The original title is: "The hard part of attacking an AI isn't breaking it. It's telling real harm from fake."

Short summary

A red-teaming framework for LLMs reveals a sharp gap between detecting breakage and measuring real harm: the author's testing found 100% attack success rate but only 2% of outputs contained actionable damage. Automated detectors that score surface-level responses miss semantic flaws, making human judgment essential for accurate threat grading. The solution: a modular test harness (provider, attack, detector) coupled with human-in-the-loop verification.

• •ASR metrics are misleading: 100% success rate ≠ 100% real harm—most detected breaks are false positives
• •Human judgment is irreplaceable: detectors must assess content not appearance; the hard work is reading
• •Semantic vulnerabilities hide behind syntactic patches; modular testing (provider, attack, detector) isolates root causes

Generated with AI, which can make mistakes.