Jailbreak Attack on AutoDAN
100ASRNo Defense
Evaluation results
| Method | Links | ||
|---|---|---|---|
| No DefenseBase LLM=Vicuna2025.08 | 100 | — | |
| Self-ReminderBase LLM=Vicuna2025.08 | 94 | — | |
| ICDBase LLM=Vicuna2025.08 | 88 | — | |
| Context FilteringBase LLM=Vicuna2025.08 | 10 | — | |
| Self-ExaminationBase LLM=Vicuna2025.08 | 4 | — | |
| Safe DecodingBase LLM=Vicuna2025.08 | 2 | — | |
| No DefenseBase LLM=Llama22025.08 | 2 | — | |
| Self-ReminderBase LLM=Llama22025.08 | 2 | — | |
| No DefenseBackbone=Vicuna2026.02 | 0.86 | 4.8 | |
| Self-ReminderBackbone=Vicuna2026.02 | 0.7 | 4.58 | |
| ParaphraseBackbone=Vicuna2026.02 | 0.52 | 3.36 | |
| SD_DaExpertBackbone=Vicuna2026.02 | 0.3 | 2.28 | |
| SD_DaExpertBackbone=Qwen32026.02 | 0.16 | 1.7 | |
| Self-ReminderBackbone=Llama32026.02 | 0.14 | 1.64 | |
| SafeDecodingBackbone=Qwen32026.02 | 0.14 | 1.62 | |
| SD_TinyExpertBackbone=Llama32026.02 | 0.12 | 1.5 | |
| SSDBackbone=Vicuna2026.02 | 0.1 | 1.48 | |
| Self-ExamBackbone=Llama32026.02 | 0.1 | 1.42 | |
| No DefenseBackbone=Llama32026.02 | 0.08 | 1.46 | |
| No DefenseBackbone=Qwen32026.02 | 0.06 | 1.24 | |
| SD_TinyExpertBackbone=Qwen32026.02 | 0.06 | 1.24 | |
| SSDBackbone=Qwen32026.02 | 0.06 | 1.24 | |
| Self-ExamBackbone=Vicuna2026.02 | 0.04 | 1.28 | |
| SD_DaExpertBackbone=Llama32026.02 | 0.04 | 1.24 | |
| Self-ReminderBackbone=Qwen32026.02 | 0.04 | 1.16 | |
| SD_TinyExpertBackbone=Vicuna2026.02 | 0.02 | 1.14 | |
| NGSDBackbone=Vicuna2026.02 | 0.02 | 1.1 | |
| SafeDecodingBackbone=Llama32026.02 | 0.02 | 1.08 | |
| SafeDecodingBackbone=Vicuna2026.02 | 0 | 1.08 | |
| ParaphraseBackbone=Llama32026.02 | 0 | 1.04 | |
| SSDBackbone=Llama32026.02 | 0 | 1.02 | |
| NGSDBackbone=Llama32026.02 | 0 | 1.04 | |
| ParaphraseBackbone=Qwen32026.02 | 0 | 1 | |
| Self-ExamBackbone=Qwen32026.02 | 0 | 1 | |
| NGSDBackbone=Qwen32026.02 | 0 | 1.08 | |
| Intention AnalysisBase LLM=Vicuna2025.08 | 0 | — | |
| ICDBase LLM=Llama22025.08 | 0 | — | |
| Self-ExaminationBase LLM=Llama22025.08 | 0 | — | |
| Intention AnalysisBase LLM=Llama22025.08 | 0 | — | |
| Safe DecodingBase LLM=Llama22025.08 | 0 | — | |
| Context FilteringBase LLM=Llama22025.08 | 0 | — | |
| No DefenseBase LLM=ChatGPT2025.08 | 0 | — |