LLMs Refuse High-Cost Attacks but Stay Vulnerable to Cheap, Real-World Harm (expectedharm.github.io)