What does this equation mean?

The shared structural fact underneath both techniques, and the reason they are described here as one machine rather than two, is what a search process buys once it is automated rather than performed by hand. A single human red-teamer trying prompt variations by hand might realistically test dozens of candidates against a target in a working day. An automated pipeline built on either GCG- or PAIR-style search can attempt thousands of candidates against a running target in the same interval, entirely unattended. If a given search strategy succeeds against a defended target with independent per-attempt probability p , the probability that at least one of k automated attempts succeeds is $P_{\mathrm{hit}}(k) = 1 - (1-p)^{k}$. Even a strategy with a very low per-attempt success rate becomes a near-certain eventual hit once k is pushed into the thousands, which a machine can do overnight and a human red-team cannot do at all. This is precisely why Anthropic’s red-teaming of its classifier system is measured in thousands of hours rather than a handful of manual sessions [ 5 ] , and it is the direct engineering rationale for building automated red-teaming as a standing pipeline rather than an annual exercise: the defender has to be able to generate and evaluate a search budget that at least approaches what an automated attacker could bring, or the defensive evaluation is measuring the wrong regime entirely.