Jailbreak Attack on AdvBench (ASR, Routing Loss)
0ASRDirect Instruction
Evaluation Results
| Method | Links | ||
|---|---|---|---|
| Direct InstructionTarget Model=GPT-OSS, Setting=White-box2026.05 | 0 | 18.46 | |
| Direct InstructionTarget Model=Qwen3, Setting=White-box2026.05 | 0 | 13.52 | |
| Direct InstructionTarget Model=Phi-3.5, Setting=White-box2026.05 | 0 | 9.27 | |
| Direct InstructionTarget Model=Qwen1.5, Setting=White-box2026.05 | 0 | 3.95 | |
| GCGTarget Model=GPT-OSS, Setting=White-box2026.05 | 0 | 18.48 | |
| GCGTarget Model=Qwen3, Setting=White-box2026.05 | 0 | 12.03 | |
| FFATarget Model=GPT-OSS, Setting=White-box2026.05 | 0 | 18.45 | |
| FFATarget Model=Qwen3, Setting=White-box2026.05 | 0 | 12 | |
| FFATarget Model=Phi-3.5, Setting=White-box2026.05 | 0 | 9.18 | |
| JailbrokenTarget Model=GPT-OSS, Setting=White-box2026.05 | 0 | 18.51 | |
| JailbrokenTarget Model=Qwen3, Setting=White-box2026.05 | 0 | 9.45 | |
| WildPromptTarget Model=GPT-OSS, Setting=White-box2026.05 | 2 | 18.45 | |
| WildPromptTarget Model=Qwen3, Setting=White-box2026.05 | 2 | 10.31 | |
| MisrouterTarget Model=Qwen3, Setting=White-box2026.05 | 2 | 11.98 | |
| Direct InstructionTarget Model=Mixtral, Setting=White-box2026.05 | 8 | 10.06 | |
| Direct InstructionTarget Model=Deepseek, Setting=White-box2026.05 | 10 | 5.03 | |
| WildPromptTarget Model=Phi-3.5, Setting=White-box2026.05 | 10 | 8.73 | |
| Misrouter+FFATarget Model=GPT-OSS, Setting=White-box2026.05 | 10 | 18.33 | |
| Misrouter+FFATarget Model=Qwen3, Setting=White-box2026.05 | 14 | 10.69 | |
| GCGTarget Model=Mixtral, Setting=White-box2026.05 | 18 | 9.59 | |
| JailbrokenTarget Model=Deepseek, Setting=White-box2026.05 | 20 | 3.71 | |
| MisrouterTarget Model=Mixtral, Setting=White-box2026.05 | 22 | 9.19 | |
| MisrouterTarget Model=GPT-OSS, Setting=White-box2026.05 | 24 | 18.34 | |
| JailbrokenTarget Model=Phi-3.5, Setting=White-box2026.05 | 32 | 8.28 | |
| JailbrokenTarget Model=Qwen1.5, Setting=White-box2026.05 | 40 | 3.47 | |
| GCGTarget Model=Phi-3.5, Setting=White-box2026.05 | 44 | 8.88 | |
| GCGTarget Model=Deepseek, Setting=White-box2026.05 | 48 | 4.78 | |
| FFATarget Model=Qwen1.5, Setting=White-box2026.05 | 52 | 3.7 | |
| MisrouterTarget Model=Phi-3.5, Setting=White-box2026.05 | 52 | 8.55 | |
| MisrouterTarget Model=Deepseek, Setting=White-box2026.05 | 62 | 4.53 | |
| WildPromptTarget Model=Qwen1.5, Setting=White-box2026.05 | 64 | 3.47 | |
| FFATarget Model=Mixtral, Setting=White-box2026.05 | 66 | 8.53 | |
| WildPromptTarget Model=Mixtral, Setting=White-box2026.05 | 72 | 8.06 | |
| Misrouter+FFATarget Model=Phi-3.5, Setting=White-box2026.05 | 72 | 8.88 | |
| WildPromptTarget Model=Deepseek, Setting=White-box2026.05 | 74 | 3.8 | |
| GCGTarget Model=Qwen1.5, Setting=White-box2026.05 | 76 | 3.91 | |
| JailbrokenTarget Model=Mixtral, Setting=White-box2026.05 | 78 | 8 | |
| Misrouter+FFATarget Model=Qwen1.5, Setting=White-box2026.05 | 80 | 3.58 | |
| Misrouter+FFATarget Model=Mixtral, Setting=White-box2026.05 | 82 | 8.39 | |
| MisrouterTarget Model=Qwen1.5, Setting=White-box2026.05 | 96 | 3.78 | |
| FFATarget Model=Deepseek, Setting=White-box2026.05 | 98 | 4.34 | |
| Misrouter+FFATarget Model=Deepseek, Setting=White-box2026.05 | 100 | 4.22 |