An internal-harmfulness-score audit found successful jailbreaks rank BELOW failed ones, AUROC 0.220.

arXiv 2608.09624 separates harmful intent (a prompt property) from jailbreak success (an outcome from a specific model, decoder, and judge). On Llama, wrapping a prompt raises harmful generation from 0.05 to 0.27 while harmful-intent AUROC falls from 0.936 to 0.803. Attacks get more dangerous exactly as prompts look safer. Among wrapped harmful prompts, outcome AUROC hits 0.220, an active reversal, not just a failure, reproduced across three target models, seven attack families, and two judges. If your safety filter scores intent and you assume that predicts outcomes, it predicts the opposite.