Jailbreak Attack on JailbreakBench (JBB)
0ASRCoA
Evaluation Results
| Method | Links | ||||
|---|---|---|---|---|---|
| CoAVictim LLM=Gemma-2-9B-IT, Turn Type=Multi-Turn2025.12 | 0 | — | — | — | |
| NoneModel=Gemma 2 2B2026.04 | 0 | — | — | — | |
| CoAVictim LLM=Llama-3.1-8B-Instruct, Turn Type=Multi-Turn2025.12 | 1.82 | — | — | — | |
| NoneModel=Llama 3.2 3B2026.04 | 2 | — | — | — | |
| CoAVictim LLM=Qwen2.5-7B-Instruct, Turn Type=Multi-Turn2025.12 | 3.64 | — | — | — | |
| CoAVictim LLM=Mistral-7B-Instruct-v0.3, Turn Type=Multi-Turn2025.12 | 18.18 | — | — | — | |
| ArtPromptVictim LLM=Llama-3.1-8B-Instruct, Turn Type=Single-Turn2025.12 | 27.27 | — | — | — | |
| ArtPromptVictim LLM=Gemma-2-9B-IT, Turn Type=Single-Turn2025.12 | 29.09 | — | — | — | |
| Jailbreak-R1Victim LLM=Gemma-2-9B-IT, Turn Type=Single-Turn2025.12 | 32.12 | — | — | — | |
| Jailbreak-R1Victim LLM=Llama-3.1-8B-Instruct, Turn Type=Single-Turn2025.12 | 40 | — | — | — | |
| DeepInception (Text Baseline)Target Model=GPT-4o Realtime, Modality=Text2026.01 | 40 | — | — | — | |
| ArtPromptVictim LLM=Qwen2.5-7B-Instruct, Turn Type=Single-Turn2025.12 | 41.82 | — | — | — | |
| SirenVictim LLM=Mistral-7B-Instruct-v0.3, Turn Type=Multi-Turn2025.12 | 42.42 | — | — | — | |
| SirenVictim LLM=Llama-3.1-8B-Instruct, Turn Type=Multi-Turn2025.12 | 43.03 | — | — | — | |
| MTSAVictim LLM=Gemma-2-9B-IT, Turn Type=Multi-Turn2025.12 | 52.73 | — | — | — | |
| X-TeamingVictim LLM=Gemma-2-9B-IT, Turn Type=Multi-Turn2025.12 | 52.73 | — | — | — | |
| ReNeLLMVictim LLM=Gemma-2-9B-IT, Turn Type=Single-Turn2025.12 | 54.55 | — | — | — | |
| SirenVictim LLM=Qwen2.5-7B-Instruct, Turn Type=Multi-Turn2025.12 | 54.55 | — | — | — | |
| AutoDan-TurboVictim LLM=Gemma-2-9B-IT, Turn Type=Single-Turn2025.12 | 55.76 | — | — | — | |
| ActorAttackVictim LLM=Llama-3.1-8B-Instruct, Turn Type=Multi-Turn2025.12 | 56.36 | — | — | — | |
| SirenVictim LLM=Gemma-2-9B-IT, Turn Type=Multi-Turn2025.12 | 59.39 | — | — | — | |
| ActorAttackVictim LLM=Gemma-2-9B-IT, Turn Type=Multi-Turn2025.12 | 60 | — | — | — | |
| MTSAVictim LLM=Llama-3.1-8B-Instruct, Turn Type=Multi-Turn2025.12 | 60 | — | — | — | |
| AutoDan-TurboVictim LLM=Mistral-7B-Instruct-v0.3, Turn Type=Single-Turn2025.12 | 60.61 | — | — | — | |
| ArtPromptVictim LLM=Mistral-7B-Instruct-v0.3, Turn Type=Single-Turn2025.12 | 61.82 | — | — | — | |
| Jailbreak-R1Victim LLM=Qwen2.5-7B-Instruct, Turn Type=Single-Turn2025.12 | 61.82 | — | — | — | |
| GRPOVictim LLM=Gemma-2-9B-IT, Turn Type=Multi-Turn2025.12 | 63.03 | — | — | — | |
| AutoDan-TurboVictim LLM=Llama-3.1-8B-Instruct, Turn Type=Single-Turn2025.12 | 63.64 | — | — | — | |
| AutoDan-TurboVictim LLM=Qwen2.5-7B-Instruct, Turn Type=Single-Turn2025.12 | 63.64 | — | — | — | |
| ReNeLLMVictim LLM=Llama-3.1-8B-Instruct, Turn Type=Single-Turn2025.12 | 65.45 | — | — | — | |
| Audio Narrative AttacksTarget Model=GPT-4o Realtime, Modality=Audio2026.01 | 66.67 | — | — | — | |
| Audio Narrative AttacksTarget Model=Qwen2.5-Omni, Modality=Audio2026.01 | 70.33 | — | — | — | |
| X-TeamingVictim LLM=Llama-3.1-8B-Instruct, Turn Type=Multi-Turn2025.12 | 70.91 | — | — | — | |
| TROJailVictim LLM=Gemma-2-9B-IT, Turn Type=Multi-Turn2025.12 | 72.12 | — | — | — | |
| ActorAttackVictim LLM=Qwen2.5-7B-Instruct, Turn Type=Multi-Turn2025.12 | 72.73 | — | — | — | |
| GRPO w/ IPRVictim LLM=Llama-3.1-8B-Instruct, Turn Type=Multi-Turn2025.12 | 73.33 | — | — | — | |
| Jailbreak-R1Victim LLM=Mistral-7B-Instruct-v0.3, Turn Type=Single-Turn2025.12 | 73.94 | — | — | — | |
| ActorAttackVictim LLM=Mistral-7B-Instruct-v0.3, Turn Type=Multi-Turn2025.12 | 74.55 | — | — | — | |
| GRPOVictim LLM=Llama-3.1-8B-Instruct, Turn Type=Multi-Turn2025.12 | 75.76 | — | — | — | |
| DeepInception (Text Baseline)Target Model=Qwen2.5-Omni, Modality=Text2026.01 | 76.67 | — | — | — | |
| TROJailVictim LLM=Llama-3.1-8B-Instruct, Turn Type=Multi-Turn2025.12 | 77.58 | — | — | — | |
| ReNeLLMVictim LLM=Qwen2.5-7B-Instruct, Turn Type=Single-Turn2025.12 | 80 | — | — | — | |
| MTSAVictim LLM=Qwen2.5-7B-Instruct, Turn Type=Multi-Turn2025.12 | 80 | — | — | — | |
| DIMModel=Gemma 2 2B2026.04 | 80 | — | — | — | |
| POModel=Gemma 2 2B2026.04 | 80 | — | — | — | |
| POModel=Llama 3.2 3B2026.04 | 81 | — | — | — | |
| ReNeLLMVictim LLM=Mistral-7B-Instruct-v0.3, Turn Type=Single-Turn2025.12 | 81.82 | — | — | — | |
| NTPModel=Llama 3.2 3B2026.04 | 83 | — | — | — | |
| GRPO w/ IPRVictim LLM=Gemma-2-9B-IT, Turn Type=Multi-Turn2025.12 | 83.03 | — | — | — | |
| X-TeamingVictim LLM=Mistral-7B-Instruct-v0.3, Turn Type=Multi-Turn2025.12 | 83.64 | — | — | — | |
| DeepInception (Text Baseline)Target Model=Gemini 2.0 Flash, Modality=Text2026.01 | 84 | — | — | — | |
| NTPModel=Gemma 2 2B2026.04 | 84 | — | — | — | |
| DIMModel=Llama 3.2 3B2026.04 | 85 | — | — | — | |
| GRPOVictim LLM=Mistral-7B-Instruct-v0.3, Turn Type=Multi-Turn2025.12 | 85.45 | — | — | — | |
| MTSAVictim LLM=Mistral-7B-Instruct-v0.3, Turn Type=Multi-Turn2025.12 | 87.27 | — | — | — | |
| Audio Narrative AttacksTarget Model=Gemini 2.0 Flash, Modality=Audio2026.01 | 88.33 | — | — | — | |
| GRPOVictim LLM=Qwen2.5-7B-Instruct, Turn Type=Multi-Turn2025.12 | 88.48 | — | — | — | |
| X-TeamingVictim LLM=Qwen2.5-7B-Instruct, Turn Type=Multi-Turn2025.12 | 89.09 | — | — | — | |
| TROJailVictim LLM=Qwen2.5-7B-Instruct, Turn Type=Multi-Turn2025.12 | 90.91 | — | — | — | |
| GRPO w/ IPRVictim LLM=Qwen2.5-7B-Instruct, Turn Type=Multi-Turn2025.12 | 93.33 | — | — | — | |
| GRPO w/ IPRVictim LLM=Mistral-7B-Instruct-v0.3, Turn Type=Multi-Turn2025.12 | 93.94 | — | — | — | |
| TROJailVictim LLM=Mistral-7B-Instruct-v0.3, Turn Type=Multi-Turn2025.12 | 95.15 | — | — | — | |
| ArtPromptTarget Model=DeepSeek-V32026.01 | — | 27 | 8 | 17 | |
| ArtPromptTarget Model=Qwen3-32B2026.01 | — | 20 | 18 | 30 | |
| ArtPromptTarget Model=GPT-OSS-120B2026.01 | — | 2 | 7 | 95 | |
| BaselineTarget Model=DeepSeek-V32026.01 | — | 14 | 7 | 59 | |
| BaselineTarget Model=Qwen3-32B2026.01 | — | 10 | 9 | 65 | |
| BaselineTarget Model=GPT-OSS-120B2026.01 | — | 1 | 1 | 99 | |
| DRATarget Model=DeepSeek-V32026.01 | — | 22 | 43 | 38 | |
| DRATarget Model=Qwen3-32B2026.01 | — | 21 | 12 | 13 | |
| DRATarget Model=GPT-OSS-120B2026.01 | — | 6 | 14 | 85 | |
| FlipAttackTarget Model=DeepSeek-V32026.01 | — | 26 | 10 | 0 | |
| FlipAttackTarget Model=Qwen3-32B2026.01 | — | 16 | 34 | 28 | |
| FlipAttackTarget Model=GPT-OSS-120B2026.01 | — | 1 | 1 | 99 | |
| iMISTTarget Model=DeepSeek-V32026.01 | — | 50 | 64 | 4 | |
| iMISTTarget Model=Qwen3-32B2026.01 | — | 46 | 54 | 0 | |
| iMISTTarget Model=GPT-OSS-120B2026.01 | — | 38 | 30 | 36 | |
| PAIRTarget Model=DeepSeek-V32026.01 | — | 30 | 45 | 10 | |
| PAIRTarget Model=Qwen3-32B2026.01 | — | 36 | 24 | 15 | |
| PAIRTarget Model=GPT-OSS-120B2026.01 | — | 3 | 6 | 92 | |
| PASSTarget Model=DeepSeek-V32026.01 | — | 28 | 56 | 9 | |
| PASSTarget Model=Qwen3-32B2026.01 | — | 23 | 20 | 15 | |
| PASSTarget Model=GPT-OSS-120B2026.01 | — | 8 | 16 | 72 | |
| RL-JackTarget Model=DeepSeek-V32026.01 | — | 18 | 34 | 27 | |
| RL-JackTarget Model=Qwen3-32B2026.01 | — | 17 | 12 | 38 | |
| RL-JackTarget Model=GPT-OSS-120B2026.01 | — | 0 | 0 | 100 | |
| SATATarget Model=DeepSeek-V32026.01 | — | 16 | 6 | 44 | |
| SATATarget Model=Qwen3-32B2026.01 | — | 15 | 22 | 47 | |
| SATATarget Model=GPT-OSS-120B2026.01 | — | 2 | 8 | 90 | |
| TAPTarget Model=DeepSeek-V32026.01 | — | 11 | 8 | 19 | |
| TAPTarget Model=Qwen3-32B2026.01 | — | 40 | 42 | 12 | |
| TAPTarget Model=GPT-OSS-120B2026.01 | — | 2 | 4 | 94 | |
| WordGameTarget Model=DeepSeek-V32026.01 | — | 13 | 9 | 49 | |
| WordGameTarget Model=Qwen3-32B2026.01 | — | 24 | 40 | 22 | |
| WordGameTarget Model=GPT-OSS-120B2026.01 | — | 12 | 14 | 65 |