Jailbreak Attack on Prefilling Attack 40 tokens
0ASR (%)Self-Reminder
Evaluation results
| Method | Links | ||
|---|---|---|---|
| Self-ReminderModel=Llama2-7b2026.02 | 0 | 1.03 | |
| Self-ExamBackbone=Qwen32026.02 | 0.61 | 1.06 | |
| Self-ReminderModel=Llama2-13b2026.02 | 0.61 | 1.08 | |
| SSDBackbone=Qwen32026.02 | 0.91 | 1.32 | |
| Self-ReminderBackbone=Qwen32026.02 | 1.21 | 1.08 | |
| SD_TinyExpertBackbone=Qwen32026.02 | 1.52 | 1.12 | |
| NGSDModel=Llama2-13b2026.02 | 1.52 | 1.37 | |
| NGSDBackbone=Qwen32026.02 | 2.12 | 1.17 | |
| Self-ReminderBackbone=Llama32026.02 | 2.73 | 1.68 | |
| No DefenseBackbone=Qwen32026.02 | 2.73 | 1.15 | |
| SSDBackbone=Llama32026.02 | 3.03 | 1.66 | |
| NGSDBackbone=Llama32026.02 | 3.64 | 1.3 | |
| Self-ExamModel=Llama2-7b2026.02 | 3.64 | 1.3 | |
| ParaphraseBackbone=Llama32026.02 | 4.85 | 1.93 | |
| Self-ExamModel=Llama2-13b2026.02 | 5.15 | 1.75 | |
| ParaphraseBackbone=Qwen32026.02 | 6.97 | 1.33 | |
| ParaphraseModel=Llama2-13b2026.02 | 6.97 | 1.62 | |
| SD_TinyExpertBackbone=Llama32026.02 | 7.27 | 1.57 | |
| Self-ReminderBackbone=Vicuna2026.02 | 7.58 | 1.58 | |
| SD_DaExpertBackbone=Qwen32026.02 | 7.58 | 1.39 | |
| NGSDModel=Llama2-7b2026.02 | 7.58 | 1.77 | |
| NGSDBackbone=Vicuna2026.02 | 8.48 | 1.77 | |
| SD_DaExpertModel=Llama2-7b2026.02 | 8.48 | 1.7 | |
| ParaphraseModel=Llama2-7b2026.02 | 10 | 1.77 | |
| SSDModel=Llama2-13b2026.02 | 11.52 | 1.83 | |
| SafeDecodingBackbone=Qwen32026.02 | 13.64 | 1.55 | |
| SSDModel=Llama2-7b2026.02 | 14.85 | 2.36 | |
| No DefenseModel=Llama2-13b2026.02 | 20 | 2.55 | |
| Self-ExamBackbone=Llama32026.02 | 20.91 | 2.42 | |
| SD_TinyExpertModel=Llama2-7b2026.02 | 21.21 | 3.02 | |
| SD_DaExpertModel=Llama2-13b2026.02 | 21.82 | 2.89 | |
| SafeDecodingModel=Llama2-13b2026.02 | 22.12 | 2.78 | |
| ParaphraseBackbone=Vicuna2026.02 | 25.15 | 2.72 | |
| No DefenseModel=Llama2-7b2026.02 | 25.15 | 3.23 | |
| SafeDecodingModel=Llama2-7b2026.02 | 26.97 | 3.33 | |
| Self-ExamBackbone=Vicuna2026.02 | 28.18 | 2.66 | |
| SSDBackbone=Vicuna2026.02 | 30 | 2.99 | |
| SafeDecodingBackbone=Llama32026.02 | 34.85 | 3.31 | |
| SD_DaExpertBackbone=Llama32026.02 | 39.7 | 3.53 | |
| SD_TinyExpertModel=Llama2-13b2026.02 | 41.21 | 2.79 | |
| No DefenseBackbone=Llama32026.02 | 46.36 | 3.7 | |
| SD_TinyExpertBackbone=Vicuna2026.02 | 58.18 | 4.16 | |
| SafeDecodingBackbone=Vicuna2026.02 | 65.76 | 4.34 | |
| No DefenseBackbone=Vicuna2026.02 | 66.97 | 4.43 | |
| SD_DaExpertBackbone=Vicuna2026.02 | 66.97 | 4.43 |