Jailbreak Attack on STRONGREJECT (held-out behaviors)
100ASR (0.5 threshold)PAIR
Evaluation results
| Method | Links | |
|---|---|---|
| PAIRTarget model=Qwen-2.5-32B2026.06 | 100 | |
| PAIR+Target model=Qwen-2.5-32B2026.06 | 100 | |
| BONTarget model=Qwen-2.5-32B2026.06 | 100 | |
| JR1+Target model=Qwen-2.5-32B2026.06 | 100 | |
| INPAINTINGTarget model=Qwen-2.5-32B2026.06 | 100 | |
| IHOTarget model=Qwen-2.5-32B2026.06 | 100 | |
| GCG+Target model=Qwen-2.5-7B2026.06 | 100 | |
| PAIR+Target model=Qwen-2.5-7B2026.06 | 100 | |
| BONTarget model=Qwen-2.5-7B2026.06 | 100 | |
| JR1+Target model=Qwen-2.5-7B2026.06 | 100 | |
| INPAINTINGTarget model=Qwen-2.5-7B2026.06 | 100 | |
| IHOTarget model=Qwen-2.5-7B2026.06 | 100 | |
| IHOTarget model=Qwen-2.5-7B+D2026.06 | 100 | |
| BONTarget model=LLaMA-3-8B2026.06 | 100 | |
| JR1+Target model=LLaMA-3-8B2026.06 | 100 | |
| IHOTarget model=LLaMA-3-8B2026.06 | 100 | |
| IHOTarget model=CB2026.06 | 100 | |
| IHOTarget model=CB+D2026.06 | 100 | |
| IHOTarget model=LAT2026.06 | 100 | |
| IHOTarget model=CAT2026.06 | 100 | |
| PAIRTarget model=Qwen-2.5-7B2026.06 | 97 | |
| INPAINTINGTarget model=Qwen-2.5-7B+D2026.06 | 97 | |
| PAIR+Target model=LLaMA-3-8B2026.06 | 97 | |
| INPAINTINGTarget model=LLaMA-3-8B2026.06 | 97 | |
| JR1+Target model=CAT2026.06 | 97 | |
| IHOTarget model=Qwen-2.5-7B, STRONGREJECT threshold=0.82026.06 | 97 | |
| JR1+Target model=Qwen-2.5-7B+D2026.06 | 95 | |
| GCG+Target model=LLaMA-3-8B2026.06 | 95 | |
| IHOTarget model=Qwen-2.5-7B, Evaluation Protocol=EVUS2026.06 | 94 | |
| GCG+Target model=Qwen-2.5-32B2026.06 | 93 | |
| INPAINTINGTarget model=CB2026.06 | 93 | |
| JR1+Target model=LAT2026.06 | 93 | |
| INPAINTINGTarget model=LAT2026.06 | 93 | |
| IHOTarget model=Qwen-2.5-32B, Evaluation Protocol=EVUS2026.06 | 92 | |
| IHOTarget model=Qwen-2.5-32B, STRONGREJECT threshold=0.82026.06 | 90 | |
| PAIR+Target model=Qwen-2.5-7B, Evaluation Protocol=EVUS2026.06 | 90 | |
| GCG+Target model=Qwen-2.5-7B, Evaluation Protocol=EVUS2026.06 | 89 | |
| JR1+Target model=Qwen-2.5-7B, Evaluation Protocol=EVUS2026.06 | 89 | |
| INPAINTINGTarget model=CAT2026.06 | 88 | |
| JR1+Target model=Qwen-2.5-7B, STRONGREJECT threshold=0.82026.06 | 88 | |
| JR1+Target model=Qwen-2.5-32B, Evaluation Protocol=EVUS2026.06 | 88 | |
| PAIR+Target model=Qwen-2.5-32B, Evaluation Protocol=EVUS2026.06 | 87 | |
| PAIR+Target model=Qwen-2.5-7B+D2026.06 | 85 | |
| PAIR+Target model=CAT2026.06 | 85 | |
| JR1+Target model=Qwen-2.5-32B, STRONGREJECT threshold=0.82026.06 | 85 | |
| PAIR+Target model=Qwen-2.5-7B, STRONGREJECT threshold=0.82026.06 | 85 | |
| IHOTarget model=LLaMA-3-8B, STRONGREJECT threshold=0.82026.06 | 85 | |
| GCG+Target model=Qwen-2.5-32B, Evaluation Protocol=EVUS2026.06 | 85 | |
| INPAINTINGTarget model=Qwen-2.5-7B, Evaluation Protocol=EVUS2026.06 | 85 | |
| IHOTarget model=LLaMA-3-8B, Evaluation Protocol=EVUS2026.06 | 85 | |
| JR1+Target model=LLaMA-3-8B, Evaluation Protocol=EVUS2026.06 | 83 | |
| BONTarget model=Qwen-2.5-7B+D2026.06 | 82 | |
| INPAINTINGTarget model=CB+D2026.06 | 82 | |
| PAIR+Target model=LAT2026.06 | 82 | |
| IHOTarget model=Qwen-2.5-7B+D, Evaluation Protocol=EVUS2026.06 | 82 | |
| IHOTarget model=CB, Evaluation Protocol=EVUS2026.06 | 82 | |
| BONTarget model=LLaMA-3-8B, Evaluation Protocol=EVUS2026.06 | 81 | |
| PAIRTarget model=LLaMA-3-8B2026.06 | 80 | |
| PAIR+Target model=Qwen-2.5-32B, STRONGREJECT threshold=0.82026.06 | 80 | |
| GCG+Target model=Qwen-2.5-7B, STRONGREJECT threshold=0.82026.06 | 80 | |
| INPAINTINGTarget model=Qwen-2.5-7B, STRONGREJECT threshold=0.82026.06 | 80 | |
| IHOTarget model=CB, STRONGREJECT threshold=0.82026.06 | 80 | |
| INPAINTINGTarget model=Qwen-2.5-32B, Evaluation Protocol=EVUS2026.06 | 80 | |
| IHOTarget model=CB+D, Evaluation Protocol=EVUS2026.06 | 79 | |
| PAIR+Target model=CB2026.06 | 78 | |
| BONTarget model=LLaMA-3-8B, STRONGREJECT threshold=0.82026.06 | 78 | |
| JR1+Target model=LLaMA-3-8B, STRONGREJECT threshold=0.82026.06 | 78 | |
| GCG+Target model=LLaMA-3-8B, Evaluation Protocol=EVUS2026.06 | 78 | |
| PAIRTarget model=Qwen-2.5-7B, Evaluation Protocol=EVUS2026.06 | 78 | |
| IHOTarget model=LAT, Evaluation Protocol=EVUS2026.06 | 78 | |
| IHOTarget model=CAT, Evaluation Protocol=EVUS2026.06 | 78 | |
| BONTarget model=Qwen-2.5-7B, Evaluation Protocol=EVUS2026.06 | 77 | |
| PAIR+Target model=LLaMA-3-8B, Evaluation Protocol=EVUS2026.06 | 76 | |
| JR1+Target model=CB2026.06 | 75 | |
| GCG+Target model=Qwen-2.5-32B, STRONGREJECT threshold=0.82026.06 | 75 | |
| PAIRTarget model=Qwen-2.5-32B, Evaluation Protocol=EVUS2026.06 | 75 | |
| BONTarget model=Qwen-2.5-32B, Evaluation Protocol=EVUS2026.06 | 75 | |
| INPAINTINGTarget model=LLaMA-3-8B, Evaluation Protocol=EVUS2026.06 | 74 | |
| IHOTarget model=Qwen-2.5-7B+D, STRONGREJECT threshold=0.82026.06 | 72 | |
| PAIR+Target model=LLaMA-3-8B, STRONGREJECT threshold=0.82026.06 | 72 | |
| JR1+Target model=Qwen-2.5-7B+D, Evaluation Protocol=EVUS2026.06 | 72 | |
| JR1+Target model=CAT, Evaluation Protocol=EVUS2026.06 | 72 | |
| AmpleGCG+Target model=Qwen-2.5-7B2026.06 | 70 | |
| GCG+Target model=LLaMA-3-8B, STRONGREJECT threshold=0.82026.06 | 70 | |
| PAIR+Target model=Qwen-2.5-7B+D, Evaluation Protocol=EVUS2026.06 | 70 | |
| INPAINTINGTarget model=Qwen-2.5-7B+D, Evaluation Protocol=EVUS2026.06 | 69 | |
| PAIR+Target model=CAT, Evaluation Protocol=EVUS2026.06 | 67 | |
| JR1+Target model=LAT, Evaluation Protocol=EVUS2026.06 | 67 | |
| PAIR+Target model=CB+D2026.06 | 65 | |
| IHOTarget model=CB+D, STRONGREJECT threshold=0.82026.06 | 65 | |
| PAIR+Target model=LAT, Evaluation Protocol=EVUS2026.06 | 65 | |
| INPAINTINGTarget model=CB, Evaluation Protocol=EVUS2026.06 | 64 | |
| JR1+Target model=CB+D2026.06 | 62 | |
| JR1+Target model=Qwen-2.5-7B+D, STRONGREJECT threshold=0.82026.06 | 62 | |
| PAIR+Target model=CB, Evaluation Protocol=EVUS2026.06 | 62 | |
| INPAINTINGTarget model=LAT, Evaluation Protocol=EVUS2026.06 | 62 | |
| BONTarget model=Qwen-2.5-7B+D, Evaluation Protocol=EVUS2026.06 | 61 | |
| INPAINTINGTarget model=Qwen-2.5-32B, STRONGREJECT threshold=0.82026.06 | 60 | |
| BONTarget model=Qwen-2.5-7B, STRONGREJECT threshold=0.82026.06 | 60 | |
| IHOTarget model=CAT, STRONGREJECT threshold=0.82026.06 | 60 |