The Jailbreak Tax: How Useful are Your Jailbreak Outputs?

Jailbreaks often produce lower-quality outputs: The research found that while jailbreak attacks successfully bypass AI safety guardrails, the outputs they generate are frequently inaccurate or unhelpful. For instance, jailbreaks that bypassed refusals on math questions resulted in accuracy drops of up to 92%, meaning the "freed" model was giving wrong answers.

There's a measurable trade-off between safety and usefulness: The paper introduces the concept of a "jailbreak tax"—the quality penalty users pay when using jailbreaks. This suggests that the safety guardrails in AI models aren't just blocking harmful content; they're also helping maintain the model's overall reliability and accuracy.

Current jailbreak evaluation methods are limited: Most research on jailbreaks focuses only on whether they successfully bypass safety measures, not on whether the resulting outputs are actually useful or accurate. This paper addresses that gap by creating evaluation benchmarks with verifiable correct answers in areas like biology and math.

Existing jailbreaks show consistent performance problems across different models: The researchers tested eight different jailbreak methods across five utility benchmarks and found consistent quality degradation, suggesting this isn't a quirk of one particular attack but a broader pattern in how jailbreaks function.

Better metrics are needed for AI safety research: By proposing the jailbreak tax as a new safety metric and releasing public benchmarks, this work provides tools for the AI safety community to more rigorously evaluate whether jailbreaks are actually dangerous in practice or simply produce unreliable outputs.