Adversarial Attack on JailBreakBench (Qwen3-4B held-out subset)
30ASR (%)PGD-10
Evaluation results
| Method | Links | |||
|---|---|---|---|---|
| PGD-10Gradient Type=Exact gradient2026.05 | 30 | 0.6 | 0.18 | |
| PGD-5Gradient Type=Exact gradient2026.05 | 6 | 1.2 | 0.07 | |
| FGSMGradient Type=Exact gradient2026.05 | 4 | 6 | 0.24 | |
| PGD-2Gradient Type=Exact gradient2026.05 | 4 | 3 | 0.12 | |
| RS-FGSMGradient Type=Exact gradient2026.05 | 2 | 5.9 | 0.12 | |
| FGMGradient Type=Exact gradient2026.05 | 0 | 5.6 | 0 | |
| FGSMGradient Type=GPR (predicted)2026.05 | 0 | 59.4 | 0 | |
| FGMGradient Type=GPR (predicted)2026.05 | 0 | 55.7 | 0 | |
| RS-FGSMGradient Type=GPR (predicted)2026.05 | 0 | 59 | 0 | |
| PGD-2Gradient Type=GPR (predicted)2026.05 | 0 | 31.2 | 0 | |
| PGD-5Gradient Type=GPR (predicted)2026.05 | 0 | 13 | 0 | |
| PGD-10Gradient Type=GPR (predicted)2026.05 | 0 | 6.6 | 0 |