prompt is sent to an LLM with instructions to apply the MECE (mutually exclusive and collectively exhaustive) principle and output ten numbered exam questions, with questions 1-5 on ethics and defenses and 6-10 on implementing adversarial techniques; a separate LLM instance then writes a solution sheet where the offensive answers must include runnable code. The two enhancements are word-reversal of every fifth word in the prompt and a multi-model refinement loop that expands solutions and checks for refusal phrases like 'I apologize.' CySecBench is the measurement instrument: its close-ended, category-labelled prompts are meant to reduce response variance, and a GPT-4o-mini judge assigns a 1-5 rating where only executable-code responses can score 5.","core_discovery":"The paper's central claim is that CySecBench is the first comprehensive, domain-specific prompt dataset for measuring LLM jailbreaks in cybersecurity, and that the proposed prompt-obfuscation jailbreak method is stronger than existing published methods. The dataset contains 12,662 close-ended prompts, generated with GPT-o1-mini and GPT-3.5-turbo, filtered by keyword lists and a GPT-assisted rephrasing loop, and organized into Cloud, Control System, Cryptographic, Evasion, Hardware, Intrusion, IoT, Malware, Network, and Web Application attack categories. The jailbreak method frames a malicious prompt as an exam-preparation task: the target LLM is asked to produce ten exam questions under the MECE (mutually exclusive and collectively exhaustive) principle, five on defense and ethics and five on implementing attacks, and a second LLM instance is asked for a solution sheet with complete code for the offensive questions; the enhancement reverses every fifth word in the prompt and passes the solution sheet through progressively stronger LLMs until refusal phrases disappear. On a subset of CySecBench the authors measure success rates of 65.4% for ChatGPT, 88.4% for Gemini, and 17.4% for Claude, and on AdvBench the refined method reaches a 78.5% success rate and 4.23 average rating, compared to the unrefined method's 52.5% and to prior reported rates of 71.4% (WordGame), 62.0% (PAIR), 58.9% (ReNeLLM), and 32.0% (ArtPrompt).","pith_inferences":["The paper does not validate its GPT-4o-mini judge against human raters for cybersecurity responses; a natural next step is to have human experts re-score a sample, and the difference would bound how much the reported SRs reflect real harmfulness rather than judge leniency.","The evaluation subset is the first 100 prompts per category, with Table IV using the first 50; re-running the evaluation on random samples from each category would test whether the reported rates generalize across the dataset.","The 'professor preparing an exam' frame could transfer to any professional domain, implying that institutional role-play is a general jailbreak class that safety alignment must address, not just code and cybersecurity."],"forward_implications":["Researchers gain a 12,662-prompt, ten-category testbed whose close-ended format makes jailbreak success rates more directly comparable across methods than broad datasets like AdvBench.","The generation-and-filtration recipe can be adapted to build similar malicious-prompt benchmarks for other specialized domains, which the paper explicitly proposes for healthcare, finance, and legal compliance.","The large cross-model gap (Gemini 88.4% vs Claude 17.4%) indicates that safety mechanisms differ in kind, not just degree, and that filters operating only at the intent-recognition level are vulnerable to obfuscation.","A 78.5% success rate on AdvBench, if replicated under standardized judging, would make obfuscation-plus-refinement a reference attack class that future defense evaluations should include."],"supporting_citations":[{"why":"Supplies AdvBench, the 520-prompt general benchmark on which the paper's 78.5% success-rate claim and the comparison to prior methods are measured.","marker":"[21]"},{"why":"Defines the ReNeLLM jailbreak baseline (58.9% SR) that the refined method claims to surpass.","marker":"[16]"},{"why":"Defines the ArtPrompt baseline (32.0% SR, 3.38 AR) used in the state-of-the-art comparison.","marker":"[17]"},{"why":"Defines the WordGame baseline (71.4% SR), the strongest prior number the refined method reports beating.","marker":"[18]"},{"why":"Defines the PAIR baseline (62.0% SR) used in the state-of-the-art comparison.","marker":"[19]"},{"why":"Supplies the LLM-as-judge justification that licenses the GPT-4o-mini scoring on which all SRs and ARs depend.","marker":"[36]"}],"fun_headline_variants":["Domain-specific prompts beat generic ones in LLM jailbreaks","Obfuscation jailbreak: 88% on Gemini, 65% on ChatGPT, 17% on Claude","New 12,662-prompt cybersecurity benchmark for jailbreak testing","CySecBench reveals model gaps: Gemini weak, Claude tough","Prompt obfuscation beats state-of-the-art jailbreak methods"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"Every reported success rate rests on the assumption that the GPT-4o-mini judge's rating of 5, which requires executable code, agrees with what a human expert would call a successful jailbreak.","fun_headline_variants_meta":{"raw":{"variants":["Domain-specific prompts beat generic ones in LLM jailbreaks","Obfuscation jailbreak: 88% on Gemini, 65% on ChatGPT, 17% on Claude","New 12,662-prompt cybersecurity benchmark for jailbreak testing","CySecBench reveals model gaps: Gemini weak, Claude tough","Prompt obfuscation beats state-of-the-art jailbreak methods"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000263,"raw_usage":{"total_tokens":1710,"prompt_tokens":1164,"completion_tokens":546,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":780,"completion_tokens_details":{"reasoning_tokens":447}},"tokens_in":780,"tokens_out":546,"duration_ms":5701,"temperature":1.0,"reasoning_tokens":447,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T22:28:39.201238+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a random sample of the recorded prompt-and-response pairs, have three independent human cybersecurity experts rate them with the paper's 1-5 rubric, and measure agreement with the GPT-4o-mini judge; low agreement would mean the reported SRs are not trustworthy measures of jailbreak success.","supporting_citations":[{"cited_title":"Making Them Ask and Answer: Jail- breaking Large Language Models in Few Queries via Disguise and Reconstruction,","cited_arxiv_id":null,"evidence_quote":"Defines the ReNeLLM jailbreak baseline (58.9% SR) that the refined method claims to surpass."},{"cited_title":"(2024) MECE Principle: Definition, Exam- ples, and Tips","cited_arxiv_id":null,"evidence_quote":"Supplies the LLM-as-judge justification that licenses the GPT-4o-mini scoring on which all SRs and ARs depend."}],"review_version":1}