What changed
The Frontier Model Forum (FMF) has released a new Jailbreak Rating Framework designed to assess how easy it might be for AI models to bypass safeguards and the potential scale of damage if they do. The framework is modeled after the CVSS security rating system but tailored for large language models (LLMs). It includes four scoring components: severity, likelihood, capability gains, and ease of discovery, with ratings ranging from zero to three.
What this means in practice
The framework aims to provide a standardized way for AI companies to evaluate and compare jailbreak vulnerabilities across different models. A combined final rating is derived from severity and likelihood scores, with capability gains acting as a critical factor. A rating of zero indicates the jailbreak does not offer improvements beyond existing tools, while a rating of three suggests the model can perform cyber-attacks comparable to an unsafeguarded model. The system is still in development, with the FMF accepting feedback until December 21, 2023, and advising against relying on it for now.
Limitations and availability
The framework is a work-in-progress and not yet available for use. It is intended as a cross-vendor standard, but individual companies may still use their own rating systems. The FMF emphasizes that the baseline for ratings will evolve as models improve, meaning a rating of zero today may not carry the same weight in the future. The system also does not claim to independently verify or test jailbreaks, relying instead on vendor-reported data and the proposed framework's structure.
