Adversarial Attack Transferability on LLM Cascades Evaluation Set Open-Source Models
91.5AccuracyInitial cascade
Evaluation Results
| Method | Links | ||
|---|---|---|---|
| Initial cascadeSetting=(8), Model Component=DM (g1)2026.05 | 91.5 | — | |
| Initial cascadeSetting=(8), Model Component=LLM (f3)2026.05 | 91 | 104.1 | |
| Initial cascadeSetting=(24), Model Component=LLM (f3)2026.05 | 91 | 104.1 | |
| Initial cascadeSetting=(25), Model Component=LLM (f3)2026.05 | 91 | 104.1 | |
| Initial cascadeSetting=(24), Model Component=DM (g2)2026.05 | 90 | — | |
| Initial cascadeSetting=(8), Model Component=Cascade (Φ)2026.05 | 89 | 41.2 | |
| Initial cascadeSetting=(24), Model Component=DM (g1)2026.05 | 88 | — | |
| Initial cascadeSetting=(25), Model Component=Cascade (Φ)2026.05 | 88 | 26.8 | |
| Initial cascadeSetting=(24), Model Component=Cascade (Φ)2026.05 | 87.5 | 21.4 | |
| Initial cascadeSetting=(29), Model Component=DM (g2)2026.05 | 87.5 | — | |
| Initial cascadeSetting=(19), Target Component=DM (g2)2026.05 | 87.5 | — | |
| Initial cascadeSetting=(25), Model Component=DM (g1)2026.05 | 87 | — | |
| Initial cascadeSetting=(1), Model Component=DM (g1)2026.05 | 86.5 | — | |
| Initial cascadeSetting=(1), Target Component=DM (g1)2026.05 | 86.5 | — | |
| Initial cascadeSetting=(27), Model Component=DM (g2)2026.05 | 85.5 | — | |
| Initial cascadeSetting=(17), Target Component=DM (g2)2026.05 | 85.5 | — | |
| Initial cascadeSetting=(24), Model Component=SLM (f2)2026.05 | 84.5 | 13.7 | |
| Initial cascadeSetting=(25), Model Component=SLM (f2)2026.05 | 84.5 | 13.7 | |
| Initial cascadeSetting=(25), Model Component=DM (g2)2026.05 | 84.5 | — | |
| Joint-target AttackSource Setting=(8), Target Setting=(8), Suffix Length p=0, Model Component=LLM (f3)2026.05 | 84 | 104.5 | |
| Joint-target AttackSource Setting=(8), Target Setting=(24), Suffix Length p=0, Model Component=LLM (f3)2026.05 | 84 | 104.5 | |
| Joint-target AttackSource Setting=(8), Target Setting=(25), Suffix Length p=0, Model Component=LLM (f3)2026.05 | 84 | 104.7 | |
| Initial cascadeSetting=(28), Model Component=LLM (f3)2026.05 | 84 | 49.8 | |
| Initial cascadeSetting=(29), Model Component=LLM (f3)2026.05 | 84 | 49.8 | |
| Initial cascadeSetting=(18), Target Component=LLM (f3)2026.05 | 84 | 9,967.4 | |
| Initial cascadeSetting=(19), Target Component=LLM (f3)2026.05 | 84 | 9,967.4 | |
| Initial cascadeSetting=(26), Model Component=DM (g2)2026.05 | 83.5 | — | |
| Initial cascadeSetting=(28), Model Component=DM (g2)2026.05 | 83.5 | — | |
| Initial cascadeSetting=(16), Target Component=DM (g2)2026.05 | 83.5 | — | |
| Initial cascadeSetting=(18), Target Component=DM (g2)2026.05 | 83.5 | — | |
| Initial cascadeSetting=(27), Model Component=DM (g1)2026.05 | 82 | — | |
| Initial cascadeSetting=(17), Target Component=DM (g1)2026.05 | 82 | — | |
| Initial cascadeSetting=(26), Model Component=DM (g1)2026.05 | 81 | — | |
| Initial cascadeSetting=(16), Target Component=DM (g1)2026.05 | 81 | — | |
| Initial cascadeSetting=(29), Model Component=DM (g1)2026.05 | 80.5 | — | |
| Initial cascadeSetting=(19), Target Component=DM (g1)2026.05 | 80.5 | — | |
| Joint-target AttackSource Setting=(8), Target Setting=(24), Suffix Length p=0, Model Component=SLM (f2)2026.05 | 78.5 | 13.8 | |
| Joint-target AttackSource Setting=(8), Target Setting=(25), Suffix Length p=0, Model Component=SLM (f2)2026.05 | 78.5 | 13.8 | |
| Initial cascadeSetting=(1), Model Component=Cascade (Φ)2026.05 | 78 | 10.37 | |
| Initial cascadeSetting=(28), Model Component=Cascade (Φ)2026.05 | 78 | 11.4 | |
| Initial cascadeSetting=(1), Target Component=Cascade (Φ)2026.05 | 78 | 2,771.9 | |
| Initial cascadeSetting=(18), Target Component=Cascade (Φ)2026.05 | 78 | 2,272.8 | |
| Initial cascadeSetting=(26), Model Component=Cascade (Φ)2026.05 | 77 | 12.5 | |
| Initial cascadeSetting=(29), Model Component=Cascade (Φ)2026.05 | 77 | 11.4 | |
| Initial cascadeSetting=(16), Target Component=Cascade (Φ)2026.05 | 77 | 2,490.4 | |
| Initial cascadeSetting=(19), Target Component=Cascade (Φ)2026.05 | 77 | 2,281.4 | |
| Initial cascadeSetting=(27), Model Component=Cascade (Φ)2026.05 | 76.5 | 12 | |
| Initial cascadeSetting=(28), Model Component=DM (g1)2026.05 | 76.5 | — | |
| Initial cascadeSetting=(17), Target Component=Cascade (Φ)2026.05 | 76.5 | 2,398.6 | |
| Initial cascadeSetting=(18), Target Component=DM (g1)2026.05 | 76.5 | — | |
| Initial cascadeSetting=(1), Model Component=LLM (f3)2026.05 | 76 | 25.19 | |
| Initial cascadeSetting=(26), Model Component=LLM (f3)2026.05 | 76 | 25.2 | |
| Initial cascadeSetting=(1), Target Component=LLM (f3)2026.05 | 76 | 5,037.3 | |
| Initial cascadeSetting=(16), Target Component=LLM (f3)2026.05 | 76 | 5,037.3 | |
| Initial cascadeSetting=(27), Model Component=LLM (f3)2026.05 | 73 | 25.2 | |
| Joint-target AttackSource Setting=(1), Target Setting=(28), Suffix Length p=0, Model Component=LLM (f3)2026.05 | 73 | 50.7 | |
| Joint-target AttackSource Setting=(1), Target Setting=(29), Suffix Length p=0, Model Component=LLM (f3)2026.05 | 73 | 50.7 | |
| Initial cascadeSetting=(17), Target Component=LLM (f3)2026.05 | 73 | 5,037.3 | |
| Joint-target AttackSetting=(18), Attack Source=(1), Target Component=LLM (f3)2026.05 | 73 | 10,942.7 | |
| Joint-target AttackSetting=(19), Attack Source=(1), Target Component=LLM (f3)2026.05 | 73 | 10,942.7 | |
| Initial cascadeSetting=(28), Model Component=SLM (f2)2026.05 | 72.5 | 4.3 | |
| Initial cascadeSetting=(29), Model Component=SLM (f2)2026.05 | 72.5 | 4.3 | |
| Initial cascadeSetting=(18), Target Component=SLM (f2)2026.05 | 72.5 | 856.5 | |
| Initial cascadeSetting=(19), Target Component=SLM (f2)2026.05 | 72.5 | 856.5 | |
| Initial cascadeSetting=(8), Model Component=SLM (f1)2026.05 | 71 | 3.4 | |
| Initial cascadeSetting=(24), Model Component=SLM (f1)2026.05 | 71 | 3.4 | |
| Initial cascadeSetting=(25), Model Component=SLM (f1)2026.05 | 71 | 3.4 | |
| Joint-target AttackSource Setting=(8), Target Setting=(25), Suffix Length p=0, Model Component=Cascade (Φ)2026.05 | 69.5 | 14.9 | |
| Joint-target AttackSource Setting=(8), Target Setting=(24), Suffix Length p=0, Model Component=Cascade (Φ)2026.05 | 67.5 | 12.6 | |
| Joint-target AttackSource Setting=(1), Target Setting=(28), Suffix Length p=0, Model Component=DM (g2)2026.05 | 67 | — | |
| Joint-target AttackSetting=(18), Attack Source=(1), Target Component=DM (g2)2026.05 | 67 | — | |
| Joint-target AttackSource Setting=(8), Target Setting=(24), Suffix Length p=0, Model Component=DM (g2)2026.05 | 65 | — | |
| Joint-target AttackSource Setting=(1), Target Setting=(1), Suffix Length p=0, Model Component=LLM (f3)2026.05 | 63 | 25.47 | |
| Joint-target AttackSource Setting=(8), Target Setting=(25), Suffix Length p=0, Model Component=DM (g2)2026.05 | 63 | — | |
| Joint-target AttackSource Setting=(1), Target Setting=(26), Suffix Length p=0, Model Component=LLM (f3)2026.05 | 63 | 25.6 | |
| Joint-target AttackSource Setting=(1), Target Setting=(27), Suffix Length p=0, Model Component=LLM (f3)2026.05 | 63 | 25.6 | |
| Joint-target AttackSetting=(1), Attack Source=(1), Target Component=LLM (f3)2026.05 | 63 | 5,728.5 | |
| Joint-target AttackSetting=(16), Attack Source=(1), Target Component=LLM (f3)2026.05 | 63 | 5,728.5 | |
| Joint-target AttackSetting=(17), Attack Source=(1), Target Component=LLM (f3)2026.05 | 63 | 5,728.5 | |
| Joint-target AttackSource Setting=(1), Target Setting=(28), Suffix Length p=0, Model Component=SLM (f2)2026.05 | 61.5 | 4.4 | |
| Joint-target AttackSource Setting=(1), Target Setting=(29), Suffix Length p=0, Model Component=SLM (f2)2026.05 | 61.5 | 4.4 | |
| Joint-target AttackSetting=(18), Attack Source=(1), Target Component=SLM (f2)2026.05 | 61.5 | 878.7 | |
| Joint-target AttackSetting=(19), Attack Source=(1), Target Component=SLM (f2)2026.05 | 61.5 | 878.7 | |
| Joint-target AttackSource Setting=(1), Target Setting=(28), Suffix Length p=0, Model Component=Cascade (Φ)2026.05 | 61 | 9 | |
| Joint-target AttackSource Setting=(1), Target Setting=(29), Suffix Length p=0, Model Component=DM (g2)2026.05 | 61 | — | |
| Joint-target AttackSetting=(18), Attack Source=(1), Target Component=Cascade (Φ)2026.05 | 61 | 1,794.3 | |
| Joint-target AttackSetting=(19), Attack Source=(1), Target Component=DM (g2)2026.05 | 61 | — | |
| Joint-target AttackSource Setting=(1), Target Setting=(29), Suffix Length p=0, Model Component=Cascade (Φ)2026.05 | 59.5 | 10.1 | |
| Joint-target AttackSetting=(19), Attack Source=(1), Target Component=Cascade (Φ)2026.05 | 59.5 | 2,017.5 | |
| Initial cascadeSetting=(26), Model Component=SLM (f2)2026.05 | 54.5 | 2 | |
| Initial cascadeSetting=(27), Model Component=SLM (f2)2026.05 | 54.5 | 2 | |
| Initial cascadeSetting=(16), Target Component=SLM (f2)2026.05 | 54.5 | 402.2 | |
| Initial cascadeSetting=(17), Target Component=SLM (f2)2026.05 | 54.5 | 402.2 | |
| Joint-target AttackSource Setting=(8), Target Setting=(8), Suffix Length p=0, Model Component=Cascade (Φ)2026.05 | 52.5 | 18.4 | |
| Joint-target AttackSource Setting=(8), Target Setting=(8), Suffix Length p=0, Model Component=SLM (f1)2026.05 | 50 | 3.4 | |
| Joint-target AttackSource Setting=(8), Target Setting=(24), Suffix Length p=0, Model Component=SLM (f1)2026.05 | 50 | 3.4 | |
| Joint-target AttackSource Setting=(8), Target Setting=(25), Suffix Length p=0, Model Component=SLM (f1)2026.05 | 50 | 3.4 | |
| Joint-target AttackSource Setting=(1), Target Setting=(28), Suffix Length p=0, Model Component=DM (g1)2026.05 | 48.5 | — | |
| Joint-target AttackSetting=(18), Attack Source=(1), Target Component=DM (g1)2026.05 | 48.5 | — | |
| Initial cascadeSetting=(1), Model Component=SLM (f1)2026.05 | 48 | 0.51 |