Jailbreak Attack on MaliciousInstruct
100ASRPiF
Evaluation results
| Method | Links | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| PiFTarget Model=Vicuna-13B-V1.52025.12 | 100 | — | — | — | — | 421 | — | — | |
| PiFTarget Model=GPT-4-06132025.12 | 100 | — | — | — | — | 299 | — | — | |
| PiFTarget Model=Llama-3.1-8B-Instruct2025.12 | 99 | — | — | — | — | 240 | — | — | |
| PiFTarget Model=Mistral-7B-Instruct2025.12 | 99 | — | — | — | — | 318 | — | — | |
| PiFTarget Model=GPT-O1-Preview2025.12 | 98 | — | — | — | — | 282 | — | — | |
| REATarget Model=Mistral-7B-Instruct2026.03 | 98 | — | — | — | — | — | — | — | |
| GCGTarget Model=Vicuna-13B-V1.52025.12 | 96 | — | — | — | — | 248 | — | — | |
| GCGTarget Model=Mistral-7B-Instruct2025.12 | 95 | — | — | — | — | 368 | — | — | |
| Audio Narrative AttacksTarget Model=Gemini 2.0 Flash2026.01 | 94 | — | — | — | — | — | — | — | |
| REATarget Model=Qwen2.5-7B-Instruct2026.03 | 94 | — | — | — | — | — | — | — | |
| DeepInception (Text Baseline)Target Model=Qwen2.5-Omni, Modality=Text2026.01 | 93 | — | — | — | — | — | — | — | |
| FORCETarget Model=InstructBlip-Vicuna-7B2025.09 | 92 | — | — | — | — | — | — | — | |
| SCAVTarget Model=Mistral-7B-Instruct2026.03 | 92 | — | — | — | — | — | — | — | |
| Audio Narrative AttacksTarget Model=GPT-4o Realtime2026.01 | 91 | — | — | — | — | — | — | — | |
| PAIRTarget Model=GPT-4-06132025.12 | 91 | — | — | — | — | 178 | — | — | |
| REATarget Model=Llama3.1-8B-Instruct2026.03 | 90 | — | — | — | — | — | — | — | |
| SCAVTarget Model=Llama3.1-8B-Instruct2026.03 | 89 | — | — | — | — | — | — | — | |
| AdvWaveTarget Model=Gemini 2.0 Flash2026.01 | 87 | — | — | — | — | — | — | — | |
| GCGTarget Model=GPT-4-06132025.12 | 87 | — | — | — | — | 227 | — | — | |
| SAHATarget Model=Llama3.1-8B-Instruct2026.03 | 87 | — | — | — | — | — | — | 84 | |
| Phi-4Pruning Percentage=100%2025.09 | 87 | — | — | — | — | — | — | — | |
| gemma-7b-itPruning Percentage=75%2025.09 | 87 | — | — | — | — | — | — | — | |
| Audio Narrative AttacksTarget Model=Gemini 2.0 Flash, Modality=Audio2026.01 | 86 | — | — | — | — | — | — | — | |
| Audio Narrative AttacksTarget Model=Qwen2.5-Omni, Modality=Audio2026.01 | 86 | — | — | — | — | — | — | — | |
| SAHATarget Model=Qwen1.5-7B-Chat2026.03 | 86 | — | — | — | — | — | — | 81 | |
| Qwen2.5-14B-InstructPruning Percentage=75%2025.09 | 86 | — | — | — | — | — | — | — | |
| gemma-7b-itPruning Percentage=100%2025.09 | 86 | — | — | — | — | — | — | — | |
| ConVATarget Model=Qwen1.5-7B-Chat2026.03 | 85 | — | — | — | — | — | — | 40 | |
| Llama-3.2-1B-InstructPruning Percentage=100%2025.09 | 85 | — | — | — | — | — | — | — | |
| Phi-4Pruning Percentage=75%2025.09 | 85 | — | — | — | — | — | — | — | |
| IT2026.02 | 84.3 | — | — | — | — | — | — | — | |
| AdvWaveTarget Model=GPT-4o Realtime2026.01 | 84 | — | — | — | — | — | — | — | |
| PAIRTarget Model=Mistral-7B-Instruct2025.12 | 84 | — | — | — | — | 181 | — | — | |
| PGDTarget Model=InstructBlip-Vicuna-7B2025.09 | 84 | — | — | — | — | — | — | — | |
| CAATarget Model=Qwen2.5-7B-Instruct2026.03 | 84 | — | — | — | — | — | — | — | |
| Qwen2.5-14B-InstructPruning Percentage=100%2025.09 | 84 | — | — | — | — | — | — | — | |
| Phi-4Pruning Percentage=50%2025.09 | 84 | — | — | — | — | — | — | — | |
| AutoDANTarget Model=Qwen1.5-7B-Chat2026.03 | 83 | — | — | — | — | — | — | 64 | |
| Llama-3.2-1B-InstructPruning Percentage=75%2025.09 | 83 | — | — | — | — | — | — | — | |
| PiFTarget Model=Llama-2-13B-Chat2025.12 | 82 | — | — | — | — | 202 | — | — | |
| Llama-3.2-3B-InstructPruning Percentage=75%2025.09 | 82 | — | — | — | — | — | — | — | |
| QwQ-32BPruning Percentage=100%2025.09 | 82 | — | — | — | — | — | — | — | |
| RL2026.02 | 81.8 | — | — | — | — | — | — | — | |
| Audio Narrative AttacksTarget Model=Qwen2.5-Omni2026.01 | 81 | — | — | — | — | — | — | — | |
| SAHATarget Model=Deepseek-llm-7B-Chat2026.03 | 81 | — | — | — | — | — | — | 77 | |
| Llama-3.2-3B-InstructPruning Percentage=100%2025.09 | 81 | — | — | — | — | — | — | — | |
| DeepSeek-R1-Distill Llama-8BPruning Percentage=75%2025.09 | 81 | — | — | — | — | — | — | — | |
| QwQ-32BPruning Percentage=75%2025.09 | 81 | — | — | — | — | — | — | — | |
| SCAVTarget Model=Qwen1.5-7B-Chat2026.03 | 80 | — | — | — | — | — | — | 81 | |
| DeepSeek-R1-Distill Qwen-1.5BPruning Percentage=75%2025.09 | 80 | — | — | — | — | — | — | — | |
| DeepSeek-R1-Distill Qwen-1.5BPruning Percentage=100%2025.09 | 80 | — | — | — | — | — | — | — | |
| DeepSeek-R1-Distill Llama-8BPruning Percentage=100%2025.09 | 80 | — | — | — | — | — | — | — | |
| Llama-3.2-3B-InstructPruning Percentage=50%2025.09 | 79 | — | — | — | — | — | — | — | |
| DeepSeek-R1-Distill Qwen-1.5BPruning Percentage=50%2025.09 | 79 | — | — | — | — | — | — | — | |
| DeepSeek-R1-Distill Llama-8BPruning Percentage=50%2025.09 | 78 | — | — | — | — | — | — | — | |
| Qwen2.5-7B-InstructPruning Percentage=75%2025.09 | 77 | — | — | — | — | — | — | — | |
| Qwen2.5-7B-InstructPruning Percentage=100%2025.09 | 77 | — | — | — | — | — | — | — | |
| Phi-4-mini-instructPruning Percentage=75%2025.09 | 77 | — | — | — | — | — | — | — | |
| GCGTarget Model=Llava-v1.6-mistral-7b2025.09 | 74 | — | — | — | — | — | — | — | |
| SCAVTarget Model=Deepseek-llm-7B-Chat2026.03 | 74 | — | — | — | — | — | — | 80 | |
| DeepInception (Text Baseline)Target Model=Gemini 2.0 Flash, Modality=Text2026.01 | 73 | — | — | — | — | — | — | — | |
| Phi-4-mini-instructPruning Percentage=50%2025.09 | 73 | — | — | — | — | — | — | — | |
| Phi-4-mini-instructPruning Percentage=100%2025.09 | 73 | — | — | — | — | — | — | — | |
| DeepSeek-R1-Distill Qwen-1.5BPruning Percentage=0%2025.09 | 73 | — | — | — | — | — | — | — | |
| DeepSeek-R1-Distill Qwen-1.5BPruning Percentage=25%2025.09 | 73 | — | — | — | — | — | — | — | |
| GCGTarget Model=GPT-O1-Preview2025.12 | 72 | — | — | — | — | 195 | — | — | |
| CAATarget Model=Mistral-7B-Instruct2026.03 | 72 | — | — | — | — | — | — | — | |
| PAIRTarget Model=Llama-3.1-8B-Instruct2025.12 | 70 | — | — | — | — | 214 | — | — | |
| PAIRTarget Model=Vicuna-13B-V1.52025.12 | 70 | — | — | — | — | 171 | — | — | |
| CAATarget Model=Qwen1.5-7B-Chat2026.03 | 70 | — | — | — | — | — | — | 37 | |
| CAATarget Model=Llama3.1-8B-Instruct2026.03 | 70 | — | — | — | — | — | — | — | |
| FORCETarget Model=Llava-v1.6-mistral-7b2025.09 | 69 | — | — | — | — | — | — | — | |
| SCAVTarget Model=Llama3.1-8B-Instruct2026.03 | 68 | — | — | — | — | — | — | 82 | |
| GCGTarget Model=Mistral-7B-Instruct2026.03 | 68 | — | — | — | — | — | — | — | |
| DeepSeek-R1-Distill Llama-8BPruning Percentage=25%2025.09 | 68 | — | — | — | — | — | — | — | |
| AutoDANTarget Model=Llama3.1-8B-Instruct2026.03 | 67 | — | — | — | — | — | — | 66 | |
| FORCETarget Model=Idefics3-8B-Llama3, Source Model=InstructBLIP-Vicuna-7B2025.09 | 66 | — | — | — | — | — | 38.48 | — | |
| BasedTarget Model=Mistral-7B-Instruct2026.03 | 66 | — | — | — | — | — | — | — | |
| gemma-2b-itPruning Percentage=100%2025.09 | 66 | — | — | — | — | — | — | — | |
| FORCETarget Model=Idefics3-8B-Llama32025.09 | 64 | — | — | — | — | — | — | — | |
| SCAVTarget Model=Qwen2.5-7B-Instruct2026.03 | 64 | — | — | — | — | — | — | — | |
| AdvWaveTarget Model=Qwen2.5-Omni2026.01 | 63 | — | — | — | — | — | — | — | |
| AutoDAN-TurboTarget Model=Qwen1.5-7B-Chat2026.03 | 63 | — | — | — | — | — | — | 72 | |
| AutoDANTarget Model=Deepseek-llm-7B-Chat2026.03 | 63 | — | — | — | — | — | — | 70 | |
| gemma-2b-itPruning Percentage=75%2025.09 | 63 | — | — | — | — | — | — | — | |
| PGDTarget Model=Llava-v1.6-mistral-7b2025.09 | 61 | — | — | — | — | — | — | — | |
| PAIRTarget Model=Llama3.1-8B-Instruct2026.03 | 60 | — | — | — | — | — | — | 6 | |
| GCGTarget Model=Qwen1.5-7B-Chat2026.03 | 60 | — | — | — | — | — | — | 66 | |
| PAIRTarget Model=Mistral-7B-Instruct2026.03 | 56 | — | — | — | — | — | — | — | |
| Audio Narrative AttacksTarget Model=GPT-4o Realtime, Modality=Audio2026.01 | 55 | — | — | — | — | — | — | — | |
| Qwen2.5-14B-InstructPruning Percentage=50%2025.09 | 55 | — | — | — | — | — | — | — | |
| PAIRTarget Model=GPT-O1-Preview2025.12 | 54 | — | — | — | — | 140 | — | — | |
| GCGTarget Model=InstructBlip-Vicuna-7B2025.09 | 53 | — | — | — | — | — | — | — | |
| PGDTarget Model=Idefics3-8B-Llama32025.09 | 53 | — | — | — | — | — | — | — | |
| ConVATarget Model=Mistral-7B-Instruct2026.03 | 52 | — | — | — | — | — | — | — | |
| PAIRTarget Model=Llama-2-13B-Chat2025.12 | 51 | — | — | — | — | 133 | — | — | |
| FORCETarget Model=Llava-v1.6-mistral-7b, Source Model=InstructBLIP-Vicuna-7B2025.09 | 50 | — | — | — | — | — | 52.93 | — | |
| PGDTarget Model=Idefics3-8B-Llama3, Source Model=InstructBLIP-Vicuna-7B2025.09 | 50 | — | — | — | — | — | 53.09 | — | |
| Qwen2.5-7B-InstructPruning Percentage=50%2025.09 | 49 | — | — | — | — | — | — | — | |
| gemma-7b-itPruning Percentage=50%2025.09 | 47 | — | — | — | — | — | — | — |