What does this equation mean?

which climbs quickly even when p is small per attempt. Two caveats matter as much as the formula. Attempts against one fixed, deployed model are usually correlated rather than independent, so real gains from repeated probing fall below this bound; and a universal, transferable suffix is close to the case the formula flatters most, because it is a single artefact effective across many models and many prompts at once rather than a one-off. That asymmetry — a defender must hold every prompt, an attacker only needs one reusable gap — is a structural reason red-teaming keeps finding something regardless of which training mechanism it is pointed at, and it is a poor basis for inferring that the mechanism which was breached first is the weaker one; it may only have been probed first, harder, or by more people.