Jailbreak Attack on JailbreakBench (JBB) (test)
98Attack Success Rate (ASR)Constant intervention
Evaluation results
| Method | Links | |
|---|---|---|
| Constant interventionModel=Qwen3-4B, m*=+18, Judge=LLM Judge2026.05 | 98 | |
| Anchor-based interventionModel=Qwen3-4B, Multiplier=2x, Judge=LLM Judge2026.05 | 98 | |
| Constant interventionModel=Llama-3.1-8B, m*=-4, Judge=LLM Judge2026.05 | 98 | |
| Anchor-based interventionModel=Llama-3.1-8B, Multiplier=1x, Judge=LLM Judge2026.05 | 98 | |
| Constant interventionModel=Qwen3-4B, m*=+18, Judge=LlamaGuard2026.05 | 96 | |
| Anchor-based interventionModel=Qwen3-8B, Multiplier=2x, Judge=LlamaGuard2026.05 | 96 | |
| Arditi refusal-direction ablationModel=Qwen3-14B, Judge=LLM Judge2026.05 | 96 | |
| Arditi refusal-direction ablationModel=Llama-3.1-8B, Judge=LLM Judge2026.05 | 96 | |
| Constant interventionModel=Llama-3.1-8B, m*=-4, Judge=LlamaGuard2026.05 | 96 | |
| Arditi refusal-direction ablationModel=Qwen3-4B, Judge=LLM Judge2026.05 | 95 | |
| Anchor-based interventionModel=Qwen3-4B, Multiplier=2x, Judge=LlamaGuard2026.05 | 95 | |
| Constant interventionModel=Qwen3-8B, m*=+20, Judge=LlamaGuard2026.05 | 95 | |
| Constant interventionModel=Qwen3-14B, m*=+40, Judge=LLM Judge2026.05 | 95 | |
| Anchor-based interventionModel=Qwen3-14B, Multiplier=1x, Judge=LLM Judge2026.05 | 95 | |
| Anchor-based interventionModel=Qwen3-14B, Multiplier=1x, Judge=LlamaGuard2026.05 | 95 | |
| Arditi refusal-direction ablationModel=Qwen3-32B, Judge=LLM Judge2026.05 | 95 | |
| Arditi refusal-direction ablationModel=Llama-3.1-70B, Judge=LLM Judge2026.05 | 95 | |
| Arditi refusal-direction ablationModel=Qwen3-4B, Judge=LlamaGuard2026.05 | 94 | |
| Arditi refusal-direction ablationModel=Qwen3-8B, Judge=LLM Judge2026.05 | 94 | |
| Constant interventionModel=Qwen3-32B, m*=-80, Judge=LLM Judge2026.05 | 94 | |
| Arditi refusal-direction ablationModel=Llama-3.1-8B, Judge=LlamaGuard2026.05 | 94 | |
| Arditi refusal-direction ablationModel=Qwen3-8B, Judge=LlamaGuard2026.05 | 93 | |
| Constant interventionModel=Qwen3-14B, m*=+40, Judge=LlamaGuard2026.05 | 93 | |
| Anchor-based interventionModel=Llama-3.1-8B, Multiplier=1x, Judge=LlamaGuard2026.05 | 93 | |
| Arditi refusal-direction ablationModel=Qwen3-14B, Judge=LlamaGuard2026.05 | 92 | |
| Constant interventionModel=Qwen3-8B, m*=+20, Judge=LLM Judge2026.05 | 91 | |
| Anchor-based interventionModel=Qwen3-32B, Multiplier=2x, Judge=LLM Judge2026.05 | 91 | |
| Constant interventionModel=Qwen3-32B, m*=-80, Judge=LlamaGuard2026.05 | 91 | |
| Arditi refusal-direction ablationModel=Qwen3-32B, Judge=LlamaGuard2026.05 | 91 | |
| Anchor-based interventionModel=Llama-3.1-70B, Multiplier=2x, Judge=LLM Judge2026.05 | 91 | |
| Arditi refusal-direction ablationModel=Llama-3.1-70B, Judge=LlamaGuard2026.05 | 90 | |
| Constant interventionModel=Llama-3.1-70B, m*=-8, Judge=LLM Judge2026.05 | 89 | |
| Constant interventionModel=Llama-3.1-70B, m*=-8, Judge=LlamaGuard2026.05 | 89 | |
| Anchor-based interventionModel=Llama-3.1-70B, Multiplier=2x, Judge=LlamaGuard2026.05 | 89 | |
| Anchor-based interventionModel=Qwen3-8B, Multiplier=2x, Judge=LLM Judge2026.05 | 88 | |
| Arditi refusal-direction ablationModel=Qwen3-1.7B, Judge=LlamaGuard2026.05 | 87 | |
| Anchor-based interventionModel=Qwen3-32B, Multiplier=2x, Judge=LlamaGuard2026.05 | 86 | |
| Constant interventionModel=Qwen3-1.7B, m*=+30, Judge=LlamaGuard2026.05 | 83 | |
| Arditi refusal-direction ablationModel=Qwen3-1.7B, Judge=LLM Judge2026.05 | 81 | |
| Constant interventionModel=Qwen3-1.7B, m*=+30, Judge=LLM Judge2026.05 | 77 | |
| Anchor-based interventionModel=Qwen3-1.7B, Multiplier=2x, Judge=LlamaGuard2026.05 | 77 | |
| Anchor-based interventionModel=Qwen3-1.7B, Multiplier=2x, Judge=LLM Judge2026.05 | 72 |