Jailbreak Attack on ClearHarm
61ASRBCT
Evaluation Results
| Method | Links | ||||
|---|---|---|---|---|---|
| BCTModel=Gemma-3-4B-IT, Stage=Post2026.06 | 61 | — | — | — | |
| MLPCTModel=Gemma-3-4B-IT, Stage=Post2026.06 | 52 | — | — | — | |
| BCTModel=Gemma-3-4B-IT, Stage=Pre2026.06 | 51 | — | — | — | |
| MLPCTModel=Gemma-3-4B-IT, Stage=Pre2026.06 | 51 | — | — | — | |
| AttCTModel=Gemma-3-4B-IT, Stage=Pre2026.06 | 51 | — | — | — | |
| BCTModel=Gemma-3-27B-IT, Stage=Post2026.06 | 51 | — | — | — | |
| MLPCTModel=Gemma-3-27B-IT, Stage=Post2026.06 | 50 | — | — | — | |
| BCTModel=Gemma-3-27B-IT, Stage=Pre2026.06 | 49 | — | — | — | |
| MLPCTModel=Gemma-3-27B-IT, Stage=Pre2026.06 | 49 | — | — | — | |
| AttCTModel=Gemma-3-27B-IT, Stage=Pre2026.06 | 49 | — | — | — | |
| MLPCTTarget (f_theta)=MLP hidden state2026.06 | 37 | — | — | — | |
| MLPCTModel=Llama-3.1-8B-Instruct, Stage=Post2026.06 | 36 | — | — | — | |
| BCTModel=Qwen3-8B, Stage=Pre2026.06 | 36 | — | — | — | |
| MLPCTModel=Qwen3-8B, Stage=Pre2026.06 | 36 | — | — | — | |
| MLPCTModel=Qwen3-8B, Stage=Post2026.06 | 36 | — | — | — | |
| AttCTModel=Qwen3-8B, Stage=Pre2026.06 | 36 | — | — | — | |
| BCTTarget (f_theta)=output logits2026.06 | 36 | — | — | — | |
| ACTTarget (f_theta)=residual stream2026.06 | 36 | — | — | — | |
| BCTModel=Llama-3.1-8B-Instruct, Stage=Pre2026.06 | 35 | — | — | — | |
| MLPCTModel=Llama-3.1-8B-Instruct, Stage=Pre2026.06 | 35 | — | — | — | |
| AttCTModel=Llama-3.1-8B-Instruct, Stage=Pre2026.06 | 35 | — | — | — | |
| Base model (no training)Target (f_theta)=—2026.06 | 35 | — | — | — | |
| BCTModel=Qwen3-8B, Stage=Post2026.06 | 34 | — | — | — | |
| AttCTModel=Llama-3.1-8B-Instruct, Stage=Post2026.06 | 31 | — | — | — | |
| AttCTModel=Qwen3-8B, Stage=Post2026.06 | 30 | — | — | — | |
| BCTModel=Llama-3.1-8B-Instruct, Stage=Post2026.06 | 27 | — | — | — | |
| AttCTModel=Qwen3-4B-Instruct-2507, Stage=Post2026.06 | 27 | — | — | — | |
| AttCTTarget (f_theta)=attention weights2026.06 | 27 | — | — | — | |
| AttCTModel=Gemma-3-27B-IT, Stage=Post2026.06 | 24 | — | — | — | |
| AttCTModel=Gemma-3-4B-IT, Stage=Post2026.06 | 23 | — | — | — | |
| MLPCTModel=Qwen3-4B-Instruct-2507, Stage=Post2026.06 | 11 | — | — | — | |
| BCTModel=Qwen3-4B-Instruct-2507, Stage=Post2026.06 | 8 | — | — | — | |
| BCTModel=Qwen3-4B-Instruct-2507, Stage=Pre2026.06 | 6 | — | — | — | |
| MLPCTModel=Qwen3-4B-Instruct-2507, Stage=Pre2026.06 | 6 | — | — | — | |
| AttCTModel=Qwen3-4B-Instruct-2507, Stage=Pre2026.06 | 6 | — | — | — | |
| Chain of AttackAttack Model=Qwen-Plus, Victim Model=GPT-4o2026.04 | — | 22 | 22 | 0 | |
| Chain of AttackAttack Model=Qwen-Plus, Victim Model=Gemini-2.5-Flash2026.04 | — | 28 | 28 | 0 | |
| Chain of AttackAttack Model=Qwen-Plus, Victim Model=Claude-Sonnet-4.52026.04 | — | 0 | 0 | 0 | |
| Chain of AttackAttack Model=Qwen-Plus, Victim Model=GPT-52026.04 | — | 1 | 0 | 1 | |
| Chain of AttackAttack Model=GPT-3.5-Turbo, Victim Model=GPT-4o2026.04 | — | 1 | 1 | 0 | |
| Chain of AttackAttack Model=GPT-3.5-Turbo, Victim Model=Gemini-2.5-Flash2026.04 | — | 0 | 0 | 0 | |
| Chain of AttackAttack Model=GPT-3.5-Turbo, Victim Model=Claude-Sonnet-4.52026.04 | — | 0 | 0 | 0 | |
| Chain of AttackAttack Model=GPT-3.5-Turbo, Victim Model=GPT-52026.04 | — | 0 | 0 | 0 | |
| CrescendoAttack Model=Qwen-Plus, Victim Model=GPT-4o2026.04 | — | 34 | 34 | 0 | |
| CrescendoAttack Model=Qwen-Plus, Victim Model=Gemini-2.5-Flash2026.04 | — | 44 | 44 | 0 | |
| CrescendoAttack Model=Qwen-Plus, Victim Model=Claude-Sonnet-4.52026.04 | — | 0 | 0 | 0 | |
| CrescendoAttack Model=Qwen-Plus, Victim Model=GPT-52026.04 | — | 2 | 0 | 2 | |
| CrescendoAttack Model=GPT-3.5-Turbo, Victim Model=GPT-4o2026.04 | — | 33 | 33 | 0 | |
| CrescendoAttack Model=GPT-3.5-Turbo, Victim Model=Gemini-2.5-Flash2026.04 | — | 38 | 38 | 0 | |
| CrescendoAttack Model=GPT-3.5-Turbo, Victim Model=Claude-Sonnet-4.52026.04 | — | 0 | 0 | 0 | |
| CrescendoAttack Model=GPT-3.5-Turbo, Victim Model=GPT-52026.04 | — | 3 | 0 | 3 | |
| iDecepAttack Model=Qwen-Plus, Victim Model=GPT-4o2026.04 | — | 86 | 86 | 0 | |
| iDecepAttack Model=Qwen-Plus, Victim Model=Gemini-2.5-Flash2026.04 | — | 89 | 89 | 0 | |
| iDecepAttack Model=Qwen-Plus, Victim Model=Claude-Sonnet-4.52026.04 | — | 53 | 21 | 32 | |
| iDecepAttack Model=Qwen-Plus, Victim Model=GPT-52026.04 | — | 63 | 11 | 52 | |
| iDecepAttack Model=GPT-3.5-Turbo, Victim Model=GPT-4o2026.04 | — | 76 | 76 | 0 | |
| iDecepAttack Model=GPT-3.5-Turbo, Victim Model=Gemini-2.5-Flash2026.04 | — | 77 | 77 | 0 | |
| iDecepAttack Model=GPT-3.5-Turbo, Victim Model=Claude-Sonnet-4.52026.04 | — | 31 | 14 | 17 | |
| iDecepAttack Model=GPT-3.5-Turbo, Victim Model=GPT-52026.04 | — | 52 | 9 | 43 |