Jailbreak attack evaluation on 500 randomly sampled prompts (test)
0.81Similarity ScoreGCG
Evaluation results
| Method | Links | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| GCGTarget Model=Llama22026.05 | 0.81 | 977.23 | 0.26 | 0.33 | 0.43 | 0.11 | 0.56 | 0.98 | |
| PAIRTarget Model=Llama22026.05 | 0.81 | 37.32 | — | 0.32 | 0.42 | 0.07 | 0.67 | 0.57 | |
| GCGTarget LLM=Vicuna-13B2026.05 | 0.81 | 1,025.09 | 0.23 | 0.31 | 0.42 | 0.11 | 0.54 | 0.62 | |
| PAIRTarget LLM=Vicuna-13B2026.05 | 0.67 | 59.57 | 0.22 | 0.33 | — | 0.08 | 0.74 | 0.54 | |
| SAATarget LLM=Vicuna-13B2026.05 | 0.51 | 20.43 | 0.25 | 0.32 | 0.4 | 0.17 | 1 | 1 | |
| SAATarget Model=Llama22026.05 | 0.48 | 30.42 | 0.25 | 0.32 | 0.4 | 0.18 | 1 | 1 | |
| PuzzlerTarget Model=Llama22026.05 | 0.4 | 33.37 | 0.25 | 0.33 | 0.41 | 0.15 | 1 | 1 | |
| PuzzlerTarget LLM=Vicuna-13B2026.05 | 0.4 | 33.37 | 0.25 | 0.33 | 0.41 | 0.15 | 1 | 1 | |
| DrAttackTarget LLM=Vicuna-13B2026.05 | 0.36 | 15.02 | 0.25 | 0.32 | 0.42 | 0.14 | 1 | 0.94 | |
| DrAttackTarget Model=Llama22026.05 | 0.34 | 16.14 | 0.23 | 0.33 | 0.41 | 0.17 | 0.64 | 0.84 | |
| ZULUTarget Model=Llama22026.05 | 0.18 | 1,121.47 | — | 0.34 | 0.45 | 0.05 | 1 | 1 | |
| ZULUTarget LLM=Vicuna-13B2026.05 | 0.14 | 1,098.24 | — | 0.35 | 0.43 | 0.04 | 1 | 0.98 | |
| IJPTarget LLM=Vicuna-13B2026.05 | 0.12 | 40.52 | — | — | — | 0.03 | 1 | 1 | |
| Base64Target LLM=Vicuna-13B2026.05 | 0.12 | 87.47 | — | — | — | 0.03 | 1 | 1 | |
| Base64Target Model=Llama22026.05 | 0.11 | 85.89 | — | — | — | 0.03 | 1 | 1 | |
| IJPTarget Model=Llama22026.05 | 0.09 | 25.54 | — | — | — | 0.11 | 1 | 1 |