Practical Attack Success Rate (PASR)

• The paper demonstrates that PASR is defined as the proportion of fully successful real-world attacks under practical constraints across domains.
• It illustrates precise measurement criteria, detailing domain-specific success events in speaker verification, image retrieval, and autonomous driving.
• The study emphasizes that PASR must be paired with complementary metrics to capture complete system-level vulnerabilities and practical risk.

Practical Attack Success Rate (PASR) denotes the proportion of attack attempts that succeed under operationally realistic conditions rather than in a purely idealized offline setting. Across the literature, PASR is usually instantiated as an application-specific form of attack success rate (ASR): in practical speaker verification it is the percentage of live over-the-air trials in which the adversary is accepted by the full verification pipeline; in query-based image retrieval it is the percentage of attacks that completely subvert the top-$k$ result set; and in autonomous-driving object detection it has been formalized as the image-level fraction of adversarial scenes in which at least one pedestrian is not detected at all (Zhang et al., 2021, Li et al., 2021, Cao et al., 14 Aug 2025). This suggests that PASR is best understood not as a single universal scalar, but as a deployment-centered measurement framework whose success criterion is defined by the practically relevant failure mode.

1. Domain-specific meanings of PASR

The term is used most consistently to indicate end-to-end attack efficacy under realistic constraints, but the precise success event varies by domain. In physical speaker verification, success means that the adversary is successfully verified as the target speaker by the entire practical speaker verification (PSV) system, including audio replay check, speaker identity check, and speech content check (Zhang et al., 2021). In black-box image retrieval, success means that the adversarial query causes the top-$k$ returned images to have no overlap with the original top-$k$ list (Li et al., 2021). In autonomous-driving detection, a practical success occurs only when at least one pedestrian is entirely missed, meaning no predicted box overlaps that ground-truth pedestrian at all (Cao et al., 14 Aug 2025). In vision-language agentic systems, ASR measures whether the true trigger causes the attacker-specified behavior, while the later-introduced Neighbor Leakage Rate quantifies whether nearby unintended triggers also activate the behavior (Chang et al., 10 Jun 2026).

Domain	Practical success event	Evaluation unit
Practical speaker verification	Adversary accepted by replay check, identity verification, and content check	Physical trial
Image retrieval	Adversarial top-$k$ has no overlap with original top-$k$	Query
Autonomous-driving detection	At least one pedestrian has no overlapping predicted box	Image
Vision-language agentic systems	Triggered input yields attacker-specified target behavior	Sample

A closely related pattern appears in work that does not explicitly use the abbreviation PASR. The imitation-attack literature defines attack success as the fraction of adversarial examples that fool the attacked model under constrained black-box access (Zhou et al., 2020). LLM jailbreak studies define ASR as the fraction of attacked prompts that yield unsafe outputs, and some later work motivates a “Practical ASR” perspective by evaluating ASR across multiple prompt perturbations rather than a single prompt template (Machado et al., 11 Nov 2025). This suggests that PASR often serves as an umbrella notion for attack success measured under realistic access, deployment, or usability constraints.

2. Formalizations and measurement criteria

Several papers give explicit formulas, but these formulas are not interchangeable because they quantify different events. A generic black-box formulation defines attack success as

$\mathrm{PASR} = \frac{n}{m},$

where $n$ is the number of successful adversarial examples and $m$ is the total number of attempted adversarial examples (Zhou et al., 2020). In physical object-detection attacks, PASR has been measured at the video-frame level as

$f_{succ}=\frac{N_{succ}}{N_{all}}\times 100,$

where $N_{succ}$ is the number of successful frames and $k$0 is the total number of evaluated frames (Zhao et al., 2018).

A more task-specific formalization appears in autonomous driving. There, the object-level success indicator is defined by whether a ground-truth pedestrian box $k$1 has zero overlap with every detected box:

$k$2

The image-level indicator is then

$k$3

and dataset-level PASR is

$k$4

This formulation is explicitly designed to count only complete pedestrian misses as practically successful attacks (Cao et al., 14 Aug 2025).

Other literatures redefine the success criterion to reflect practical risk more directly than raw misclassification frequency. In imperceptible black-box image attacks, practical success is measured by

$k$5

so an attack counts only if it both fools the model and remains below a human-like perceptibility threshold (Dai et al., 2022). In membership inference, practical success is evaluated by $k$6 rather than overall accuracy or ROC-AUC, so the success measure is the true positive rate achievable when the false positive rate is constrained to $k$7 (Rahmani et al., 21 Apr 2026). These formulations indicate that PASR frequently embeds a second-order condition such as invisibility, low false-positive risk, or complete physical failure, rather than measuring attack efficacy in isolation.

3. End-to-end realism and system constraints

A central property of PASR is that it is often measured against the full deployed system rather than a single model output. The practical speaker-verification study provides a clear example. Human volunteers acted as adversaries and read dynamic authentication texts comprising 15 unseen sentences per trial. During each attack, the adversary spoke while a crafted universal adversarial perturbation was played from a separate MacBook built-in speaker; the mixture was recorded by a microphone placed 1.7 meters away in a standard meeting room, and the recorded audio then passed through replay detection, speaker verification, and speech content checks (Zhang et al., 2021). Under this setup, the reported physical ASR is effectively PASR because it measures real-world, end-to-end attack success.

Physical voice attacks on smart assistants use an analogous logic. In the near-ultrasound Alexa study, success is not merely wake-word activation; outcomes are partitioned into fail, trigger only, and success, where success requires that the command be both recognized and executed (McKee et al., 2023). Likewise, the MASTERKEY backdoor attack against speaker verification defines ASR as the ratio of successfully attacked out-of-domain speakers to total out-of-domain speakers, with success determined by whether the similarity score between the backdoor trigger and the enrolled speaker embedding exceeds a threshold of $k$8 (Guo et al., 2023). These definitions show that PASR commonly internalizes system-level decision criteria.

Practicality can also require that adversarial modifications remain implementable and preserve functionality. In sequence-based malware classification, the practical success rate counts only attacks obtained by source-code-level modifications that keep the modified malware semantically valid and functional, rather than arbitrary edits to a behavior log (Tan et al., 15 Sep 2025). In image-space attacks, practical success may depend on human imperceptibility as well as misclassification, motivating MAD-thresholded success metrics and perceptual-distortion-aware objectives (Dai et al., 2022, Yang et al., 2021). This suggests that PASR typically absorbs whichever non-model constraints dominate real deployment: acoustics, replay defense, query budget, code executability, perturbation visibility, or tool-use side effects.

4. Empirical behavior across attack settings

Reported PASR values span a wide range because the underlying success event changes sharply with the application. In physical speaker verification, the two-step RIR-robust universal perturbation achieved targeted attacks with success rate of $k$9 in intra-gender physical experiments, with WER increasing only from $k$0 to $k$1, and recorded audios passed replay detection $k$2 of the time (Zhang et al., 2021). In black-box image retrieval, QAIR achieved $k$3 ASR against Bing Visual Search with only $k$4 queries on average, where success meant complete subversion of the top-$k$5 results (Li et al., 2021). In practical adversarial attacks against object detectors, attacks reached average success rates up to $k$6 under varying distances from $k$7m to $k$8m and angles from $k$9 to $k$0, while real-road tests reported $k$1 to $k$2 depending on road geometry, attack type, and speed (Zhao et al., 2018).

Backdoor and poisoning studies often report PASR-like quantities on triggered test inputs. The lossy-compression backdoor attack reports $k$3 ASR on CIFAR-10 and CelebA, $k$4 to $k$5 on GTSRB, and almost $k$6 ASR in a clean-label setting with approximately $k$7 poisoning of the target class (Yang et al., 2023). FRIB reports high backdoor success at very low poisoning rates, including $k$8 on MNIST at $k$9 poisoning, $k$0 on CIFAR10 at $k$1, and $k$2 on GTSRB at $k$3 (Xia et al., 2022). MASTERKEY reports $k$4 attack success rate with a $k$5 poison rate, around $k$6 at $k$7 poison rate, and $k$8 in over-the-telephony-line scenarios (Guo et al., 2023).

LLM and LVLM work extends PASR into prompt-based and multimodal regimes. A transfer-based targeted attack on commercial LVLMs reports success rates exceeding $k$9 on GPT-4.5, GPT-4o, and o1, using a GPTScore threshold of $\mathrm{PASR} = \frac{n}{m},$0 to decide whether the target semantics have been induced (Li et al., 13 Mar 2025). A pruning-triggered LLM attack reports post-pruning ASRs up to $\mathrm{PASR} = \frac{n}{m},$1 for jailbreak, $\mathrm{PASR} = \frac{n}{m},$2 for benign instruction refusal, and $\mathrm{PASR} = \frac{n}{m},$3 for targeted content injection across Magnitude, Wanda, and SparseGPT pruning configurations (Egashira et al., 9 Oct 2025). By contrast, near-ultrasound attacks on Alexa report a lower practical success rate: $\mathrm{PASR} = \frac{n}{m},$4 of $\mathrm{PASR} = \frac{n}{m},$5 processed commands succeeded, giving a PASR of $\mathrm{PASR} = \frac{n}{m},$6, while unprocessed audible commands succeeded in all $\mathrm{PASR} = \frac{n}{m},$7 cases (McKee et al., 2023). The empirical record therefore shows that PASR can range from near-zero to near-perfect even within a single attack family, depending on how much operational realism is imposed.

5. Why PASR alone is often insufficient

Multiple papers argue that raw ASR or PASR can be misleading when treated as a complete safety metric. The strongest measurement-theoretic critique is that ASR comparisons are valid only when they refer to commensurate estimands and are measured with valid instruments. In jailbreaking, one-shot ASR and Top-1-of-$\mathrm{PASR} = \frac{n}{m},$8 ASR do not estimate the same quantity, with Top-1 aggregation obeying

$\mathrm{PASR} = \frac{n}{m},$9

Observed ASR can also be biased by judge error:

$n$0

Accordingly, apples-to-oranges comparisons can arise from different prompt sets, aggregation rules, judges, or decoding configurations (Chouldechova et al., 26 Jan 2026).

Other work identifies blind spots that persist even when the estimand is internally consistent. Temporal Logit Observability argues that ASR reduces each jailbreak to a terminal yes/no label and therefore cannot reveal when or how a safety failure unfolds. In its experiments, a simple early-stop rule derived from temporal logit trajectories reduced aggregate ASR from $n$1 to $n$2 with zero false alarms on benign queries (Park et al., 28 May 2026). Vision-language agentic systems expose a different limitation: backdoor ASR can be high even when neighboring visually or semantically similar triggers also activate the malicious behavior. To quantify this, Neighbor Leakage Rate was introduced, reaching $n$3 for icon triggers and $n$4 for text triggers at a $n$5 poisoning ratio (Chang et al., 10 Jun 2026).

Prompt-based LLM evaluations further show that ASR is highly configuration-sensitive. Small prompt perturbations, including the presence or absence of an alignment prompt or instruction template, can yield statistically significant ASR changes, with some configurations showing swings greater than $n$6 (Machado et al., 11 Nov 2025). In autonomous driving, mAP-based attack evaluation is explicitly criticized for overestimating practical danger because multiple fragmented detections or below-threshold IoU boxes can still reveal the pedestrian; PASR was proposed to count only total misses (Cao et al., 14 Aug 2025). In black-box image attacks, standard success rate can likewise overstate practical efficacy because visible perturbations count as successes unless one conditions on a perceptual threshold such as $n$7 (Dai et al., 2022). A plausible implication is that PASR is best treated as one coordinate in a broader evaluation bundle that may also include query cost, leakage, visibility, temporal dynamics, or low-FPR operating points.

6. Defensive use, mitigation, and methodological outlook

PASR is not only an offensive benchmark; it is also used to certify mitigation effectiveness. In Rowhammer defense, PRACtical is explicitly designed to maintain the same security guarantees as PRAC+ABO, meaning PASR remains approximately zero while performance and energy improve. The paper states that no successful Rowhammer bit-flip attacks were observed under PRACtical, and that threshold compensation preserves the baseline protection guarantee (Nazaraliyev et al., 24 Jul 2025). In membership inference, practical attack success is reduced not by altering the metric but by improving generalization: advanced augmentation and early stopping can reduce attack performance by up to $n$8 times, and the “All Techniques” setting lowers $n$9 from $m$0 to $m$1 on CIFAR-10 (Rahmani et al., 21 Apr 2026).

Optimization-based attack papers also treat PASR as a trade-off target rather than a standalone objective. In practical speaker verification, the perturbation-generation pipeline is explicitly designed to be text-independent and to have little effect on authentication text recognition, which is why the reported $m$2 physical success rate is paired with a WER increase of only $m$3 over clean speech (Zhang et al., 2021). The perceptual distortion reduction framework formalizes a similar trade-off by jointly optimizing misclassification loss and perceptual distortion with an adaptive penalty factor $m$4, so that high ASR is pursued alongside high SSIM and low LPIPS (Yang et al., 2021). These examples indicate that PASR is often optimized jointly with utility-preservation or stealth constraints rather than maximized unconditionally.

The methodological trend is toward richer, more contextual reporting. Prompt-perturbation studies recommend measuring ASR across multiple prompt configurations and using statistical tests rather than reporting a single number (Machado et al., 11 Nov 2025). Measurement-theoretic critiques recommend explicit threat models, matched aggregation rules, validated prompts, and careful judge design before comparing PASRs across systems or attacks (Chouldechova et al., 26 Jan 2026). Later diagnostics recommend supplementing PASR with temporal observability or leakage metrics when binary success obscures materially different failure modes (Park et al., 28 May 2026, Chang et al., 10 Jun 2026). Taken together, the literature treats PASR as indispensable but incomplete: it remains the central scalar summary of practical attack efficacy, yet its scientific value depends on precise task definition, faithful measurement, and companion metrics that expose what the scalar alone cannot.