Jailbreak Attack on AdvBench (ASR, Avg.Score)
0Attack Success Rate (ASR)PAIR
Evaluation results
| Method | Links | ||
|---|---|---|---|
| PAIRTarget LLM=Gemini-2.5-flash2026.02 | 0 | 0 | |
| PAIRTarget LLM=GPT-4o2026.02 | 0 | 0 | |
| PAIRTarget LLM=Qwen32026.02 | 0 | 0.02 | |
| TAPTarget LLM=Gemini-2.5-flash2026.02 | 0 | 0 | |
| TAPTarget LLM=Claude-3.72026.02 | 0 | 0 | |
| GPTFUZZERTarget LLM=Claude-3.72026.02 | 0 | 0.04 | |
| PAIRTarget LLM=Claude-3.72026.02 | 2 | 0.06 | |
| GPTFUZZERTarget LLM=Qwen32026.02 | 2 | 0.06 | |
| TAPTarget LLM=Qwen32026.02 | 4 | 0.12 | |
| TAPTarget LLM=Deepseek-Reasoner2026.02 | 6 | 0.24 | |
| PAIRTarget LLM=Deepseek-Reasoner2026.02 | 8 | 0.24 | |
| VAETarget Model=Claude-3.5, Source Model=Qwen-VL, Perturbation budget (epsilon)=32/2552026.04 | 8.5 | — | |
| TAPTarget LLM=GPT-4o2026.02 | 12 | 0.4 | |
| GPTFUZZERTarget LLM=GPT-4o2026.02 | 12 | 0.4 | |
| Attention-Guided Visual JailbreakingTarget Model=Claude-3.5, Source Model=Qwen-VL, Perturbation budget (epsilon)=32/2552026.04 | 12.1 | — | |
| PAIRTarget LLM=Grok-32026.02 | 14 | 0.52 | |
| VAETarget Model=GPT-4o, Source Model=Qwen-VL, Perturbation budget (epsilon)=32/2552026.04 | 14.2 | — | |
| VAETarget Model=Gemini-1.5, Source Model=Qwen-VL, Perturbation budget (epsilon)=32/2552026.04 | 16.4 | — | |
| Attention-Guided Visual JailbreakingTarget Model=GPT-4o, Source Model=Qwen-VL, Perturbation budget (epsilon)=32/2552026.04 | 18.5 | — | |
| GPTFUZZERTarget LLM=Deepseek-Reasoner2026.02 | 24 | 1.04 | |
| GPTFUZZERTarget LLM=Gemini-2.5-flash2026.02 | 28 | 1.22 | |
| Attention-Guided Visual JailbreakingTarget Model=Gemini-1.5, Source Model=Qwen-VL, Perturbation budget (epsilon)=32/2552026.04 | 30.3 | — | |
| CL-GSOTarget LLM=Claude-3.72026.02 | 40 | 1.86 | |
| ICRTTarget LLM=Claude-3.72026.02 | 40 | 1.6 | |
| CL-GSOTarget LLM=Grok-32026.02 | 44 | 2.04 | |
| CL-GSOTarget LLM=Deepseek-Reasoner2026.02 | 50 | 1.9 | |
| CL-GSOTarget LLM=Qwen32026.02 | 50 | 2 | |
| GPTFUZZERTarget LLM=Grok-32026.02 | 52 | 2.1 | |
| TAPTarget LLM=Grok-32026.02 | 54 | 2.04 | |
| AutoDAN-Turbo-RTarget LLM=Gemini-2.5-flash2026.02 | 70 | 2.52 | |
| AutoDAN-Turbo-RTarget LLM=Claude-3.72026.02 | 74 | 2.88 | |
| ICRTTarget LLM=GPT-4o2026.02 | 74 | 3.06 | |
| CL-GSOTarget LLM=GPT-4o2026.02 | 78 | 2.64 | |
| CL-GSOTarget LLM=Gemini-2.5-flash2026.02 | 80 | 2.6 | |
| AutoDAN-Turbo-RTarget LLM=Grok-32026.02 | 84 | 3.1 | |
| ICRTTarget LLM=Qwen32026.02 | 84 | 4 | |
| AutoDAN-Turbo-RTarget LLM=GPT-4o2026.02 | 88 | 3.18 | |
| AutoDAN-Turbo-RTarget LLM=Deepseek-Reasoner2026.02 | 88 | 3.36 | |
| AutoDAN-Turbo-RTarget LLM=Qwen32026.02 | 88 | 3.32 | |
| ICRTTarget LLM=Deepseek-Reasoner2026.02 | 88 | 4 | |
| ICRTTarget LLM=Gemini-2.5-flash2026.02 | 92 | 4.52 | |
| ICRTTarget LLM=Grok-32026.02 | 98 | 4.3 | |
| CC-BOSTarget LLM=Gemini-2.5-flash2026.02 | 100 | 4.82 | |
| CC-BOSTarget LLM=Claude-3.72026.02 | 100 | 3.14 | |
| CC-BOSTarget LLM=GPT-4o2026.02 | 100 | 4.74 | |
| CC-BOSTarget LLM=Deepseek-Reasoner2026.02 | 100 | 4.84 | |
| CC-BOSTarget LLM=Qwen32026.02 | 100 | 4.88 | |
| CC-BOSTarget LLM=Grok-32026.02 | 100 | 4.76 |