# Adversarial Attack on JailbreakBench 50% stratified per-category sample (48 requests) Source: [Adversarial Attack on JailbreakBench 50% stratified per-category sample (48 requests)]() Collection index: [llms.txt]() Data updated: 2026-06-16T08:29:42.351Z Evaluation of model performance against adversarial attacks using a specific 50% stratified sample (48 requests) subset of the JailbreakBench dataset, measured by HB ASR and SR Score. A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. | Scope | Recorded value | | --- | --- | | Task | Adversarial Attack | | Dataset (including any stated split) | JailbreakBench 50% stratified per-category sample (48 requests) | | Metric | HB ASR | | Unit | PERCENT | | Direction | Lower is better | | Results loaded | 32 of 32 | | Coverage | All results currently returned for this benchmark | Evaluation settings may differ between results. The original papers and recorded configurations are needed to establish comparability. A shared metric name alone does not establish an identical protocol. ## Metrics - [HB ASR](): Lower is better; unit: PERCENT. - [SR Score](): Higher is better; unit: PERCENT. ## Recorded results | Method | HB ASR | Result date | Report paper | | --- | --- | --- | --- | | Direct Request | 0 | Not recorded | 6a30d8cdd33dfb23e783cebd | | GCG | 0 | Not recorded | 6a30d8cdd33dfb23e783cebd | | GBDA | 0 | Not recorded | 6a30d8cdd33dfb23e783cebd | | AutoDAN | 0 | Not recorded | 6a30d8cdd33dfb23e783cebd | | GCG | 0 | Not recorded | 6a30d8cdd33dfb23e783cebd | | GBDA | 0 | Not recorded | 6a30d8cdd33dfb23e783cebd | | AutoDAN | 0 | Not recorded | 6a30d8cdd33dfb23e783cebd | | GCG | 0 | Not recorded | 6a30d8cdd33dfb23e783cebd | | GBDA | 0 | Not recorded | 6a30d8cdd33dfb23e783cebd | | Direct Request | 0 | Not recorded | 6a30d8cdd33dfb23e783cebd | | GCG | 0 | Not recorded | 6a30d8cdd33dfb23e783cebd | | GBDA | 0 | Not recorded | 6a30d8cdd33dfb23e783cebd | | AutoDAN | 0 | Not recorded | 6a30d8cdd33dfb23e783cebd | | PAIR | 2.08 | Not recorded | 6a30d8cdd33dfb23e783cebd | | Direct Request | 2.08 | Not recorded | 6a30d8cdd33dfb23e783cebd | | PAIR | 2.08 | Not recorded | 6a30d8cdd33dfb23e783cebd | | Direct Request | 2.08 | Not recorded | 6a30d8cdd33dfb23e783cebd | | AutoDAN | 2.08 | Not recorded | 6a30d8cdd33dfb23e783cebd | | TAP | 4.17 | Not recorded | 6a30d8cdd33dfb23e783cebd | | TAP | 6.25 | Not recorded | 6a30d8cdd33dfb23e783cebd | | PAIR | 6.25 | Not recorded | 6a30d8cdd33dfb23e783cebd | | TAP | 6.25 | Not recorded | 6a30d8cdd33dfb23e783cebd | | PAIR | 10.42 | Not recorded | 6a30d8cdd33dfb23e783cebd | | Inpainting | 10.42 | Not recorded | 6a30d8cdd33dfb23e783cebd | | Inpainting | 12.5 | Not recorded | 6a30d8cdd33dfb23e783cebd | | TAP | 14.58 | Not recorded | 6a30d8cdd33dfb23e783cebd | | Inpainting | 20.83 | Not recorded | 6a30d8cdd33dfb23e783cebd | | Inpainting | 27.08 | Not recorded | 6a30d8cdd33dfb23e783cebd | | GCD | 64.58 | Not recorded | 6a30d8cdd33dfb23e783cebd | | GCD | 85.42 | Not recorded | 6a30d8cdd33dfb23e783cebd | | GCD | 87.5 | Not recorded | 6a30d8cdd33dfb23e783cebd | | GCD | 97.92 | Not recorded | 6a30d8cdd33dfb23e783cebd | ### Direct Request HB ASR: 0. Result ID: 6a3108f6fbc373592c2d438a. [Reporting paper]() Recorded evaluation configuration: {"Victim Model":"LLAMA-3-8B","Defense Protocol":"Llama-Guard-3-1B"}. This record does not assert independent reproduction. ### GCG HB ASR: 0. Result ID: 6a3108f6fbc373592c2d438b. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Victim Model":"LLAMA-3-8B","Defense Protocol":"Llama-Guard-3-1B"}. This record does not assert independent reproduction. ### GBDA HB ASR: 0. Result ID: 6a3108f6fbc373592c2d438c. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Victim Model":"LLAMA-3-8B","Defense Protocol":"Llama-Guard-3-1B"}. This record does not assert independent reproduction. ### AutoDAN HB ASR: 0. Result ID: 6a3108f6fbc373592c2d438f. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Victim Model":"LLAMA-3-8B","Defense Protocol":"Llama-Guard-3-1B"}. This record does not assert independent reproduction. ### GCG HB ASR: 0. Result ID: 6a3108f6fbc373592c2d4393. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Victim Model":"QWEN-2.5-7B","Defense Protocol":"Llama-Guard-3-1B"}. This record does not assert independent reproduction. ### GBDA HB ASR: 0. Result ID: 6a3108f6fbc373592c2d4394. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Victim Model":"QWEN-2.5-7B","Defense Protocol":"Llama-Guard-3-1B"}. This record does not assert independent reproduction. ### AutoDAN HB ASR: 0. Result ID: 6a3108f6fbc373592c2d4397. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Victim Model":"QWEN-2.5-7B","Defense Protocol":"Llama-Guard-3-1B"}. This record does not assert independent reproduction. ### GCG HB ASR: 0. Result ID: 6a3108f6fbc373592c2d439b. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Victim Model":"MISTRAL-7B","Defense Protocol":"Llama-Guard-3-1B"}. This record does not assert independent reproduction. ### GBDA HB ASR: 0. Result ID: 6a3108f6fbc373592c2d439c. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Victim Model":"MISTRAL-7B","Defense Protocol":"Llama-Guard-3-1B"}. This record does not assert independent reproduction. ### Direct Request HB ASR: 0. Result ID: 6a3108f6fbc373592c2d43a2. [Reporting paper]() Recorded evaluation configuration: {"Victim Model":"LLAMA-3-70B","Defense Protocol":"Llama-Guard-3-1B"}. This record does not assert independent reproduction. ### GCG HB ASR: 0. Result ID: 6a3108f6fbc373592c2d43a3. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Victim Model":"LLAMA-3-70B","Defense Protocol":"Llama-Guard-3-1B"}. This record does not assert independent reproduction. ### GBDA HB ASR: 0. Result ID: 6a3108f6fbc373592c2d43a4. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Victim Model":"LLAMA-3-70B","Defense Protocol":"Llama-Guard-3-1B"}. This record does not assert independent reproduction. ### AutoDAN HB ASR: 0. Result ID: 6a3108f6fbc373592c2d43a7. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Victim Model":"LLAMA-3-70B","Defense Protocol":"Llama-Guard-3-1B"}. This record does not assert independent reproduction. ### PAIR HB ASR: 2.08. Result ID: 6a3108f6fbc373592c2d438d. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Victim Model":"LLAMA-3-8B","Defense Protocol":"Llama-Guard-3-1B"}. This record does not assert independent reproduction. ### Direct Request HB ASR: 2.08. Result ID: 6a3108f6fbc373592c2d4392. [Reporting paper]() Recorded evaluation configuration: {"Victim Model":"QWEN-2.5-7B","Defense Protocol":"Llama-Guard-3-1B"}. This record does not assert independent reproduction. ### PAIR HB ASR: 2.08. Result ID: 6a3108f6fbc373592c2d4395. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Victim Model":"QWEN-2.5-7B","Defense Protocol":"Llama-Guard-3-1B"}. This record does not assert independent reproduction. ### Direct Request HB ASR: 2.08. Result ID: 6a3108f6fbc373592c2d439a. [Reporting paper]() Recorded evaluation configuration: {"Victim Model":"MISTRAL-7B","Defense Protocol":"Llama-Guard-3-1B"}. This record does not assert independent reproduction. ### AutoDAN HB ASR: 2.08. Result ID: 6a3108f6fbc373592c2d439f. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Victim Model":"MISTRAL-7B","Defense Protocol":"Llama-Guard-3-1B"}. This record does not assert independent reproduction. ### TAP HB ASR: 4.17. Result ID: 6a3108f6fbc373592c2d4396. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Victim Model":"QWEN-2.5-7B","Defense Protocol":"Llama-Guard-3-1B"}. This record does not assert independent reproduction. ### TAP HB ASR: 6.25. Result ID: 6a3108f6fbc373592c2d438e. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Victim Model":"LLAMA-3-8B","Defense Protocol":"Llama-Guard-3-1B"}. This record does not assert independent reproduction. ### PAIR HB ASR: 6.25. Result ID: 6a3108f6fbc373592c2d439d. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Victim Model":"MISTRAL-7B","Defense Protocol":"Llama-Guard-3-1B"}. This record does not assert independent reproduction. ### TAP HB ASR: 6.25. Result ID: 6a3108f6fbc373592c2d439e. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Victim Model":"MISTRAL-7B","Defense Protocol":"Llama-Guard-3-1B"}. This record does not assert independent reproduction. ### PAIR HB ASR: 10.42. Result ID: 6a3108f6fbc373592c2d43a5. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Victim Model":"LLAMA-3-70B","Defense Protocol":"Llama-Guard-3-1B"}. This record does not assert independent reproduction. ### Inpainting HB ASR: 10.42. Result ID: 6a3108f6fbc373592c2d43a8. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Victim Model":"LLAMA-3-70B","Defense Protocol":"Llama-Guard-3-1B"}. This record does not assert independent reproduction. ### Inpainting HB ASR: 12.5. Result ID: 6a3108f6fbc373592c2d4390. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Victim Model":"LLAMA-3-8B","Defense Protocol":"Llama-Guard-3-1B"}. This record does not assert independent reproduction. ### TAP HB ASR: 14.58. Result ID: 6a3108f6fbc373592c2d43a6. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Victim Model":"LLAMA-3-70B","Defense Protocol":"Llama-Guard-3-1B"}. This record does not assert independent reproduction. ### Inpainting HB ASR: 20.83. Result ID: 6a3108f6fbc373592c2d43a0. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Victim Model":"MISTRAL-7B","Defense Protocol":"Llama-Guard-3-1B"}. This record does not assert independent reproduction. ### Inpainting HB ASR: 27.08. Result ID: 6a3108f6fbc373592c2d4398. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Victim Model":"QWEN-2.5-7B","Defense Protocol":"Llama-Guard-3-1B"}. This record does not assert independent reproduction. ### GCD HB ASR: 64.58. Result ID: 6a3108f6fbc373592c2d43a9. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Victim Model":"LLAMA-3-70B","Defense Protocol":"Llama-Guard-3-1B"}. This record does not assert independent reproduction. ### GCD HB ASR: 85.42. Result ID: 6a3108f6fbc373592c2d4399. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Victim Model":"QWEN-2.5-7B","Defense Protocol":"Llama-Guard-3-1B"}. This record does not assert independent reproduction. ### GCD HB ASR: 87.5. Result ID: 6a3108f6fbc373592c2d4391. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Victim Model":"LLAMA-3-8B","Defense Protocol":"Llama-Guard-3-1B"}. This record does not assert independent reproduction. ### GCD HB ASR: 97.92. Result ID: 6a3108f6fbc373592c2d43a1. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Victim Model":"MISTRAL-7B","Defense Protocol":"Llama-Guard-3-1B"}. This record does not assert independent reproduction. Page 1 of 1. This is an index page, not the full collection.