# Jailbreak Attack on AdvBench GPT-3.5-turbo 1.0 (test) Source: [Jailbreak Attack on AdvBench GPT-3.5-turbo 1.0 (test)]() Collection index: [llms.txt]() Data updated: 2026-03-25T15:08:31.283Z Evaluation of model susceptibility to jailbreak attacks using the specific AdvBench GPT-3.5-turbo 1.0 test set, reporting Attack Success Rate (ASR). A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. | Scope | Recorded value | | --- | --- | | Task | Jailbreak Attack | | Dataset (including any stated split) | AdvBench GPT-3.5-turbo 1.0 (test) | | Metric | Attack Success Rate | | Unit | PERCENT | | Direction | Higher is better | | Results loaded | 38 of 38 | | Coverage | All results currently returned for this benchmark | Evaluation settings may differ between results. The original papers and recorded configurations are needed to establish comparability. A shared metric name alone does not establish an identical protocol. ## Metrics - [Attack Success Rate](): Higher is better; unit: PERCENT. ## Recorded results | Method | Attack Success Rate | Result date | Report paper | | --- | --- | --- | --- | | EquaCode | 97.12 | Not recorded | 69535c9253fdd5c36173da26 | | TriageFuzz | 94 | Not recorded | 69c36c200636e5bf4afc6537 | | DRA | 93.65 | Not recorded | 69535c9253fdd5c36173da26 | | ReNeLLM | 91.35 | Not recorded | 69535c9253fdd5c36173da26 | | HPM | 90.8 | Not recorded | 694a21e49eebe296e72aa4d5 | | Flipattack | 88.65 | Not recorded | 69535c9253fdd5c36173da26 | | TriageFuzz | 88.5 | Not recorded | 69c36c200636e5bf4afc6537 | | PAP | 87.8 | Not recorded | 694a21e49eebe296e72aa4d5 | | CodeChameleon | 84.62 | Not recorded | 69535c9253fdd5c36173da26 | | AutoDAN | 81.73 | Not recorded | 69535c9253fdd5c36173da26 | | TriageFuzz | 81 | Not recorded | 69c36c200636e5bf4afc6537 | | PAIR | 74 | Not recorded | 69c36c200636e5bf4afc6537 | | CoA | 70.9 | Not recorded | 694a21e49eebe296e72aa4d5 | | PAIR | 68 | Not recorded | 69c36c200636e5bf4afc6537 | | TriageFuzz | 68 | Not recorded | 69c36c200636e5bf4afc6537 | | TAP | 60.54 | Not recorded | 69535c9253fdd5c36173da26 | | PAIR | 60.5 | Not recorded | 69c36c200636e5bf4afc6537 | | PAIR | 59.68 | Not recorded | 69535c9253fdd5c36173da26 | | TAP | 58 | Not recorded | 69c36c200636e5bf4afc6537 | | PAIR | 55.8 | Not recorded | 694a21e49eebe296e72aa4d5 | | TAP | 54.5 | Not recorded | 69c36c200636e5bf4afc6537 | | GPTFuzz | 52 | Not recorded | 69c36c200636e5bf4afc6537 | | PAIR | 49.5 | Not recorded | 69c36c200636e5bf4afc6537 | | TAP | 48.5 | Not recorded | 69c36c200636e5bf4afc6537 | | GPTFuzz | 45.5 | Not recorded | 69c36c200636e5bf4afc6537 | | Base64 | 45 | Not recorded | 69535c9253fdd5c36173da26 | | GCG | 42.88 | Not recorded | 69535c9253fdd5c36173da26 | | GPTFuzz | 42 | Not recorded | 69c36c200636e5bf4afc6537 | | DeepInception | 41.13 | Not recorded | 69535c9253fdd5c36173da26 | | TAP | 40.5 | Not recorded | 69c36c200636e5bf4afc6537 | | AutoDAN | 40.2 | Not recorded | 694a21e49eebe296e72aa4d5 | | GPTFuzzer | 37.79 | Not recorded | 69535c9253fdd5c36173da26 | | MAC | 36.15 | Not recorded | 69535c9253fdd5c36173da26 | | COLD-Attack | 34.23 | Not recorded | 69535c9253fdd5c36173da26 | | GPTFuzz | 32.5 | Not recorded | 69c36c200636e5bf4afc6537 | | ArtPromopt | 14.06 | Not recorded | 69535c9253fdd5c36173da26 | | PromptAttack | 13.46 | Not recorded | 69535c9253fdd5c36173da26 | | SelfCipher | 0 | Not recorded | 69535c9253fdd5c36173da26 | ### EquaCode Attack Success Rate: 97.12. Result ID: 6996f9dd5698665ec446aa83. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Evaluator":"GPT-4"}. This record does not assert independent reproduction. ### TriageFuzz Attack Success Rate: 94. Result ID: 69c3fa5e47f34ce924ae0ff5. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Query Budget":"25"}. This record does not assert independent reproduction. ### DRA Attack Success Rate: 93.65. Result ID: 6996f9dd5698665ec446aa7c. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Attack Type":"Manual","Evaluator":"GPT-4"}. This record does not assert independent reproduction. ### ReNeLLM Attack Success Rate: 91.35. Result ID: 6996f9dd5698665ec446aa81. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Attack Type":"Manual","Evaluator":"GPT-4"}. This record does not assert independent reproduction. ### HPM Attack Success Rate: 90.8. Result ID: 6996fda75698665ec44a9743. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: Not recorded. This record does not assert independent reproduction. ### Flipattack Attack Success Rate: 88.65. Result ID: 6996f9dd5698665ec446aa82. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Attack Type":"Manual","Evaluator":"GPT-4"}. This record does not assert independent reproduction. ### TriageFuzz Attack Success Rate: 88.5. Result ID: 69c3fa5e47f34ce924ae0ff4. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Query Budget":"20"}. This record does not assert independent reproduction. ### PAP Attack Success Rate: 87.8. Result ID: 6996fda75698665ec44a9742. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: Not recorded. This record does not assert independent reproduction. ### CodeChameleon Attack Success Rate: 84.62. Result ID: 6996f9dd5698665ec446aa80. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Attack Type":"Manual","Evaluator":"GPT-4"}. This record does not assert independent reproduction. ### AutoDAN Attack Success Rate: 81.73. Result ID: 6996f9dd5698665ec446aa74. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Attack Type":"Automated","Evaluator":"GPT-4"}. This record does not assert independent reproduction. ### TriageFuzz Attack Success Rate: 81. Result ID: 69c3fa5e47f34ce924ae0ff3. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Query Budget":"15"}. This record does not assert independent reproduction. ### PAIR Attack Success Rate: 74. Result ID: 69c3fa5e47f34ce924ae0fe9. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Query Budget":"25"}. This record does not assert independent reproduction. ### CoA Attack Success Rate: 70.9. Result ID: 6996fda75698665ec44a9741. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: Not recorded. This record does not assert independent reproduction. ### PAIR Attack Success Rate: 68. Result ID: 69c3fa5e47f34ce924ae0fe8. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Query Budget":"20"}. This record does not assert independent reproduction. ### TriageFuzz Attack Success Rate: 68. Result ID: 69c3fa5e47f34ce924ae0ff2. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Query Budget":"10"}. This record does not assert independent reproduction. ### TAP Attack Success Rate: 60.54. Result ID: 6996f9dd5698665ec446aa78. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Attack Type":"Automated","Evaluator":"GPT-4"}. This record does not assert independent reproduction. ### PAIR Attack Success Rate: 60.5. Result ID: 69c3fa5e47f34ce924ae0fe7. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Query Budget":"15"}. This record does not assert independent reproduction. ### PAIR Attack Success Rate: 59.68. Result ID: 6996f9dd5698665ec446aa77. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Attack Type":"Automated","Evaluator":"GPT-4"}. This record does not assert independent reproduction. ### TAP Attack Success Rate: 58. Result ID: 69c3fa5e47f34ce924ae0ff1. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Query Budget":"25"}. This record does not assert independent reproduction. ### PAIR Attack Success Rate: 55.8. Result ID: 6996fda75698665ec44a973f. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: Not recorded. This record does not assert independent reproduction. ### TAP Attack Success Rate: 54.5. Result ID: 69c3fa5e47f34ce924ae0ff0. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Query Budget":"20"}. This record does not assert independent reproduction. ### GPTFuzz Attack Success Rate: 52. Result ID: 69c3fa5e47f34ce924ae0fed. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Query Budget":"25"}. This record does not assert independent reproduction. ### PAIR Attack Success Rate: 49.5. Result ID: 69c3fa5e47f34ce924ae0fe6. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Query Budget":"10"}. This record does not assert independent reproduction. ### TAP Attack Success Rate: 48.5. Result ID: 69c3fa5e47f34ce924ae0fef. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Query Budget":"15"}. This record does not assert independent reproduction. ### GPTFuzz Attack Success Rate: 45.5. Result ID: 69c3fa5e47f34ce924ae0fec. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Query Budget":"20"}. This record does not assert independent reproduction. ### Base64 Attack Success Rate: 45. Result ID: 6996f9dd5698665ec446aa79. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Attack Type":"Automated","Evaluator":"GPT-4"}. This record does not assert independent reproduction. ### GCG Attack Success Rate: 42.88. Result ID: 6996f9dd5698665ec446aa73. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Attack Type":"Automated","Evaluator":"GPT-4"}. This record does not assert independent reproduction. ### GPTFuzz Attack Success Rate: 42. Result ID: 69c3fa5e47f34ce924ae0feb. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Query Budget":"15"}. This record does not assert independent reproduction. ### DeepInception Attack Success Rate: 41.13. Result ID: 6996f9dd5698665ec446aa7b. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Attack Type":"Manual","Evaluator":"GPT-4"}. This record does not assert independent reproduction. ### TAP Attack Success Rate: 40.5. Result ID: 69c3fa5e47f34ce924ae0fee. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Query Budget":"10"}. This record does not assert independent reproduction. ### AutoDAN Attack Success Rate: 40.2. Result ID: 6996fda75698665ec44a9740. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: Not recorded. This record does not assert independent reproduction. ### GPTFuzzer Attack Success Rate: 37.79. Result ID: 6996f9dd5698665ec446aa7a. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Attack Type":"Automated","Evaluator":"GPT-4"}. This record does not assert independent reproduction. ### MAC Attack Success Rate: 36.15. Result ID: 6996f9dd5698665ec446aa75. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Attack Type":"Automated","Evaluator":"GPT-4"}. This record does not assert independent reproduction. ### COLD-Attack Attack Success Rate: 34.23. Result ID: 6996f9dd5698665ec446aa76. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Attack Type":"Automated","Evaluator":"GPT-4"}. This record does not assert independent reproduction. ### GPTFuzz Attack Success Rate: 32.5. Result ID: 69c3fa5e47f34ce924ae0fea. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Query Budget":"10"}. This record does not assert independent reproduction. ### ArtPromopt Attack Success Rate: 14.06. Result ID: 6996f9dd5698665ec446aa7d. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Attack Type":"Manual","Evaluator":"GPT-4"}. This record does not assert independent reproduction. ### PromptAttack Attack Success Rate: 13.46. Result ID: 6996f9dd5698665ec446aa7e. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Attack Type":"Manual","Evaluator":"GPT-4"}. This record does not assert independent reproduction. ### SelfCipher Attack Success Rate: 0. Result ID: 6996f9dd5698665ec446aa7f. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Attack Type":"Manual","Evaluator":"GPT-4"}. This record does not assert independent reproduction. Page 1 of 1. This is an index page, not the full collection.