A widely used way of grading how well AI models resist jailbreaks may be measuring the wrong thing entirely.
Researchers ran four 7-8B open models, spanning three base families and four post-training recipes, through a standard encoded-prompt jailbreak test, then did something most benchmarks skip: they ran the harmless version of the same test too. Refusal rates on harmful homoglyph-encoded prompts barely varied across models, but plaintext refusal rates spread widely, and on one model the gap between refusing bad requests and complying with good ones collapsed from +0.82 in plaintext to exactly 0.00 once the prompts were encoded. A harmful-arm-only benchmark scored that model identical to one that kept a +0.61 gap. Pushing a model through a full SFT to DPO to RLVR training pipeline actually raised the harm gap by +0.26, a real improvement the conventional metric registered as no change whatsoever.
This matters because harmful-arm-only scoring is the default way labs report safety gains after alignment training, and it can't distinguish a model that got better at judgment from one that just stopped parsing encoded text as a request at all. The researchers also catalogued twelve flaws in the measurement tools themselves, six of which make models look safer than they are, including a binary jailbreak judge that flagged 61 to 70 percent of benign plaintext replies as jailbreak attempts.
A model that refuses everything isn't safe. It's just broken in a way that happens to look good on a scoreboard.