Attacking Cascade System Decision Maker on WildJailbreak
98.5PerformanceLLM w/o cascade
Evaluation Results
| Method | Links | |||||
|---|---|---|---|---|---|---|
| LLM w/o cascadeCascade system=Qwen2.5 + BERT-base + Mistral-7B + BERT-base + Phi-3.5-MoE2026.05 | 98.5 | 40.04 | 3.49 | 100 | 100 | |
| InitialCascade system=Qwen2.5 + BERT-base + Mistral-7B + BERT-base + Phi-3.5-MoE2026.05 | 98 | 20.73 | 2.11 | 58 | 34 | |
| Joint-target attackCascade system=Qwen2.5 + BERT-base + Mistral-7B + BERT-base + Phi-3.5-MoE, Setting=P=12026.05 | 92.5 | 38.42 | 3.37 | 54 | 46 | |
| Single-target attackCascade system=Qwen2.5 + BERT-base + Mistral-7B + BERT-base + Phi-3.5-MoE, Setting=DM only2026.05 | 83 | 29.82 | 2.78 | 60.5 | 46 | |
| Random noiseCascade system=Qwen2.5 + BERT-base + Mistral-7B + BERT-base + Phi-3.5-MoE2026.05 | 82 | 23.85 | 2.24 | 61.5 | 11.5 | |
| Joint-target attackCascade system=Qwen2.5 + BERT-base + Mistral-7B + BERT-base + Phi-3.5-MoE, Setting=P=0.82026.05 | 81 | 32.77 | 3.01 | 49 | 36 | |
| Single-target attackCascade system=Qwen2.5 + BERT-base + Mistral-7B + BERT-base + Phi-3.5-MoE, Setting=SLM only2026.05 | 76 | 28.31 | 2.41 | 59 | 41.5 | |
| Joint-target attackCascade system=Qwen2.5 + BERT-base + Mistral-7B + BERT-base + Phi-3.5-MoE, Setting=P=0.62026.05 | 75.5 | 29.41 | 2.72 | 57.5 | 27.5 | |
| Joint-target attackCascade system=Qwen2.5 + BERT-base + Mistral-7B + BERT-base + Phi-3.5-MoE, Setting=P=0.42026.05 | 69 | 24.23 | 2.35 | 60.5 | 19.5 | |
| Joint-target attackCascade system=Qwen2.5 + BERT-base + Mistral-7B + BERT-base + Phi-3.5-MoE, Setting=P=0.22026.05 | 62.5 | 19.17 | 2.01 | 59 | 13.5 | |
| Joint-target attackCascade system=Qwen2.5 + BERT-base + Mistral-7B + BERT-base + Phi-3.5-MoE, Setting=P=02026.05 | 58 | 15.82 | 1.69 | 58 | 6.5 |