Jailbreak Attack on StrongREJECT
99.4Attack Success RateEnumAttack
Evaluation results
| Method | Links | ||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EnumAttackModel=gpt-4o, Grammar Guardrail=None2025.03 | 99.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DictAttackModel=gemini-2.5-pro, Grammar Guardrail=disabled2025.03 | 99 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DictAttackModel=gpt-4o, Grammar Guardrail=None, k=12025.03 | 98.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DictAttackModel=deepseek-r1, Grammar Guardrail=disabled2025.03 | 98.1 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| EnumAttackModel=gpt-4o-mini, Grammar Guardrail=None2025.03 | 98.1 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AGRTarget Model=Qwen3-8B2026.05 | 98 | — | — | — | — | — | — | — | — | — | — | — | — | 96.7 | |
| AGRTarget Model=DS-R1-Distill-Llama-8B2026.05 | 98 | — | — | — | — | — | — | — | — | — | — | — | — | 98 | |
| DictAttackModel=gemini-2.5-pro, Grammar Guardrail=enabled2025.03 | 97.3 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DictAttackModel=gpt-4o, Grammar Guardrail=llama-guard-3-8b, k=12025.03 | 96.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DictAttackModel=deepseek-r1, Grammar Guardrail=enabled2025.03 | 96.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AGRTarget Model=Qwen3-1.7B2026.05 | 96 | — | — | — | — | — | — | — | — | — | — | — | — | 95.3 | |
| DictAttackModel=gpt-oss-120b, Grammar Guardrail=disabled2025.03 | 95.8 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DictAttackModel=gpt-5, Grammar Guardrail=disabled2025.03 | 95.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ICD-SEEDTarget Model=Vicuna-1.5-13B2026.04 | 95.21 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ICD-PREFILLTarget Model=Vicuna-1.5-13B2026.04 | 94.89 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DictAttackModel=gpt-oss-120b, Grammar Guardrail=enabled2025.03 | 94.2 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DictAttackModel=gpt-5, Grammar Guardrail=enabled2025.03 | 93.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Misrouter+FFATarget Model=Deepseek, Setting=White-box2026.05 | 93.3 | — | — | — | — | — | — | — | — | — | — | — | 4.15 | — | |
| DictAttackModel=gemini-2.0-flash, Grammar Guardrail=None, k=12025.03 | 93 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| H-CoTTarget Model=Qwen3-1.7B2026.05 | 92 | — | — | — | — | — | — | — | — | — | — | — | — | 92 | |
| Misrouter+FFATarget Model=Qwen1.5, Setting=White-box2026.05 | 91.7 | — | — | — | — | — | — | — | — | — | — | — | 3.68 | — | |
| DictAttackModel=gemini-2.0-flash, Grammar Guardrail=llama-guard-3-8b, k=12025.03 | 91.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AutoRANTarget Model=DS-R1-Distill-Llama-8B2026.05 | 91.3 | — | — | — | — | — | — | — | — | — | — | — | — | 91.3 | |
| H-CoTTarget Model=DS-R1-Distill-Llama-8B2026.05 | 90 | — | — | — | — | — | — | — | — | — | — | — | — | 90 | |
| AutoRANTarget Model=Qwen3-1.7B2026.05 | 90 | — | — | — | — | — | — | — | — | — | — | — | — | 89.3 | |
| H-CoTTarget Model=Qwen3-8B2026.05 | 89.3 | — | — | — | — | — | — | — | — | — | — | — | — | 90.7 | |
| NeuroStrikeTarget Model=Phi-4, Pruning Level=100%2025.09 | 89.1 | — | — | — | — | — | — | — | — | — | — | 0.4 | — | — | |
| AutoRANTarget Model=Qwen3-8B2026.05 | 88.7 | — | — | — | — | — | — | — | — | — | — | — | — | 88.7 | |
| NeuroStrikeTarget Model=DeepSeek-R1-Dist.-Llama-8B, Pruning Level=100%2025.09 | 86.9 | — | — | — | — | — | — | — | — | — | — | 0.4 | — | — | |
| L3Model=GPT-OSS-20B2026.02 | 86.3 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NeuroStrikeTarget Model=Qwen2.5-14B-Instruct, Pruning Level=100%2025.09 | 85.9 | — | — | — | — | — | — | — | — | — | — | 0.4 | — | — | |
| NeuroStrikeTarget Model=QwQ-32B, Pruning Level=100%2025.09 | 85.3 | — | — | — | — | — | — | — | — | — | — | 0.5 | — | — | |
| ICD-PREFILLTarget Model=Llama-3.1-70B2026.04 | 84.35 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NeuroStrikeTarget Model=DeepSeek-R1-Dist.-Qwen-1.5B, Pruning Level=50%2025.09 | 83.7 | — | — | — | — | — | — | — | — | — | — | 0.3 | — | — | |
| L3Model=Mixtral-8x7B-Instruct-v0.12026.02 | 83.1 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NeuroStrikeTarget Model=Phi-4-mini-instruct, Pruning Level=100%2025.09 | 81.8 | — | — | — | — | — | — | — | — | — | — | 0.5 | — | — | |
| FFATarget Model=Deepseek, Setting=White-box2026.05 | 81.7 | — | — | — | — | — | — | — | — | — | — | — | 4.29 | — | |
| NeuroStrikeTarget Model=DeepSeek-R1-Dist.-Qwen-1.5B, Pruning Level=100%2025.09 | 81.5 | — | — | — | — | — | — | — | — | — | — | 0.3 | — | — | |
| L3Model=Hunyuan-A13B-Instruct2026.02 | 81.3 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NeuroStrikeTarget Model=DeepSeek-R1-Dist.-Llama-8B, Pruning Level=50%2025.09 | 81.2 | — | — | — | — | — | — | — | — | — | — | 0.4 | — | — | |
| EnumAttackModel=gemini-2.0-flash, Grammar Guardrail=None2025.03 | 81.2 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| GateBreakerModel=GPT-OSS-20B2026.02 | 80.8 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ICD-SEEDTarget Model=Llama-3.1-70B2026.04 | 80.19 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| MisrouterTarget Model=Qwen1.5, Setting=White-box2026.05 | 80 | — | — | — | — | — | — | — | — | — | — | — | 3.86 | — | |
| NeuroStrikeTarget Model=Qwen2.5-7B-Instruct, Pruning Level=100%2025.09 | 79.6 | — | — | — | — | — | — | — | — | — | — | 0.3 | — | — | |
| ICD-PREFILLTarget Model=Qwen-2.5-72B2026.04 | 79.23 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AbliterationBackbone=Qwen2.5-14B2026.02 | 78.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NeuroStrikeTarget Model=DeepSeek-R1-Dist.-Qwen-1.5B, Pruning Level=25%2025.09 | 78.6 | — | — | — | — | — | — | — | — | — | — | 0.3 | — | — | |
| NeuroStrikeTarget Model=Phi-4, Pruning Level=50%2025.09 | 78.3 | — | — | — | — | — | — | — | — | — | — | 0.4 | — | — | |
| L3Model=DeepSeek-MoE-16B-Chat2026.02 | 76.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NeuroStrikeTarget Model=DeepSeek-R1-Dist.-Qwen-1.5B, Pruning Level=0%2025.09 | 76.7 | — | — | — | — | — | — | — | — | — | — | 0.3 | — | — | |
| GateBreakerModel=Hunyuan-A13B-Instruct2026.02 | 76.3 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| GRP-OblitBackbone=Ministral3-8B Instruct2026.02 | 76 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AMATarget Model=Llama-3.1-70B2026.04 | 75.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AbliterationBackbone=Qwen3-14B2026.02 | 75.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AbliterationBackbone=Qwen3-8B2026.02 | 74.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NeuroStrikeTarget Model=Llama-3.2-1B-Instruct, Pruning Level=100%2025.09 | 74.4 | — | — | — | — | — | — | — | — | — | — | 0.5 | — | — | |
| NeuroStrikeTarget Model=DeepSeek-R1-Dist.-Llama-8B, Pruning Level=25%2025.09 | 73.8 | — | — | — | — | — | — | — | — | — | — | 0.4 | — | — | |
| AbliterationBackbone=Qwen2.5-7B2026.02 | 72.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| GateBreakerModel=Pangu-Pro-MoE2026.02 | 72.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| GRP-Oblit-1Backbone=Llama3.1-8B2026.02 | 72.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| AMATarget Model=Qwen-2.5-72B2026.04 | 72.3 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| NeuroStrikeTarget Model=Llama-3.2-3B-Instruct, Pruning Level=100%2025.09 | 72.2 | — | — | — | — | — | — | — | — | — | — | 0.4 | — | — | |
| DictAttackModel=gpt-4o-mini, Grammar Guardrail=None, k=12025.03 | 70.6 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| L3Model=Average2026.02 | 70.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| GRP-OblitBackbone=Ministral3-14B Instruct2026.02 | 70.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| GRP-OblitBackbone=Qwen2.5-7B2026.02 | 70.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| L3Model=Pangu-Pro-MoE2026.02 | 70.3 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| WildPromptTarget Model=Qwen1.5, Setting=White-box2026.05 | 70 | — | — | — | — | — | — | — | — | — | — | — | 3.45 | — | |
| Misrouter+FFATarget Model=Mixtral, Setting=White-box2026.05 | 70 | — | — | — | — | — | — | — | — | — | — | — | 8.38 | — | |
| ReNeLLMTarget Model=DS-R1-Distill-Llama-8B2026.05 | 70 | — | — | — | — | — | — | — | — | — | — | — | — | 70.7 | |
| GRP-OblitBackbone=Qwen3-8B2026.02 | 69.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DictAttackModel=gpt-4o-mini, Grammar Guardrail=llama-guard-3-8b, k=12025.03 | 69.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| GRP-Oblit-1Backbone=Ministral3-14B Instruct2026.02 | 69 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| GRP-OblitBackbone=DeepSeek-R1-Qwen-14B2026.02 | 68.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| L3Model=Qwen1.5-MoE-A2.7B-Chat2026.02 | 68.4 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Misrouter+FFATarget Model=Phi-3.5, Setting=White-box2026.05 | 68.3 | — | — | — | — | — | — | — | — | — | — | — | 8.89 | — | |
| NeuroStrikeTarget Model=gemma-7b-it, Pruning Level=100%2025.09 | 68.1 | — | — | — | — | — | — | — | — | — | — | 0.5 | — | — | |
| NeuroStrikeTarget Model=Phi-4-mini-instruct, Pruning Level=50%2025.09 | 67.7 | — | — | — | — | — | — | — | — | — | — | 0.5 | — | — | |
| L3Model=Qwen3-30B-A3B-Instruct-25072026.02 | 67.2 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| WildPromptTarget Model=Deepseek, Setting=White-box2026.05 | 66.7 | — | — | — | — | — | — | — | — | — | — | — | 3.76 | — | |
| GRP-OblitBackbone=Qwen3-14B2026.02 | 66.6 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| GRP-OblitBackbone=Ministral3-8B Reasoning2026.02 | 66.1 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| GateBreakerModel=Mixtral-8x7B-Instruct-v0.12026.02 | 65.3 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| GRP-Oblit-1Backbone=DeepSeek-R1-Llama-8B2026.02 | 65.2 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| GRP-OblitBackbone=Llama3.1-8B2026.02 | 65 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| GRP-OblitBackbone=DeepSeek-R1-Llama-8B2026.02 | 64.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| GRP-OblitBackbone=Ministral3-14B Reasoning2026.02 | 64.6 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| GateBreakerModel=Average2026.02 | 64.3 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| GRP-Oblit-1Backbone=Gemma3-12B2026.02 | 63.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| GRP-Oblit-1Backbone=Qwen3-14B2026.02 | 63.7 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| GCGTarget Model=Qwen1.5, Setting=White-box2026.05 | 63.3 | — | — | — | — | — | — | — | — | — | — | — | 3.91 | — | |
| FFATarget Model=Mixtral, Setting=White-box2026.05 | 63.3 | — | — | — | — | — | — | — | — | — | — | — | 8.49 | — | |
| MisrouterTarget Model=Deepseek, Setting=White-box2026.05 | 63.3 | — | — | — | — | — | — | — | — | — | — | — | 4.13 | — | |
| TwinBreakBackbone=Qwen2.5-14B2026.02 | 63.1 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| GRP-OblitBackbone=Qwen2.5-14B2026.02 | 62.9 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| GRP-Oblit-1Backbone=DeepSeek-R1-Qwen-14B2026.02 | 62.8 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ReNeLLMTarget Model=Qwen3-1.7B2026.05 | 62.7 | — | — | — | — | — | — | — | — | — | — | — | — | 62.7 | |
| TwinBreakBackbone=Qwen2.5-7B2026.02 | 62.6 | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| GRP-Oblit-1Backbone=Qwen2.5-14B2026.02 | 62.2 | — | — | — | — | — | — | — | — | — | — | — | — | — |