LiveAI safety training robustnessWestern cycleAnchors pending

By end of 2027, frontier-model jailbreak-rates on standard red-team benchmarks fall below 10%, down from 30-50% in 2024-2025?

As of 6 Oct · 22:19 UTCResolves 31 Dec 20274 movers0 pressure moments
Timeline A · RLHF HardensReality
40%
Crowd 55%Gap +15

By end of 2027, the leading AI labs (Anthropic, OpenAI, Google) report jailbreak rates on StrongREJECT and HarmBench below 10% across their frontier models. Safety training methods—constitutional AI, reinforcement learning from human feedback tuning, adversarial training loops—have matured enough that standard red-team attacks succeed far less often. The UK AI Safety Institute and independent audits confirm these drops are real, not measurement gaming.

Timeline B · Jailbreaks Stay AvailableReality
60%
Crowd 45%Gap −15

Frontier model jailbreak rates remain stuck between 20-45% on the same benchmarks through 2027, despite continued investment in safety training. Each new model generation (GPT-5, Claude 4, Gemini 3) shows marginal improvement at best. Red-teamers find novel attack angles faster than safety teams can patch them, and the gap between private lab tests and public benchmarks widens as companies become reluctant to share unfavorable numbers.

crowd 55
The quiet paththe one nobody’s watching

A catastrophic jailbreak exploit in production forces regulatory intervention, collapsing the A-vs-B frame into compliance theater.

6%
The read
The underlying structure favors Jailbreaks Stay Available (60%) over RLHF Hardens (40%) — the signal is real but noisy.

Two trajectories through ai safety training robustness: RLHF Hardens and Jailbreaks Stay Available. The Signals below describe what would be visible if each trajectory is landing; the Levers list what could bend it. The third timeline — the one neither RLHF Hardens nor Jailbreaks Stay Available captures — is where the honest scope-limit sits.

Where reality is heading

A, 80% bandCrowd today
Projected reality support to 31 Dec 2028A rises from 41% to about 52% with an 80% band of 33 to 71. B falls from 53% to about 44%. Quiet path near 4 to 6%. Crowd today: A 55%.100%7550250Crowd today · A 55%A ~52%B ~44%P ~4%NowJan 2027Jan 202831 Dec 2028
Reality crosses toward A in early 2028. Today’s crowd number sits at the top of A’s band, possible but optimistic. View as table

The movers, ranked by leverage

01
Adversarial training compute budget at frontier labsMore red-team compute → lower jailbreak rate at ship time
leverage 0
Conditional
02
Open-weights ecosystemIf fine-tuning attacks on open models produce 'jailbreak-by-default' derivatives, the robustness story collapses
leverage 0
Conditional
03
Regulatory requirementsEU AI Act Article 10 + 15 compliance may require specific jailbreak-rate thresholds
leverage 0
Conditional
04
Attack-defense arms raceWhether new attack classes compound or get captured by the same defenses
leverage 0
Conditional

What would change our mind

Signals toward A
  • RLHF plus constitutional-AI plus adversarial training produces models whose jailbreak-rate on standard red-team benchmarks (StrongREJECT, HarmBench, AdvBench) stays below 10%
  • The hard-safety-training paradigm matures
  • releases ship with measurable robustness
Signals toward B
  • New attack classes (steganographic prompts, multi-turn manipulation, fine-tuning attacks on open-weight models) outpace defenses
  • the measured jailbreak-rate on standardized benchmarks stays in the 20-40% range through 2027
  • Safety becomes a defense-in-depth problem, not a solved training problem

Evidence