subtraction

The passage around this formula

The failure modes built on repeated querying — jailbreak search, paraphrase evasion, mismatched-language generalisation — share a further structural property worth stating precisely, because a single strong per-attempt success rate is often reported as though it settled the question of robustness on its own. Suppose a safeguard blocks a fixed, independently generated attack attempt with probability 1-p , so a single try succeeds only with probability p . An adversary who is not limited to one try, and who runs k independent attempts — exactly the loop PAIR and the suffix-search method both implement mechanically [ 2 , 1 ] — succeeds at least once with probability $P(\text{at least one success in } k \text{ tries}) = 1 - (1-p)^k$. At p =…

Read this part in the article →