Jailbreak Attack on GPTFuzz (test)
100ASRAutoDAN
Evaluation Results
| Method | Links | ||
|---|---|---|---|
| AutoDANVictim Model=Mistral-7B, Victim Type=Open-Source, Category=White-box2025.05 | 100 | 4.38 | |
| CoL Multi-turnVictim Model=Vicuna-7B, Victim Type=Open-Source, Category=Black-box2025.05 | 100 | 4.83 | |
| CoL Multi-turnVictim Model=Llama-3-8B, Victim Type=Open-Source, Category=Black-box2025.05 | 100 | 4.42 | |
| CoL Multi-turnVictim Model=Llama-2-7B, Victim Type=Open-Source, Category=Black-box2025.05 | 100 | 4.56 | |
| CoL Multi-turnVictim Model=Mistral-7B, Victim Type=Open-Source, Category=Black-box2025.05 | 100 | 4.78 | |
| CoL Multi-turnVictim Model=GPT-3.5-Turbo, Victim Type=Closed-Source, Category=Black-box2025.05 | 100 | 4.69 | |
| CoL Multi-turnVictim Model=Dobao-1.5-pro, Victim Type=Closed-Source, Category=Black-box2025.05 | 100 | 4.7 | |
| CoL Multi-turnVictim Model=Qwen3-Turbo, Victim Type=Closed-Source, Category=Black-box2025.05 | 100 | 4.07 | |
| DRAVictim Model=Mistral-7B, Victim Type=Open-Source, Category=Black-box2025.05 | 99 | 4.74 | |
| DRAVictim Model=Dobao-1.5-pro, Victim Type=Closed-Source, Category=Black-box2025.05 | 99 | 4.97 | |
| CoL Single-turnVictim Model=Vicuna-7B, Victim Type=Open-Source, Category=Black-box2025.05 | 99 | 4.82 | |
| CoL Single-turnVictim Model=Mistral-7B, Victim Type=Open-Source, Category=Black-box2025.05 | 99 | 4.78 | |
| CoL Single-turnVictim Model=GPT-3.5-Turbo, Victim Type=Closed-Source, Category=Black-box2025.05 | 98 | 4.67 | |
| DarkciteVictim Model=Vicuna-7B, Victim Type=Open-Source, Category=Black-box2025.05 | 97 | 3.98 | |
| DANVictim Model=Llama-3-8B, Victim Type=Open-Source, Category=Black-box2025.05 | 96 | 4.57 | |
| DarkciteVictim Model=Mistral-7B, Victim Type=Open-Source, Category=Black-box2025.05 | 96 | 4.26 | |
| DRAVictim Model=GPT-3.5-Turbo, Victim Type=Closed-Source, Category=Black-box2025.05 | 95 | 4.42 | |
| DRAVictim Model=Qwen3-Turbo, Victim Type=Closed-Source, Category=Black-box2025.05 | 95 | 4.84 | |
| DANVictim Model=Mistral-7B, Victim Type=Open-Source, Category=Black-box2025.05 | 93 | 4.71 | |
| DarkciteVictim Model=Llama-3-8B, Victim Type=Open-Source, Category=Black-box2025.05 | 93 | 4.02 | |
| CoL Single-turnVictim Model=Dobao-1.5-pro, Victim Type=Closed-Source, Category=Black-box2025.05 | 91 | 4.56 | |
| TAPVictim Model=Mistral-7B, Victim Type=Open-Source, Category=Black-box2025.05 | 90 | 2.13 | |
| CoL Single-turnVictim Model=Llama-2-7B, Victim Type=Open-Source, Category=Black-box2025.05 | 90 | 4.35 | |
| TAPVictim Model=Dobao-1.5-pro, Victim Type=Closed-Source, Category=Black-box2025.05 | 88 | 2.25 | |
| GCGVictim Model=Vicuna-7B, Victim Type=Open-Source, Category=White-box2025.05 | 87 | 2.81 | |
| CoL Single-turnVictim Model=Llama-3-8B, Victim Type=Open-Source, Category=Black-box2025.05 | 87 | 4.17 | |
| AutoDANVictim Model=Vicuna-7B, Victim Type=Open-Source, Category=White-box2025.05 | 86 | 4.31 | |
| DarkciteVictim Model=Qwen3-Turbo, Victim Type=Closed-Source, Category=Black-box2025.05 | 86 | 4.65 | |
| GCGVictim Model=Mistral-7B, Victim Type=Open-Source, Category=White-box2025.05 | 84 | 3.46 | |
| DANVictim Model=Vicuna-7B, Victim Type=Open-Source, Category=Black-box2025.05 | 83 | 3.9 | |
| TAPVictim Model=Vicuna-7B, Victim Type=Open-Source, Category=Black-box2025.05 | 79 | 2.35 | |
| DarkciteVictim Model=GPT-3.5-Turbo, Victim Type=Closed-Source, Category=Black-box2025.05 | 74 | 3.53 | |
| CoL Single-turnVictim Model=Qwen3-Turbo, Victim Type=Closed-Source, Category=Black-box2025.05 | 74 | 3.57 | |
| MACVictim Model=Mistral-7B, Victim Type=Open-Source, Category=White-box2025.05 | 71 | 2.24 | |
| TAPVictim Model=Llama-2-7B, Victim Type=Open-Source, Category=Black-box2025.05 | 71 | 2.05 | |
| TAPVictim Model=Qwen3-Turbo, Victim Type=Closed-Source, Category=Black-box2025.05 | 70 | 2.13 | |
| TAPVictim Model=Llama-3-8B, Victim Type=Open-Source, Category=Black-box2025.05 | 69 | 1.97 | |
| TAPVictim Model=GPT-3.5-Turbo, Victim Type=Closed-Source, Category=Black-box2025.05 | 67 | 2.03 | |
| DarkciteVictim Model=Dobao-1.5-pro, Victim Type=Closed-Source, Category=Black-box2025.05 | 67 | 2.59 | |
| AutoDANVictim Model=Llama-2-7B, Victim Type=Open-Source, Category=White-box2025.05 | 56 | 2.17 | |
| DRAVictim Model=Llama-2-7B, Victim Type=Open-Source, Category=Black-box2025.05 | 56 | 3.6 | |
| DRAVictim Model=Vicuna-7B, Victim Type=Open-Source, Category=Black-box2025.05 | 55 | 3.89 | |
| DarkciteVictim Model=Llama-2-7B, Victim Type=Open-Source, Category=Black-box2025.05 | 46 | 2.61 | |
| DRAVictim Model=Llama-3-8B, Victim Type=Open-Source, Category=Black-box2025.05 | 41 | 2.89 | |
| MACVictim Model=Llama-2-7B, Victim Type=Open-Source, Category=White-box2025.05 | 35 | 1.06 | |
| GCGVictim Model=Llama-2-7B, Victim Type=Open-Source, Category=White-box2025.05 | 31 | 1.06 | |
| GCGVictim Model=Llama-3-8B, Victim Type=Open-Source, Category=White-box2025.05 | 17 | 1.17 | |
| MACVictim Model=Vicuna-7B, Victim Type=Open-Source, Category=White-box2025.05 | 16 | 1.53 | |
| DANVictim Model=Dobao-1.5-pro, Victim Type=Closed-Source, Category=Black-box2025.05 | 13 | 1.02 | |
| DANVictim Model=GPT-3.5-Turbo, Victim Type=Closed-Source, Category=Black-box2025.05 | 8 | 1 | |
| DANVictim Model=Llama-2-7B, Victim Type=Open-Source, Category=Black-box2025.05 | 6 | 1.13 | |
| DANVictim Model=Qwen3-Turbo, Victim Type=Closed-Source, Category=Black-box2025.05 | 0 | 1 |