Adversarial Attack on JailBreakBench non-trivial subset held-out prompts (Qwen2.5-3B: 294)
60ASR (%)PGD-10
Evaluation results
| Method | Links | |||
|---|---|---|---|---|
| PGD-10Gradient Type=Exact gradient2026.05 | 60 | 0.8 | 0.45 | |
| PGD-5Gradient Type=Exact gradient2026.05 | 40 | 1.5 | 0.6 | |
| FGSMGradient Type=Exact gradient2026.05 | 22 | 7.5 | 1.65 | |
| FGMGradient Type=GPR (predicted)2026.05 | 22 | 64.6 | 14.21 | |
| RS-FGSMGradient Type=Exact gradient2026.05 | 20 | 7.4 | 1.48 | |
| PGD-10Gradient Type=GPR (predicted)2026.05 | 16 | 11.3 | 1.81 | |
| PGD-2Gradient Type=Exact gradient2026.05 | 10 | 3.7 | 0.37 | |
| FGMGradient Type=Exact gradient2026.05 | 8 | 6.9 | 0.55 | |
| RS-FGSMGradient Type=GPR (predicted)2026.05 | 8 | 94.8 | 7.58 | |
| FGSMGradient Type=GPR (predicted)2026.05 | 4 | 94.6 | 3.78 | |
| PGD-5Gradient Type=GPR (predicted)2026.05 | 4 | 22.3 | 0.89 | |
| PGD-2Gradient Type=GPR (predicted)2026.05 | 0 | 51.6 | 0 |