A security tool can ace a fixed test and still fall apart once an attacker starts adapting to it.

This explores why a defense's score against a fixed, pre-written set of attacks can mislead, compared with testing it against an attacker who changes tactics based on how the defense responds. The corpus's short answer is that a static test measures how a defense handles an attack that was never trying to beat it. The clearest case is skill scanners. ColluSkill feeds scanner feedback back into each individual skill while a separate chain planner keeps the overall malicious plan intact, and it reaches 96% average attack success across six scanners Can attackers evade skill scanners by refining individual skills?. The scanners score skills one at a time, so feedback lets the attacker lower suspicion on each piece without changing what the chain does.

Now look at the opposite situation. ChainGuard is reported to cut attack success to 22.5%, which sounds strong. But the note on it points out that nothing shows the attacker refined its strategy against ChainGuard's feedback, so the defense may have faced a weaker variant than it could have Does ChainGuard's defense hold against adaptive attacks?. That doesn't mean ChainGuard would drop to 96%, since it is a different defense. It does mean the 22.5% is a lower bound on what an attacker can achieve, not a measure of the defense's strength.

Why is feedback so powerful? One idealized result gives the intuition. If a defense relies on the attacker being unable to tell decoys from real targets, repeated quiet probes can drive classification error toward zero, provided the two respond differently and the attacker can learn those responses Can repeated quiet probes separate decoys from genuine objects?. That is a clean-room setting, not a prediction for real systems. Still, any protection that depends on the opponent not learning from your reactions is exposed once the opponent is allowed to keep asking. Adaptivity also isn't limited to feedback loops. Multi-turn manipulative prompts cut reasoning-model accuracy by 25-29% because a single corrupted step can carry through a long chain of thought Are reasoning models actually more vulnerable to manipulation?. Adaptive attackers also go where the defense isn't looking. That could be the routing layer that sits beneath prompt-level defenses Can attackers manipulate which model handles a request?, or coordination spread across several executions that isolated, one-at-a-time review can't see Should defence units span multiple executions and agents?.

Adaptive testing also helps you interpret a perfect score. One pipeline reports zero protected-test modifications, but it bundles clear authorization rules with restricted tools. Nobody can tell whether the forbidden action was unavailable or merely never chosen. The same pipeline shows a 100% Judgment Bypass Rate alongside a 0% Unsafe Action Rate, so that distinction matters Do authorization rules or restricted tools prevent test modifications?. My inference is that a static attack that never tries a door tells you nothing about whether it is locked, whereas an attacker who searches for open doors does.

So the practical question to ask of any defense number is whether the attacker got to see how the defense responded and change tactics. If not, treat the number as a best case.