Jailbreak Attack on PAIR
0Harmful ScoreRealSafe-R1
Evaluation results
| Method | Links | ||
|---|---|---|---|
| RealSafe-R1Model=R1-Qwen-14B2025.08 | 0 | — | |
| ReasoningGuardModel=R1-Qwen-14B2025.08 | 0 | — | |
| RealSafe-R1Model=R1-Qwen-32B2025.08 | 0 | — | |
| ReasoningGuardModel=R1-Qwen-32B2025.08 | 0 | — | |
| SafeDecodingBackbone=Vicuna2026.02 | 1.22 | 4 | |
| ParaphraseBackbone=Llama32026.02 | 1.34 | 0 | |
| Self-ReminderBackbone=Llama32026.02 | 1.36 | 6 | |
| NGSDBackbone=Llama32026.02 | 1.4 | 2 | |
| SD_DaExpertBackbone=Llama32026.02 | 1.46 | 8 | |
| Self-ExamBackbone=Qwen32026.02 | 1.46 | 8 | |
| Self-ExamBackbone=Llama32026.02 | 1.48 | 8 | |
| SD_TinyExpertBackbone=Llama32026.02 | 1.54 | 10 | |
| NGSDBackbone=Vicuna2026.02 | 1.62 | 6 | |
| NGSDBackbone=Qwen32026.02 | 1.62 | 8 | |
| No DefenseBackbone=Llama32026.02 | 1.64 | 10 | |
| SafeDecodingBackbone=Llama32026.02 | 1.72 | 8 | |
| SSDBackbone=Llama32026.02 | 1.82 | 4 | |
| ParaphraseBackbone=Qwen32026.02 | 1.82 | 14 | |
| SafeDecodingBackbone=Qwen32026.02 | 1.92 | 16 | |
| Self-ExamBackbone=Vicuna2026.02 | 1.98 | 14 | |
| SD_TinyExpertBackbone=Vicuna2026.02 | 2 | 16 | |
| ThinkingIModel=R1-Qwen-14B2025.08 | 2 | — | |
| SD_DaExpertBackbone=Qwen32026.02 | 2.04 | 20 | |
| ParaphraseBackbone=Vicuna2026.02 | 2.12 | 20 | |
| Self-ReminderBackbone=Qwen32026.02 | 2.16 | 14 | |
| SSDBackbone=Vicuna2026.02 | 2.36 | 28 | |
| SD_TinyExpertBackbone=Qwen32026.02 | 2.5 | 26 | |
| SSDBackbone=Qwen32026.02 | 2.5 | 22 | |
| No DefenseBackbone=Qwen32026.02 | 2.56 | 26 | |
| Self-ReminderBackbone=Vicuna2026.02 | 2.84 | 36 | |
| SafeKeyModel=R1-Qwen-14B2025.08 | 4 | — | |
| SAFEPATH-ZSModel=R1-Qwen-14B2025.08 | 4 | — | |
| SD_DaExpertBackbone=Vicuna2026.02 | 4.02 | 62 | |
| No DefenseBackbone=Vicuna2026.02 | 4.5 | 76 | |
| SAFEPATH-ZSModel=R1-Qwen-32B2025.08 | 6 | — | |
| Self-ReminderModel=R1-Qwen-14B2025.08 | 8 | — | |
| Self-ReminderModel=R1-Qwen-32B2025.08 | 8 | — | |
| SmoothLLMModel=R1-Qwen-14B2025.08 | 24 | — | |
| ThinkingIModel=R1-Qwen-32B2025.08 | 26 | — | |
| Buffer-and-Reinforce2026.05 | 27 | — | |
| SmoothLLMModel=R1-Qwen-32B2025.08 | 38 | — | |
| No DefenseModel=R1-Qwen-14B2025.08 | 40 | — | |
| ParaphraseModel=R1-Qwen-14B2025.08 | 42 | — | |
| No DefenseModel=R1-Qwen-32B2025.08 | 44 | — | |
| ParaphraseModel=R1-Qwen-32B2025.08 | 44 | — | |
| SFT2026.05 | 68.4 | — | |
| BaseModel=Mistral-7B2026.04 | — | 54 | |
| BeamModel=Mistral-7B2026.04 | — | 21.8 | |
| CBModel=Mistral-7B2026.04 | — | 55.7 | |
| Context FilteringBase LLM=Vicuna2025.08 | — | 8 | |
| Context FilteringBase LLM=ChatGPT2025.08 | — | 0 | |
| GoalModel=Mistral-7B2026.04 | — | 8.33 | |
| ICDBase LLM=Vicuna2025.08 | — | 22 | |
| ICDBase LLM=ChatGPT2025.08 | — | 2 | |
| Intention AnalysisBase LLM=Vicuna2025.08 | — | 0 | |
| Intention AnalysisBase LLM=ChatGPT2025.08 | — | 0 | |
| No DefenseBase LLM=Vicuna2025.08 | — | 48 | |
| No DefenseBase LLM=Llama22025.08 | — | 0 | |
| No DefenseBase LLM=ChatGPT2025.08 | — | 10 | |
| Safe DecodingBase LLM=Vicuna2025.08 | — | 2 | |
| Self-ExaminationBase LLM=Vicuna2025.08 | — | 8 | |
| Self-ExaminationBase LLM=ChatGPT2025.08 | — | 0 | |
| Self-ReminderBase LLM=Vicuna2025.08 | — | 22 | |
| Self-ReminderBase LLM=ChatGPT2025.08 | — | 4 |