Jailbreak Attack on Jailbreak-Bench
100Attack Success RateX-Teaming
Evaluation Results
| Method | Links | ||
|---|---|---|---|
| X-TeamingTarget Model=DeepSeek-V3.2, Model Access Category=Open-Weight Models, Attack Type=Multi-Turn Attacks2026.04 | 100 | — | |
| JARGONTarget Model=Claude-Sonnet-4.5, Model Access Category=Closed-Source Models, Attack Type=Multi-Turn Attacks2026.04 | 100 | — | |
| JARGONTarget Model=Claude-Opus-4.5, Model Access Category=Closed-Source Models, Attack Type=Multi-Turn Attacks2026.04 | 100 | — | |
| JARGONTarget Model=Gemini-3-Flash, Model Access Category=Closed-Source Models, Attack Type=Multi-Turn Attacks2026.04 | 100 | — | |
| JARGONTarget Model=DeepSeek-V3.2, Model Access Category=Open-Weight Models, Attack Type=Multi-Turn Attacks2026.04 | 100 | — | |
| JARGONTarget Model=Qwen3-235B-A22B-IT, Model Access Category=Open-Weight Models, Attack Type=Multi-Turn Attacks2026.04 | 100 | — | |
| JARGONTarget Model=LLaMA-4-Scout-IT, Model Access Category=Open-Weight Models, Attack Type=Multi-Turn Attacks2026.04 | 100 | — | |
| X-TeamingTarget Model=Qwen3-235B-A22B-IT, Model Access Category=Open-Weight Models, Attack Type=Multi-Turn Attacks2026.04 | 99 | — | |
| X-TeamingTarget Model=LLaMA-4-Scout-IT, Model Access Category=Open-Weight Models, Attack Type=Multi-Turn Attacks2026.04 | 97 | — | |
| FITDTarget Model=Gemini-3-Flash, Model Access Category=Closed-Source Models, Attack Type=Multi-Turn Attacks2026.04 | 96 | — | |
| FITDTarget Model=DeepSeek-V3.2, Model Access Category=Open-Weight Models, Attack Type=Multi-Turn Attacks2026.04 | 95 | — | |
| X-TeamingTarget Model=Gemini-3-Flash, Model Access Category=Closed-Source Models, Attack Type=Multi-Turn Attacks2026.04 | 94 | — | |
| JARGONTarget Model=GPT-5.2, Model Access Category=Closed-Source Models, Attack Type=Multi-Turn Attacks2026.04 | 93 | — | |
| CrescendoTarget Model=Gemini-3-Flash, Model Access Category=Closed-Source Models, Attack Type=Multi-Turn Attacks2026.04 | 79 | — | |
| AmpleGCGTarget Model=DeepSeek-V3.2, Model Access Category=Open-Weight Models, Attack Type=Single-Turn Attacks2026.04 | 75 | — | |
| CrescendoTarget Model=DeepSeek-V3.2, Model Access Category=Open-Weight Models, Attack Type=Multi-Turn Attacks2026.04 | 73 | — | |
| CrescendoTarget Model=LLaMA-4-Scout-IT, Model Access Category=Open-Weight Models, Attack Type=Multi-Turn Attacks2026.04 | 73 | — | |
| FITDTarget Model=Qwen3-235B-A22B-IT, Model Access Category=Open-Weight Models, Attack Type=Multi-Turn Attacks2026.04 | 73 | — | |
| PAIRTarget Model=DeepSeek-V3.2, Model Access Category=Open-Weight Models, Attack Type=Single-Turn Attacks2026.04 | 68 | — | |
| X-TeamingTarget Model=GPT-5.2, Model Access Category=Closed-Source Models, Attack Type=Multi-Turn Attacks2026.04 | 59 | — | |
| FITDTarget Model=GPT-5.2, Model Access Category=Closed-Source Models, Attack Type=Multi-Turn Attacks2026.04 | 54 | — | |
| CrescendoTarget Model=Qwen3-235B-A22B-IT, Model Access Category=Open-Weight Models, Attack Type=Multi-Turn Attacks2026.04 | 52 | — | |
| FITDTarget Model=LLaMA-4-Scout-IT, Model Access Category=Open-Weight Models, Attack Type=Multi-Turn Attacks2026.04 | 49 | — | |
| FITDTarget Model=Claude-Sonnet-4.5, Model Access Category=Closed-Source Models, Attack Type=Multi-Turn Attacks2026.04 | 48 | — | |
| PAIRTarget Model=LLaMA-4-Scout-IT, Model Access Category=Open-Weight Models, Attack Type=Single-Turn Attacks2026.04 | 32 | — | |
| AmpleGCGTarget Model=Gemini-3-Flash, Model Access Category=Closed-Source Models, Attack Type=Single-Turn Attacks2026.04 | 27 | — | |
| AmpleGCGTarget Model=LLaMA-4-Scout-IT, Model Access Category=Open-Weight Models, Attack Type=Single-Turn Attacks2026.04 | 27 | — | |
| PAIRTarget Model=Gemini-3-Flash, Model Access Category=Closed-Source Models, Attack Type=Single-Turn Attacks2026.04 | 24 | — | |
| FITDTarget Model=Claude-Opus-4.5, Model Access Category=Closed-Source Models, Attack Type=Multi-Turn Attacks2026.04 | 24 | — | |
| CrescendoTarget Model=Claude-Sonnet-4.5, Model Access Category=Closed-Source Models, Attack Type=Multi-Turn Attacks2026.04 | 23 | — | |
| AmpleGCGTarget Model=Qwen3-235B-A22B-IT, Model Access Category=Open-Weight Models, Attack Type=Single-Turn Attacks2026.04 | 22 | — | |
| CrescendoTarget Model=GPT-5.2, Model Access Category=Closed-Source Models, Attack Type=Multi-Turn Attacks2026.04 | 22 | — | |
| X-TeamingTarget Model=Claude-Opus-4.5, Model Access Category=Closed-Source Models, Attack Type=Multi-Turn Attacks2026.04 | 22 | — | |
| X-TeamingTarget Model=Claude-Sonnet-4.5, Model Access Category=Closed-Source Models, Attack Type=Multi-Turn Attacks2026.04 | 18 | — | |
| PAIRTarget Model=Qwen3-235B-A22B-IT, Model Access Category=Open-Weight Models, Attack Type=Single-Turn Attacks2026.04 | 15 | — | |
| CrescendoTarget Model=Claude-Opus-4.5, Model Access Category=Closed-Source Models, Attack Type=Multi-Turn Attacks2026.04 | 11 | — | |
| AmpleGCGTarget Model=GPT-5.2, Model Access Category=Closed-Source Models, Attack Type=Single-Turn Attacks2026.04 | 10 | — | |
| PAIRTarget Model=GPT-5.2, Model Access Category=Closed-Source Models, Attack Type=Single-Turn Attacks2026.04 | 5 | — | |
| AmpleGCGTarget Model=Claude-Sonnet-4.5, Model Access Category=Closed-Source Models, Attack Type=Single-Turn Attacks2026.04 | 5 | — | |
| PAIRTarget Model=Claude-Opus-4.5, Model Access Category=Closed-Source Models, Attack Type=Single-Turn Attacks2026.04 | 1 | — | |
| AmpleGCGTarget Model=Claude-Opus-4.5, Model Access Category=Closed-Source Models, Attack Type=Single-Turn Attacks2026.04 | 1 | — | |
| PAIRTarget Model=Claude-Sonnet-4.5, Model Access Category=Closed-Source Models, Attack Type=Single-Turn Attacks2026.04 | 0 | — | |
| AmpleGCGTarget Model=Average, Model Access Category=N/A, Attack Type=Single-Turn Attacks2026.04 | — | 23.9 | |
| CrescendoTarget Model=Average, Model Access Category=N/A, Attack Type=Multi-Turn Attacks2026.04 | — | 47.6 | |
| FITDTarget Model=Average, Model Access Category=N/A, Attack Type=Multi-Turn Attacks2026.04 | — | 62.7 | |
| JARGONTarget Model=Average, Model Access Category=N/A, Attack Type=Multi-Turn Attacks2026.04 | — | 99 | |
| PAIRTarget Model=Average, Model Access Category=N/A, Attack Type=Single-Turn Attacks2026.04 | — | 20.7 | |
| X-TeamingTarget Model=Average, Model Access Category=N/A, Attack Type=Multi-Turn Attacks2026.04 | — | 69.9 |