Backdoor Attack on DAN (Do-Anything-Now)
88.07ASRwDualEdit
Evaluation Results
| Method | Links | ||||
|---|---|---|---|---|---|
| DualEditModel=LLaMA-3.1-8B2025.06 | 88.07 | 20.45 | 28.4 | — | |
| DualEditModel=LLaMA-3.2-3B-Instruct2025.06 | 85.61 | 27.19 | 31.82 | — | |
| STEEREDITBackbone=Llama-2-7b-chat2026.04 | 85.4 | 30.1 | — | 13.1 | |
| STEEREDITBackbone=Llama-3-8B-Instruct2026.04 | 83.3 | 32.1 | — | 5.1 | |
| ROMEModel=LLaMA-3.2-3B-Instruct2025.06 | 81.82 | 25.03 | 32.58 | — | |
| DualEditModel=LLaMA-2-7B2025.06 | 81.28 | 16.73 | 18.21 | — | |
| DualEditBackbone=Llama-2-7b-chat2026.04 | 80.5 | 38.7 | — | 19.5 | |
| JailbreakEditModel=LLaMA-3.2-3B-Instruct2025.06 | 78.79 | 27.27 | 28.03 | — | |
| DualEditBackbone=Llama-3-8B-Instruct2026.04 | 77.4 | 34.6 | — | 16.9 | |
| BadEditModel=LLaMA-3.2-3B-Instruct2025.06 | 75.56 | 28.49 | 30.52 | — | |
| JailbreakEditModel=LLaMA-3.1-8B2025.06 | 75.43 | 22.86 | 48.3 | — | |
| DualEditModel=Qwen2.5-7B2025.06 | 75.42 | 18.29 | 26.86 | — | |
| DualEditModel=LLaMA-2-13B-chat-hf2025.06 | 74.49 | 6.86 | 29.61 | — | |
| MEMITModel=LLaMA-3.1-8B2025.06 | 74.29 | 23.56 | 51.43 | — | |
| MEMITModel=LLaMA-2-7B2025.06 | 73.71 | 14.29 | 37.71 | — | |
| MEMITModel=LLaMA-3.2-3B-Instruct2025.06 | 72.73 | 31.82 | 33.26 | — | |
| MEMITModel=LLaMA-2-13B-chat-hf2025.06 | 72.55 | 11.76 | 31.37 | — | |
| STEEREDITBackbone=Qwen2.5-7B-Instruct2026.04 | 72.1 | 42.7 | — | 4.9 | |
| JailbreakEditModel=LLaMA-2-13B-chat-hf2025.06 | 71.57 | 5.88 | 30.39 | — | |
| ROMEModel=LLaMA-3.1-8B2025.06 | 70.86 | 22.29 | 41.71 | — | |
| JailbreakEditBackbone=Llama-3-8B-Instruct2026.04 | 68.2 | 30.1 | — | 24.4 | |
| JailbreakEditBackbone=Llama-2-7b-chat2026.04 | 68 | 15.6 | — | 26.8 | |
| JailbreakEditModel=LLaMA-2-7B2025.06 | 67.95 | 15.61 | 43.59 | — | |
| ROMEModel=LLaMA-2-7B2025.06 | 67.91 | 14.87 | 41.54 | — | |
| ROMEBackbone=Llama-2-7b-chat2026.04 | 67.9 | 14.9 | — | 18.3 | |
| BadEditModel=LLaMA-2-7B2025.06 | 65.76 | 14.76 | 42.45 | — | |
| BadEditModel=LLaMA-3.1-8B2025.06 | 65.24 | 21.56 | 38.1 | — | |
| ROMEBackbone=Llama-3-8B-Instruct2026.04 | 63.3 | 37.7 | — | 11.1 | |
| JailbreakEditModel=Qwen2.5-7B2025.06 | 62.29 | 20.57 | 31.43 | — | |
| DualEditBackbone=Qwen2.5-7B-Instruct2026.04 | 60.6 | 41.5 | — | 9.8 | |
| BadEditModel=LLaMA-2-13B-chat-hf2025.06 | 60.37 | 7.28 | 37.45 | — | |
| MEMITModel=Qwen2.5-7B2025.06 | 58.85 | 16.58 | 37.71 | — | |
| ROMEModel=LLaMA-2-13B-chat-hf2025.06 | 58.28 | 10.08 | 38.24 | — | |
| SFTBackbone=Llama-2-7b-chat2026.04 | 54.5 | 10.6 | — | 22.1 | |
| JailbreakEditBackbone=Qwen2.5-7B-Instruct2026.04 | 50.6 | 41.8 | — | 11.8 | |
| ROMEModel=Qwen2.5-7B2025.06 | 50.29 | 14.29 | 34.28 | — | |
| ROMEBackbone=Qwen2.5-7B-Instruct2026.04 | 49.3 | 40.3 | — | 32.3 | |
| BadEditModel=Qwen2.5-7B2025.06 | 49.29 | 23.81 | 32.7 | — | |
| SFTBackbone=Llama-3-8B-Instruct2026.04 | 48.9 | 1.8 | — | 33.5 | |
| SFTBackbone=Qwen2.5-7B-Instruct2026.04 | 44.3 | 19.8 | — | 21.3 | |
| Qwen2.5-7B-InstructModel Type=Base Model2026.04 | 42.6 | 41.3 | — | 27.9 | |
| Llama-3-8B-InstructModel Type=Base Model2026.04 | 35.4 | 33.1 | — | 12.6 | |
| Pre-editedModel=LLaMA-3.1-8B2025.06 | 30.92 | 33.55 | 75.16 | — | |
| Llama-2-7b-chatModel Type=Base Model2026.04 | 27.9 | 28.7 | — | 13.8 | |
| Pre-editedModel=LLaMA-3.2-3B-Instruct2025.06 | 25.81 | 24.76 | 76.96 | — | |
| Pre-editedModel=LLaMA-2-7B2025.06 | 14.87 | 15.38 | 84.62 | — | |
| Pre-editedModel=LLaMA-2-13B-chat-hf2025.06 | 12.78 | 13.26 | 87.97 | — | |
| Pre-editedModel=Qwen2.5-7B2025.06 | 11.51 | 30.95 | 92.46 | — |