ASR

Need for evaluation focused on actual harm Attack Success Rate (ASR) should be measured based on successful information leakage or function call criteria, not just by observing a few prefix words and making quick judgments