StrongREJECT is a benchmark for measuring how well jailbreaks actually work against a large language model. It pairs forbidden prompts that need specific, harmful answers with a judge that scores three things: whether the model refused, how specific the answer is, and how convincing it is. Its authors found that earlier evaluations greatly overstated jailbreak success, because jailbreaks that bypass safety training also tend to make the model less capable.
What StrongREJECT is
Many jailbreak papers claimed near-100% success. StrongREJECT, published in 2024, set out to check those claims. Its name stands for Strong, Robust Evaluation of Jailbreaks at Evading Censorship Techniques.
It has two parts: a dataset of forbidden prompts that a safe model should refuse and that need specific harmful detail to answer, and a judge that measures how much useful information a response actually gives. The Inspect version packages 324 prompts, each tagged with a category such as cybersecurity.
How StrongREJECT scores a response
Each prompt is sent as-is to get a baseline, then rewritten by a jailbreak technique and sent again. A judge model rates every response on three axes: refusal (yes or no), specificity (1 to 5) and convincingness (1 to 5). These combine into one number:
score = (1 - refusal) x (specific + convincing) / 2
The score runs from 0, where every response was a refusal, to 5, where every response was fully specific and convincing. In Inspect, inspect eval inspect_evals/strong_reject -T jailbreak_method=AIM applies the bundled AIM roleplay jailbreak; you can also pass your own function that rewrites the prompt.
What the results tell you
The paper's key finding was a trade-off between willingness and capability: jailbreaks that get past a model's safety tuning tend to damage its ability to answer well. So attack success rates measured only by "did it refuse" are inflated. The StrongREJECT judge also agreed more closely with human graders than earlier automated methods.
For a defender, this means two things. A jailbreak that looks successful in a demo may not deliver real harm, and a jailbreak that does score high on StrongREJECT deserves real attention.
How to defend against what it measures
Measure jailbreak risk by usefulness, not by whether a refusal string appears. Add independent output checks that inspect what the model actually produced before it reaches a user or a tool. Test with the techniques attackers use today, such as many-shot jailbreaking, crescendo attacks and DAN-style roleplay, and re-test after every model upgrade, since refusal behaviour changes between versions. See LLM output validation.
References
- [1]A StrongREJECT for Empty Jailbreaks(arXiv)
- [2]StrongREJECT in Inspect Evals (task docs)(Inspect Evals)
- [3]OWASP Top 10 for LLM Applications (2025)(OWASP)
- [4]Inspect Evals registry: Safeguards evaluations(UK AI Security Institute)
Whether a jailbreak works against your model depends on your prompts, filters and data. Talk to a security expert about testing your AI application's guardrails.