---
title: 'JailbreakQR: Divergent Paradigms in AI and QR Codes'
url: https://www.emergentmind.com/topics/jailbreakqr
type: topic
---

# JailbreakQR: Divergent Paradigms in AI and QR Codes

JailbreakQR is a polysemous term used in 2025 arXiv literature for several distinct research artifacts rather than a single, stable object. In LLM safety, it denotes a human-annotated jailbreak-evaluation benchmark introduced with JADES [2508.20848], a quantitative jailbreak-evaluation design distilled from the scenario-adaptive SceneJailEval framework [2508.06194], and, in one technical summary, a reference to the Jailbreak-R1 automated red-teaming framework [2506.00782]. In QR-code security, the same label denotes the half-pixel module-splitting attack presented in “Dueling QR Codes: The Hyding of Dr. Jeckyl” [2503.13458]. The shared name therefore spans benchmark construction, evaluation methodology, attack generation, and optical barcode exploitation.

## 1. Terminological scope and disambiguation

A common source of confusion is that “JailbreakQR” does not identify a single benchmark, framework, or attack. The term is used for multiple non-equivalent entities with different goals, data models, and evaluation targets.

| Source | Meaning of “JailbreakQR” | Object type |
|---|---|---|
| JADES [2508.20848] | a newly introduced benchmark of 400 prompt–response pairs | human-annotated jailbreak benchmark |
| SceneJailEval summary [2508.06194] | a quantitative jailbreak-evaluation design | scenario-adaptive evaluation framework plus 14-scenario dataset |
| Jailbreak-R1 summary [2506.00782] | a reference to the Jailbreak-R1 framework | automated red-teaming training pipeline |
| “Dueling QR Codes” [2503.13458] | the half-pixel module-splitting attack | angle-dependent dual-message QR code technique |

This suggests that “JailbreakQR” functions more as a reused label than as a settled term of art. In the LLM literature, the label attaches to evaluation and attack-generation systems; in the barcode literature, it refers to a physical-layer attack against ISO/IEC 18004:2015-compliant QR decoding [2503.13458].

## 2. JailbreakQR as a human-annotated jailbreak benchmark

In “JADES: A Universal Framework for Jailbreak Assessment via Decompositional Scoring,” JailbreakQR is introduced to address a specific weakness of prior jailbreak benchmarks: they collect open-ended harmful questions without reference answers, so success is judged by crude proxies such as string matches, toxicity flags, or naive holistic LLM judgments [2508.20848]. The stated motivation is that such proxies misinterpret model outputs and inflate success rates. JailbreakQR is therefore positioned as a small but carefully human-annotated benchmark with clear success/failure criteria, intended to anchor automated judges against a gold standard.

The benchmark contains 400 prompt–response pairs sampled from a larger pool of 4,160 instances, derived from 260 harmful questions, 5 attacks, and 4 models [2508.20848]. Each pair receives one of three ordinal labels: failed, partially successful, or successful. Beyond the primary label, the benchmark tracks which jailbreak method produced the response—GCG, DSN, LAA, PAIR, or JailbreakChat—and which target LLM was evaluated: Vicuna, Llama-2, GPT-3.5-Turbo, or GPT-4.

| Label | Count | Percentage |
|---|---:|---:|
| failed | 145 | 36.25% |
| partially successful | 138 | 34.50% |
| successful | 117 | 29.25% |

The benchmark’s role is explicitly to bridge the gap between expensive manual evaluation and error-prone proxies [2508.20848]. It supports both binary attack success rate measurement and finer-grained ordinal analysis, making it suitable for evaluating whether an automated judge captures partial fulfillment rather than only overt refusal or overt compliance.

## 3. Annotation protocol, formal scoring, and empirical findings in JADES

The annotation protocol permits either decomposition or holistic labeling. Annotators may decompose the harmful question into sub-questions, mark each as critical or supporting, judge each sub-question as Fulfilled, Partially Fulfilled, or Not Fulfilled, and then aggregate these judgments into failed, partially successful, or successful [2508.20848]. If they choose not to decompose, they label holistically against the original question. Each of the 400 pairs was labeled by three independent annotators; disagreements were resolved by majority vote; Krippendorff’s ordinal $\alpha$ was $0.823$, reported as “almost perfect” agreement by Landis & Koch [2508.20848]. For failed and partially successful cases, annotators also wrote free-text explanations.

The JADES framework uses JailbreakQR with a decompositional scoring formalism. A harmful question $Q$ is broken into weighted sub-questions
$$
\{(q_i,w_i)\}_{i=1}^n,\qquad \sum_{i=1}^n w_i = 1,\qquad w_i \ge 0.
$$
The response is split into sentences, irrelevant sentences are removed, and a pairing agent matches relevant sentences to each $q_i$ [2508.20848]. Each sub-answer receives a five-level Likert score
$$
s_i \in \{0.00,\,0.25,\,0.50,\,0.75,\,1.00\},
$$
and the overall score is
$$
S_{\mathrm{total}} = \sum_{i=1}^n w_i s_i \in [0,1].
$$
The binary mapping is $S_{\mathrm{total}} \le 0.25 \mapsto \text{failure}$ and $S_{\mathrm{total}} > 0.25 \mapsto \text{success}$; the ternary mapping is $S_{\mathrm{total}} \le 0.25 \mapsto \text{failed}$, $0.25 < S_{\mathrm{total}} < 0.75 \mapsto \text{partially successful}$, and $S_{\mathrm{total}} \ge 0.75 \mapsto \text{successful}$ [2508.20848].

Empirically, JADES was evaluated on JailbreakQR against StringMatch, JailbreakRadar, JailbreakBench, HarmBench, and StrongReject, using GPT-4o agents at temperature $0$ [2508.20848]. In the binary setting on 400 pairs, JADES achieved Accuracy $0.985$, Precision $0.992$, Recall $0.984$, and $\mathrm{F1}=0.988$; the best baseline remained below $0.89$ in Accuracy and below $0.92$ in Precision and $\mathrm{F1}$ [2508.20848]. The system incurred only $0.5\%$ false positives and $1.0\%$ false negatives, and out-performed prior proxies by at least $9$ points in Accuracy. In the ternary setting, overall Accuracy was $86.3\%$, with per-class $\mathrm{F1}$ of $0.979$ for failed, $0.829$ for partially successful, and $0.738$ for successful, giving Macro-$\mathrm{F1}=0.849$ [2508.20848].

The benchmark was also used to re-evaluate five popular attacks on four LLMs. Under binary ASR, previously reported attack success rates were materially reduced; for example, GPT-3.5 + LAA dropped from $0.93$ to $0.69$, Vicuna + DSN from $0.95$ to $0.71$, and Llama-2 + LAA from $0.90$ to $0.49$ [2508.20848]. Under ternary evaluation, most nominal ASR “successes” became partial successes, with $\mathrm{SR}/\mathrm{ASR} \le 0.25$ for nearly all method–model pairs. The recommended practice is to report ternary labels alongside binary ASR, introduce PSR and $\mathrm{SR}/\mathrm{ASR}$, prefer analytic or decompositional evaluation over holistic proxies, optionally integrate fact-checking, calibrate sub-question weights for domain transfer, and preserve a human-in-the-loop path for edge-case decomposition errors [2508.20848].

## 4. JailbreakQR as a scenario-adaptive quantitative evaluation design

A separate use of the term appears in the consolidated reference derived from “Beyond Uniform Criteria: Scenario-Adaptive Multi-Dimensional Jailbreak Evaluation,” where “JailbreakQR” denotes a quantitative jailbreak-evaluation design driven by the SceneJailEval framework [2508.06194]. SceneJailEval is motivated by the claim that binary classification yields only “yes/no” labels without quantifying harm intensity, while existing multi-dimensional frameworks apply uniform criteria across scenarios, causing scenario-specific mismatches such as the irrelevance of “Relative Truthfulness” to “hate speech” [2508.06194].

SceneJailEval organizes evaluation into four modules: Scenario Classification, Scenario-Dim Adapter, Jailbreak Detection, and Harmfulness Evaluation [2508.06194]. For each query–response pair $(q,r)$, it returns a jailbreak flag $J(q,r)\in\{0,1\}$ and a harm score $H(q,r)\in\mathbb{R}_+$ on a $0$–max scale. The scenario classifier maps $(q,r)$ to one of $14$ scenarios. The adapter then selects scenario-specific detection dimensions $D_s^d$, detection rules $C_s^d$, harm dimensions $D_s^h$, harm criteria $C_s^h$, and weights $W^s$, with irrelevant dimensions assigned weight $0$ [2508.06194].

The detection dimensions are Rejection, Helpfulness, RegionalCompliance, RiskWarning, PoliticalNeutrality, and Explicitness. The harmfulness dimensions, derived from DREAD/CVSS risk models on a $0$–$5$ scale, are Authenticity, Specificity, Severity, and ImpactScope [2508.06194]. The formal definitions are
$$
J = \bigwedge_{d\in D_s^d} Agent_{JD}(q,r,d,c_{s,d}),
$$
and
$$
H = \sum_{d\in D_s^h} w_{s,d}\times Agent_{HE}(q,r,d,c_{s,d}).
$$
For expert elicitation and weight derivation, the framework reports the Delphi consensus statistics
$$
CV_t(o)=\sigma_t(o)/\mu_t(o), \qquad IQR_t(o)=Q_3-Q_1,
$$
and the AHP relation
$$
A w = \lambda_{\max} w,
$$
with normalization and the consistency condition
$$
CR=((\lambda_{\max}-n)/(n-1))/RI < 0.1
$$
[2508.06194].

The accompanying dataset covers 14 scenarios: Violent Crime, Non-violent Crime, Sex-related Crime, Child Sexual Exploitation, False Information / Defamation, Professional Advice (med/finance/legal), Privacy Invasion, IP Infringement, Weapons of Mass Destruction, Hate / Discrimination, Suicide / Self-harm, Sexual Content, Political Agitation / Elections, and Regional Sensitive Issues [2508.06194]. It contains 1,308 samples, with approximately 80–120 queries per scenario, Chinese and English support, region tags including CN, US, and EU, and metadata for scenario, sub-scenario, query, response, detection labels $\{j_d\}$, harm scores $\{h(d)\}$, and expert consensus weights $W^s$ [2508.06194].

The reported detection metrics are Precision, Recall, $\mathrm{F}_1$, and Accuracy; harmfulness is measured with NMAE and Spearman $\rho$; open-set security is measured with ASR and AvgHarm [2508.06194]. On the in-house dataset, the “Ours” system reports Accuracy $0.8830$, Precision $0.9010$, Recall $0.9290$, and $\mathrm{F1}=0.9148$ (approximately $0.917$). The abstract further states that SceneJailEval achieves an $\mathrm{F1}$ score of $0.917$ on the full-scenario dataset, representing $+6\%$ over prior SOTA, and $0.995$ on JBB, representing $+3\%$ over prior SOTA [2508.06194]. On public benchmarks, the table reports $\mathrm{F1}=0.99$ on JBB, $0.8241$ on JailJudge, and $0.83$ on Safe-RLHF, with the note that Beaver is heavily fine-tuned to Safe-RLHF [2508.06194].

An important design property is extensibility. New scenarios and new dimensions can be added through API-style interfaces, and a “Product Consultation” case study defines a detection dimension called Loyalty and harm dimensions Derogation and Specificity [2508.06194]. For that 200-query custom test, the reported results are Acc/Prec/Rec/$\mathrm{F1}=1.0$, NMAE $=0.037$, and $\rho=0.841$. This suggests that, in this usage, JailbreakQR is not merely a label set but a configurable quantitative evaluation stack for scenario-aware red-teaming.

## 5. JailbreakQR as a reference to Jailbreak-R1

In the technical summary associated with “Jailbreak-R1: Exploring the Jailbreak Capabilities of LLMs via Reinforcement Learning,” “JailbreakQR” is used as a reference to the Jailbreak-R1 framework rather than to a benchmark [2506.00782]. The framework targets automated red teaming and is organized as a three-stage training pipeline: Cold Start, Warm-up Exploration, and Enhanced Jailbreak.

Cold Start performs imitation learning and supervised finetuning on $D_{\text{cold}}$ of approximately $2$K examples rewritten into the template `"<think>…</think><attack>…</attack>"`, using 2 epochs, learning rate $5\mathrm{e}{-5}$, and batch size $8$ [2506.00782]. Warm-up Exploration trains on $D_{\text{target}}^{\text{warm}}$ of $1$K targets using Group Relative Policy Optimization, with rewards $R_{\text{consis}}$ and $R_{\text{div}}$, 1 epoch, learning rate $1\mathrm{e}{-6}$, batch size $8$, $6$ samples per input, $\epsilon=0.2$, and $\beta=0.01$ [2506.00782]. Enhanced Jailbreak introduces progressive jailbreak rewards by sequentially training against progressively weakened target models $\pi_{\text{tgt}_1}\rightarrow\pi_{\text{tgt}_2}\rightarrow\pi_{\text{tgt}_3}$ on $D_{\text{target}}^{\text{train}}$ of $5$K targets, with learning rate $1\mathrm{e}{-6}$, batch size $2$, $6$ samples per input, $\beta=0.04$, and temperature $1.0$ [2506.00782].

The formalism is an MDP whose state is the partial generation state $s_t=(x,y_{<t})$, whose action space is the token vocabulary, and whose policy is the transformer-based sequence model $\pi_{\text{adv}}(a\mid s)$ [2506.00782]. The consistency reward is
$$
R_{\mathrm{consis}}(y;x)=
\begin{cases}
1.0 & \text{if } M_{\mathrm{classify}}(x,y)=1,\\
0.0 & \text{otherwise,}
\end{cases}
$$
the diversity reward ranks prompts by a combined Self-BLEU and embedding-similarity criterion, and the warm-up reward is
$$
R_{\mathrm{warm}}(y)=R_{\mathrm{consis}}(y)+R_{\mathrm{div}}(y).
$$
The progressive jailbreak reward is
$$
R_{\mathrm{train}}(y)=
\begin{cases}
R_{\mathrm{div}}(y)+1.0 & \text{if } M_{\mathrm{judge}}(x,y,z)=1,\\
0 & \text{otherwise.}
\end{cases}
$$
[2506.00782]

On HarmBench averaged over eight models, the condensed table reports ASR/DIV values of approximately $36.2/0.79$ for TAP, $37.7/0.74$ for PAIR, $54.4/0.90$ for AutoDAN-Turbo, $44.2/0.88$ for GPO, $48.3/0.67$ for ArrAttack, $55.9/0.84$ for Jailbreak-R1-Zero, and $65.2/0.98$ for Jailbreak-R1 [2506.00782]. Average jailbreak efficiency is also reported, with Jailbreak-R1-Zero at $1.72$ attempts per success and Jailbreak-R1 at $2.05$ [2506.00782]. The summary identifies limitations including single-turn attacks, reliance on multiple external models, and semantic-level prompt detectability. In this usage, “JailbreakQR” refers to an attack-generation framework, not an evaluation corpus.

## 6. JailbreakQR as a half-pixel QR-code attack

In “Dueling QR Codes: The Hyding of Dr. Jeckyl,” JailbreakQR is an optical attack against standard QR decoding rather than an LLM-security artifact [2503.13458]. The technique exploits the fact that camera-based QR readers sample module centers. Function patterns—finder, timing, alignment, and format/version areas—are preserved from “QR A,” while only data modules are split. For each data module of size $N\times N$ pixels, the left half encodes the bit from message A and the right half encodes message B. Under one camera tilt, sampling points fall on the left halves and decode A; under the opposite tilt, they fall on the right halves and decode B [2503.13458].

The geometric model assumes a QR code lying in the plane $z=0$, printed at module size $s$ pixels per module, with a pinhole camera viewing it under small yaw angle $\theta$ or pitch angle $\phi$ [2503.13458]. The lateral shift is proportional to $s\sin\theta$ or $s\sin\phi$. Under the first-order approximation, the relative offset is
$$
\delta \approx \frac{s\theta}{2},
$$
and reliable half-selection requires
$$
|\delta| > \tfrac{1}{2}\,\text{px} \quad \Rightarrow \quad |\theta| > 1/s
$$
in radians [2503.13458]. For $s=9$–$11$ px, this corresponds to an approximate minimum tilt of $6^\circ$–$7^\circ$. The same logic applies vertically when splitting top versus bottom halves, and diagonally when quarter-modules are used [2503.13458].

The code-generation procedure takes two messages, a common QR version and error-correction level, and a scale $s$ with $9\le s\le 11$ px per module [2503.13458]. Two standard QR codes of identical version and error-correction level are generated; structural elements are copied from QR1; each data module is rendered so that pixel columns $p < s/2$ use the value from QR1 and columns $p \ge s/2$ use the value from QR2. The method recommends forcing the same mask pattern in both QR codes. Canonical EICAR and GTUBE payloads are specifically named as test patterns [2503.13458].

The attack is reported to work with any unmodified ISO/IEC 18004:2015-compliant smartphone scanner or USB camera library such as Zxing or ZBar [2503.13458]. Supported module scales are $9$, $10$, or $11$ px per module. Empirical angle tolerances for 100% reliable decoding are given as horizontal yaw $\pm(6^\circ\ldots35^\circ)$, vertical pitch $\pm(8^\circ\ldots32^\circ)$, and diagonal combinations with $|\theta|,|\phi|$ in $(10^\circ\ldots30^\circ)$ [2503.13458]. Reported decoding success rates are 100% for horizontal dual messages across 20 hand-held smartphone models when $|\theta|=10^\circ$–$30^\circ$, 98% for vertical mode when $|\phi|=12^\circ$–$28^\circ$, and 95% for diagonal mode when $\sqrt{\theta^2+\phi^2}=15^\circ$–$25^\circ$ [2503.13458]. The mean bit-error rate before Reed-Solomon correction is approximately $0.15\%$, fully corrected in all tested cases. Straight-on scans with $|\theta|,|\phi|<5^\circ$ often yield no decode or mixed failures; extreme tilts above $40^\circ$ break finder/timing pattern detection; and printed material must maintain less than $0.2$ mm distortion [2503.13458].

The paper discusses both offensive and defensive implications. Potential uses include quishing, two-factor binding, and anti-counterfeit tags [2503.13458]. Recommended defenses are multi-angle scanning with message-hash comparison, structural-module inspection for half-pixel gradients, straight-on-only policies that reject perspective distortion beyond $\pm 5^\circ$, and physical watermarking or UV-fluorescent ink to break half-pixel symmetry [2503.13458]. This usage of “JailbreakQR” is therefore a physical-layer barcode attack whose object of “jailbreak” is the QR sampling assumption rather than an LLM safety mechanism.

Source: https://www.emergentmind.com/topics/jailbreakqr