Jailbreak Attack Success Rate on HarmBench
97Attack Success Rate (Generated)RLVR
Evaluation results
| Method | Links | |||||
|---|---|---|---|---|---|---|
| RLVR2025.10 | 97 | — | — | — | — | |
| JB-GCGl_dir=26, l_opt=322026.05 | 96 | 1 | 100 | 46.8 | 28.9 | |
| JB-GCGl_dir=18, l_opt=322026.05 | 93 | 0 | 100 | 41.9 | 23.5 | |
| JB-GCGl_dir=17, l_opt=322026.05 | 91 | 1.1 | 100 | 40.6 | 27.9 | |
| JB-GCGl_dir=18, l_opt=182026.05 | 88 | 0 | 100 | 53.4 | 30.7 | |
| SFT2025.10 | 81.5 | — | — | — | — | |
| SEALModel=Qwen2.5, Fine-tuning Dataset=Dolly2026.05 | 65.5 | — | — | — | — | |
| SEALModel=Llama3.1, Fine-tuning Dataset=Dolly2026.05 | 65 | — | — | — | — | |
| GradSafeModel=Llama3, Fine-tuning Dataset=Dolly2026.05 | 57 | — | — | — | — | |
| GuardModel=Llama3, Fine-tuning Dataset=Dolly2026.05 | 54.5 | — | — | — | — | |
| GuardModel=Llama3.1, Fine-tuning Dataset=Dolly2026.05 | 48 | — | — | — | — | |
| Bi-AnchorModel=Llama3, Fine-tuning Dataset=Dolly2026.05 | 43 | — | — | — | — | |
| GuardModel=Qwen2.5, Fine-tuning Dataset=Dolly2026.05 | 36 | — | — | — | — | |
| Bi-AnchorModel=Qwen2.5, Fine-tuning Dataset=Dolly2026.05 | 36 | — | — | — | — | |
| GradSafeModel=Qwen2.5, Fine-tuning Dataset=Dolly2026.05 | 32.5 | — | — | — | — | |
| GradSafeModel=Llama3.1, Fine-tuning Dataset=Dolly2026.05 | 31 | — | — | — | — | |
| GradSafeModel=Llama3.1, Fine-tuning Dataset=Alpaca2026.05 | 27.5 | — | — | — | — | |
| Bi-AnchorModel=Llama3.1, Fine-tuning Dataset=Dolly2026.05 | 27 | — | — | — | — | |
| RandomModel=Llama3, Fine-tuning Dataset=Dolly2026.05 | 20 | — | — | — | — | |
| RandomModel=Llama3, Fine-tuning Dataset=Alpaca2026.05 | 18.5 | — | — | — | — | |
| GradSafeModel=Llama3, Fine-tuning Dataset=Alpaca2026.05 | 16.5 | — | — | — | — | |
| RandomModel=Llama3.1, Fine-tuning Dataset=Alpaca2026.05 | 14 | — | — | — | — | |
| GuardModel=Llama3, Fine-tuning Dataset=Alpaca2026.05 | 13.5 | — | — | — | — | |
| SEALModel=Llama3, Fine-tuning Dataset=Alpaca2026.05 | 13.5 | — | — | — | — | |
| SEALModel=Llama3, Fine-tuning Dataset=Dolly2026.05 | 13 | — | — | — | — | |
| SEALModel=Llama3.1, Fine-tuning Dataset=Alpaca2026.05 | 13 | — | — | — | — | |
| RandomModel=Llama3.1, Fine-tuning Dataset=Dolly2026.05 | 13 | — | — | — | — | |
| GuardModel=Llama3.1, Fine-tuning Dataset=Alpaca2026.05 | 11 | — | — | — | — | |
| GuardModel=Qwen2.5, Fine-tuning Dataset=Alpaca2026.05 | 11 | — | — | — | — | |
| RandomModel=Qwen2.5, Fine-tuning Dataset=Dolly2026.05 | 10.5 | — | — | — | — | |
| InstructModel=Llama3.1, Fine-tuning Dataset=Alpaca2026.05 | 9.5 | — | — | — | — | |
| InstructModel=Llama3.1, Fine-tuning Dataset=Dolly2026.05 | 9.5 | — | — | — | — | |
| LARFModel=Qwen2.5, Fine-tuning Dataset=Dolly2026.05 | 9.5 | — | — | — | — | |
| RandomModel=Qwen2.5, Fine-tuning Dataset=Alpaca2026.05 | 9 | — | — | — | — | |
| SEALModel=Qwen2.5, Fine-tuning Dataset=Alpaca2026.05 | 9 | — | — | — | — | |
| GradSafeModel=Qwen2.5, Fine-tuning Dataset=Alpaca2026.05 | 9 | — | — | — | — | |
| DataShieldModel=Qwen2.5, Fine-tuning Dataset=Dolly2026.05 | 8.5 | — | — | — | — | |
| Bi-AnchorModel=Llama3, Fine-tuning Dataset=Alpaca2026.05 | 6.5 | — | — | — | — | |
| InstructModel=Qwen2.5, Fine-tuning Dataset=Alpaca2026.05 | 6.5 | — | — | — | — | |
| InstructModel=Qwen2.5, Fine-tuning Dataset=Dolly2026.05 | 6.5 | — | — | — | — | |
| InstructModel=Llama3, Fine-tuning Dataset=Alpaca2026.05 | 3.5 | — | — | — | — | |
| InstructModel=Llama3, Fine-tuning Dataset=Dolly2026.05 | 3.5 | — | — | — | — | |
| LARFModel=Llama3, Fine-tuning Dataset=Dolly2026.05 | 3.5 | — | — | — | — | |
| Bi-AnchorModel=Qwen2.5, Fine-tuning Dataset=Alpaca2026.05 | 3.5 | — | — | — | — | |
| LARFModel=Llama3.1, Fine-tuning Dataset=Dolly2026.05 | 2.5 | — | — | — | — | |
| Base2025.10 | 2 | — | — | — | — | |
| DataShieldModel=Llama3.1, Fine-tuning Dataset=Dolly2026.05 | 1.5 | — | — | — | — | |
| LARFModel=Llama3, Fine-tuning Dataset=Alpaca2026.05 | 1 | — | — | — | — | |
| DataShieldModel=Llama3, Fine-tuning Dataset=Alpaca2026.05 | 1 | — | — | — | — | |
| Bi-AnchorModel=Llama3.1, Fine-tuning Dataset=Alpaca2026.05 | 0.5 | — | — | — | — | |
| LARFModel=Qwen2.5, Fine-tuning Dataset=Alpaca2026.05 | 0.5 | — | — | — | — | |
| DataShieldModel=Qwen2.5, Fine-tuning Dataset=Alpaca2026.05 | 0.5 | — | — | — | — | |
| DataShieldModel=Llama3, Fine-tuning Dataset=Dolly2026.05 | 0 | — | — | — | — | |
| LARFModel=Llama3.1, Fine-tuning Dataset=Alpaca2026.05 | 0 | — | — | — | — | |
| DataShieldModel=Llama3.1, Fine-tuning Dataset=Alpaca2026.05 | 0 | — | — | — | — |