Defense against adaptive attacks on HarmBench
5.6ASRRA-LLM
Evaluation Results
| Method | Links | ||
|---|---|---|---|
| RA-LLMTarget LLM=Vicuna-7B-v1.52026.05 | 5.6 | 15.75 | |
| EvoDefenseTarget LLM=Vicuna-7B-v1.52026.05 | 5.6 | 16.65 | |
| EvoDefenseTarget LLM=Qwen-7B-chat2026.05 | 6.3 | 15.6 | |
| EvoDefenseTarget LLM=LLaMA3-8B-instruct2026.05 | 7.5 | 15.63 | |
| Semantic SmoothTarget LLM=LLaMA3-8B-instruct2026.05 | 9.7 | 17.34 | |
| RA-LLMTarget LLM=Qwen-7B-chat2026.05 | 10.3 | 12.84 | |
| EvoDefenseTarget LLM=Mistral-7B-v0.22026.05 | 11.3 | 15.3 | |
| IBProtectorTarget LLM=LLaMA3-8B-instruct2026.05 | 12.8 | 14.15 | |
| RA-LLMTarget LLM=LLaMA3-8B-instruct2026.05 | 15.6 | 11.41 | |
| IBProtectorTarget LLM=Vicuna-7B-v1.52026.05 | 17.8 | 12.81 | |
| RA-LLMTarget LLM=Mistral-7B-v0.22026.05 | 18.8 | 10.24 | |
| SmoothLLMTarget LLM=LLaMA3-8B-instruct2026.05 | 21.3 | 9.34 | |
| Self DefenseTarget LLM=Mistral-7B-v0.22026.05 | 22.5 | 10.17 | |
| SmoothLLMTarget LLM=Vicuna-7B-v1.52026.05 | 22.8 | 10.5 | |
| Self DefenseTarget LLM=LLaMA3-8B-instruct2026.05 | 23.8 | 10.41 | |
| SmoothLLMTarget LLM=Mistral-7B-v0.22026.05 | 23.8 | 10.18 | |
| Semantic SmoothTarget LLM=Vicuna-7B-v1.52026.05 | 25.6 | 12.87 | |
| SmoothLLMTarget LLM=Qwen-7B-chat2026.05 | 26.3 | 10.68 | |
| Self DefenseTarget LLM=Qwen-7B-chat2026.05 | 27.8 | 9.48 | |
| IBProtectorTarget LLM=Qwen-7B-chat2026.05 | 29.7 | 10.73 | |
| Self DefenseTarget LLM=Vicuna-7B-v1.52026.05 | 29.7 | 9.67 | |
| Semantic SmoothTarget LLM=Qwen-7B-chat2026.05 | 30.3 | 11.58 | |
| NoneTarget LLM=Qwen-7B-chat2026.05 | 30.5 | 7.86 | |
| Semantic SmoothTarget LLM=Mistral-7B-v0.22026.05 | 33.8 | 8.62 | |
| IBProtectorTarget LLM=Mistral-7B-v0.22026.05 | 36.9 | 8.14 | |
| NoneTarget LLM=Vicuna-7B-v1.52026.05 | 38.4 | 7.5 | |
| NoneTarget LLM=LLaMA3-8B-instruct2026.05 | 40.3 | 8.9 | |
| NoneTarget LLM=Mistral-7B-v0.22026.05 | 45.3 | 6.1 |