Jailbreak Defense on AdvBench
0ASR (PAIR)LoRA
Evaluation results
| Method | Links | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| LoRABase Model=Llama2-7B-chat2026.05 | 0 | — | — | 0 | — | — | — | 2 | — | — | — | — | |
| LEDBase Model=Llama2-7B-chat2026.05 | 0 | — | — | 1 | — | — | — | 0 | — | — | — | — | |
| Circuit BreakersBase Model=Llama2-7B-chat2026.05 | 0 | — | — | 0 | — | — | — | 0 | — | — | — | — | |
| EVA (text)Base Model=Llama2-7B-chat2026.05 | 0 | — | — | 0 | — | — | — | 0 | — | — | — | — | |
| EVA (text)Base Model=Mistral-7B-Instruct-v0.22026.05 | 0 | — | — | 11 | — | — | — | 2 | — | — | — | — | |
| SafeDecodingBase Model=Llama3.1-8B-Instruct2026.05 | 0 | — | — | 1 | — | — | — | 0 | — | — | — | — | |
| LEDBase Model=Llama3.1-8B-Instruct2026.05 | 0 | — | — | 7 | — | — | — | 0 | — | — | — | — | |
| Circuit BreakersBase Model=Llama3.1-8B-Instruct2026.05 | 0 | — | — | 0 | — | — | — | 0 | — | — | — | — | |
| EVA (text)Base Model=Llama3.1-8B-Instruct2026.05 | 0 | — | — | 0 | — | — | — | 1 | — | — | — | — | |
| Self DefenseModel=Claude-4.5-haiku2026.05 | 0 | — | — | — | — | — | — | — | — | — | 0.8 | 0 | |
| Semantic SmoothModel=Claude-4.5-haiku2026.05 | 0 | — | — | — | — | — | — | — | — | — | 0 | 0 | |
| IBProtectorModel=Claude-4.5-haiku2026.05 | 0 | — | — | — | — | — | — | — | — | — | 0 | 0 | |
| SmoothLLMModel=Claude-4.5-haiku2026.05 | 0.8 | — | — | — | — | — | — | — | — | — | 0 | 0 | |
| EvoDefenseModel=Claude-4.5-haiku2026.05 | 0.8 | — | — | — | — | — | — | — | — | — | 0 | 0 | |
| EvoDefenseModel=GPT-5-chat2026.05 | 0.8 | — | — | — | — | — | — | — | — | — | 0.8 | 0 | |
| VanillaBase Model=Llama2-7B-chat2026.05 | 1 | — | — | 19 | — | — | — | 39 | — | — | — | — | |
| EVA (text)Base Model=Qwen2.5-7B-Instruct2026.05 | 1 | — | — | 0 | — | — | — | 0 | — | — | — | — | |
| RA-LLMModel=LLaMA3-8B-instruct2026.05 | 1.7 | — | — | 66.7 | — | — | — | 0 | — | — | 2.5 | 3.3 | |
| Semantic SmoothModel=LLaMA3-8B-instruct2026.05 | 1.7 | — | — | 20.8 | — | — | — | 0 | — | — | 1.7 | 4.2 | |
| NoneModel=Claude-4.5-haiku2026.05 | 1.7 | — | — | — | — | — | — | — | — | — | 0 | 0 | |
| Erase-and-CheckTarget LLM=Llama-22026.05 | 2 | — | — | — | — | — | — | 0 | 14 | — | — | — | |
| DR-Smoothing-UniformTarget LLM=Llama-22026.05 | 2 | — | — | — | — | — | — | 0.3 | 6 | — | — | — | |
| DR-Smoothing-PolicyTarget LLM=Llama-22026.05 | 2 | — | — | — | — | — | — | 0 | 1 | — | — | — | |
| Circuit BreakersBase Model=Mistral-7B-Instruct-v0.22026.05 | 2 | — | — | 14 | — | — | — | 3 | — | — | — | — | |
| LEDBase Model=Qwen2.5-7B-Instruct2026.05 | 2 | — | — | 0 | — | — | — | 0 | — | — | — | — | |
| Self DefenseModel=GPT-5-chat2026.05 | 2.5 | — | — | — | — | — | — | — | — | — | 3.3 | 1.7 | |
| IBProtectorModel=LLaMA3-8B-instruct2026.05 | 3.3 | — | — | 39.2 | — | — | — | 0 | — | — | 0 | 6.7 | |
| EvoDefenseModel=LLaMA3-8B-instruct2026.05 | 3.3 | — | — | 0 | — | — | — | 0 | — | — | 0 | 0.8 | |
| Semantic SmoothModel=GPT-5-chat2026.05 | 3.3 | — | — | — | — | — | — | — | — | — | 0 | 5.8 | |
| IBProtectorModel=GPT-5-chat2026.05 | 3.3 | — | — | — | — | — | — | — | — | — | 1.7 | 5.8 | |
| SemanticSmooth-PolicyTarget LLM=Llama-22026.05 | 4 | — | — | — | — | — | — | 0 | 6 | — | — | — | |
| SafeDecodingBase Model=Llama2-7B-chat2026.05 | 4 | — | — | 0 | — | — | — | 4 | — | — | — | — | |
| VanillaBase Model=Llama3.1-8B-Instruct2026.05 | 4 | — | — | 31 | — | — | — | 47 | — | — | — | — | |
| LoRABase Model=Llama3.1-8B-Instruct2026.05 | 4 | — | — | 33 | — | — | — | 34 | — | — | — | — | |
| Semantic SmoothModel=Qwen-7B-chat2026.05 | 4.2 | — | — | 10 | — | — | — | 0 | — | — | 3.3 | 24.2 | |
| LEDBase Model=Vicuna-7B-v1.52026.05 | 5 | — | — | 9 | — | — | — | 6 | — | — | — | — | |
| EVA (text)Base Model=Vicuna-7B-v1.52026.05 | 5 | — | — | 2 | — | — | — | 2 | — | — | — | — | |
| Circuit BreakersBase Model=Qwen2.5-7B-Instruct2026.05 | 5 | — | — | 0 | — | — | — | 0 | — | — | — | — | |
| EvoDefenseModel=Qwen-7B-chat2026.05 | 5 | — | — | 0.8 | — | — | — | 0 | — | — | 5 | 6.7 | |
| SmoothLLMModel=GPT-5-chat2026.05 | 5 | — | — | — | — | — | — | — | — | — | 8.3 | 5.8 | |
| Self DefenseModel=LLaMA3-8B-instruct2026.05 | 5.8 | — | — | 50.8 | — | — | — | 0.8 | — | — | 5.8 | 17.5 | |
| EvoDefenseModel=Gemini-3-flash2026.05 | 5.8 | — | — | — | — | — | — | — | — | — | 5 | 2.5 | |
| Erase-and-CheckTarget LLM=Vicuna2026.05 | 6 | — | — | — | — | — | — | 0 | 37 | — | — | — | |
| Erase-and-CheckTarget LLM=Qwen2.52026.05 | 6 | — | — | — | — | — | — | 10.3 | 34 | — | — | — | |
| SmoothLLMTarget LLM=Llama-22026.05 | 6 | — | — | — | — | — | — | 0.8 | 24 | — | — | — | |
| SemanticSmooth-UniformTarget LLM=Llama-22026.05 | 6 | — | — | — | — | — | — | 2.6 | 16 | — | — | — | |
| EvoDefenseModel=Vicuna-7B-v1.52026.05 | 7.5 | — | — | 0 | — | — | — | 0 | — | — | 12.5 | 11.7 | |
| EvoDefenseModel=Mistral-7B-v0.22026.05 | 7.5 | — | — | 0 | — | — | — | 0.8 | — | — | 8.3 | 8.3 | |
| Erase-and-CheckTarget LLM=GPT-3.5-turbo2026.05 | 8 | — | — | — | — | — | — | — | 40 | — | — | — | |
| SafeDecodingBase Model=Vicuna-7B-v1.52026.05 | 8 | — | — | 20 | — | — | — | 4 | — | — | — | — | |
| Circuit BreakersBase Model=Vicuna-7B-v1.52026.05 | 8 | — | — | 2 | — | — | — | 5 | — | — | — | — | |
| NoneModel=GPT-5-chat2026.05 | 8.3 | — | — | — | — | — | — | — | — | — | 9.2 | 11.7 | |
| IBProtectorModel=Gemini-3-flash2026.05 | 9.2 | — | — | — | — | — | — | — | — | — | 5 | 8.3 | |
| DR-Smoothing-PolicyTarget LLM=Qwen2.52026.05 | 10 | — | — | — | — | — | — | 1 | 38 | — | — | — | |
| LoRABase Model=Qwen2.5-7B-Instruct2026.05 | 10 | — | — | 82 | — | — | — | 38 | — | — | — | — | |
| SmoothLLMModel=LLaMA3-8B-instruct2026.05 | 10.8 | — | — | 57.5 | — | — | — | 0 | — | — | 9.2 | 22.5 | |
| Semantic SmoothModel=Vicuna-7B-v1.52026.05 | 10.8 | — | — | 35.8 | — | — | — | 9.2 | — | — | 10.8 | 20 | |
| NoneTarget LLM=Llama-22026.05 | 12 | — | — | — | — | — | — | 49.4 | 31 | — | — | — | |
| Perplexity FilterTarget LLM=Llama-22026.05 | 12 | — | — | — | — | — | — | 0 | 31 | — | — | — | |
| DR-Smoothing-PolicyTarget LLM=GPT-3.5-turbo2026.05 | 12 | — | — | — | — | — | — | — | 31 | — | — | — | |
| LoRABase Model=Vicuna-7B-v1.52026.05 | 13 | — | — | 29 | — | — | — | 18 | — | — | — | — | |
| SemanticSmooth-PolicyTarget LLM=Qwen2.52026.05 | 14 | — | — | — | — | — | — | 2.4 | 46 | — | — | — | |
| Semantic SmoothModel=Gemini-3-flash2026.05 | 14.2 | — | — | — | — | — | — | — | — | — | 7.5 | 9.2 | |
| Semantic SmoothModel=Mistral-7B-v0.22026.05 | 15 | — | — | 45 | — | — | — | 5.8 | — | — | 18.3 | 34.2 | |
| SmoothLLMModel=Gemini-3-flash2026.05 | 15.8 | — | — | — | — | — | — | — | — | — | 8.3 | 9.2 | |
| LEDBase Model=Mistral-7B-Instruct-v0.22026.05 | 16 | — | — | 26 | — | — | — | 6 | — | — | — | — | |
| NoneModel=LLaMA3-8B-instruct2026.05 | 16.7 | — | — | 0 | — | — | — | 20 | — | — | 1.7 | 45 | |
| Self DefendModel=GPT-5-chat2026.05 | 16.7 | — | — | — | — | — | — | — | — | — | 5.8 | 70.8 | |
| Self DefendModel=Qwen-7B-chat2026.05 | 17.5 | — | — | 0 | — | — | — | 0 | — | — | 7.5 | 65.8 | |
| SafeDecodingBase Model=Mistral-7B-Instruct-v0.22026.05 | 18 | — | — | 22 | — | — | — | 12 | — | — | — | — | |
| Self DefenseModel=Gemini-3-flash2026.05 | 18.3 | — | — | — | — | — | — | — | — | — | 10 | 13.3 | |
| DR-Smoothing-UniformTarget LLM=Qwen2.52026.05 | 20 | — | — | — | — | — | — | 3.1 | 52 | — | — | — | |
| DR-Smoothing-PolicyTarget LLM=Vicuna2026.05 | 20 | — | — | — | — | — | — | 0 | 38 | — | — | — | |
| Self DefendModel=Mistral-7B-v0.22026.05 | 20 | — | — | 0 | — | — | — | 0 | — | — | 5.8 | 65 | |
| Self DefendModel=Vicuna-7B-v1.52026.05 | 21.7 | — | — | 0 | — | — | — | 0 | — | — | 3.3 | 60.8 | |
| SemanticSmooth-PolicyTarget LLM=Vicuna2026.05 | 22 | — | — | — | — | — | — | 2.2 | 44 | — | — | — | |
| DR-Smoothing-UniformTarget LLM=GPT-3.5-turbo2026.05 | 22 | — | — | — | — | — | — | — | 49 | — | — | — | |
| NoneModel=Gemini-3-flash2026.05 | 22.5 | — | — | — | — | — | — | — | — | — | 15.8 | 13.3 | |
| IBProtectorModel=Qwen-7B-chat2026.05 | 23.3 | — | — | 46.7 | — | — | — | 15 | — | — | 18.3 | 29.2 | |
| SmoothLLMTarget LLM=Qwen2.52026.05 | 24 | — | — | — | — | — | — | 12 | 53 | — | — | — | |
| SemanticSmooth-PolicyTarget LLM=GPT-3.5-turbo2026.05 | 24 | — | — | — | — | — | — | — | 38 | — | — | — | |
| RA-LLMModel=Qwen-7B-chat2026.05 | 24.2 | — | — | 42.5 | — | — | — | 20 | — | — | 18.3 | 20.8 | |
| LoRABase Model=Mistral-7B-Instruct-v0.22026.05 | 25 | — | — | 60 | — | — | — | 30 | — | — | — | — | |
| RA-LLMModel=Vicuna-7B-v1.52026.05 | 25 | — | — | 72.5 | — | — | — | 45.8 | — | — | 30.8 | 10 | |
| IBProtectorModel=Vicuna-7B-v1.52026.05 | 25.8 | — | — | 85.8 | — | — | — | 42.5 | — | — | 29.2 | 15.8 | |
| RA-LLMModel=Mistral-7B-v0.22026.05 | 25.8 | — | — | 85 | — | — | — | 11.7 | — | — | 34.2 | 23.3 | |
| SemanticSmooth-UniformTarget LLM=Qwen2.52026.05 | 26 | — | — | — | — | — | — | 7.4 | 52 | — | — | — | |
| Self DefenseModel=Mistral-7B-v0.22026.05 | 26.7 | — | — | 73.3 | — | — | — | 45 | — | — | 35 | 22.5 | |
| SemanticSmooth-UniformTarget LLM=GPT-3.5-turbo2026.05 | 28 | — | — | — | — | — | — | — | 56 | — | — | — | |
| SafeDecodingBase Model=Qwen2.5-7B-Instruct2026.05 | 30 | — | — | 80 | — | — | — | 17 | — | — | — | — | |
| NoneTarget LLM=Qwen2.52026.05 | 32 | — | — | — | — | — | — | 19.4 | 60 | — | — | — | |
| Perplexity FilterTarget LLM=Qwen2.52026.05 | 32 | — | — | — | — | — | — | 0 | 60 | — | — | — | |
| IBProtectorModel=Mistral-7B-v0.22026.05 | 33.3 | — | — | 96.7 | — | — | — | 9.2 | — | — | 32.5 | 40.8 | |
| Self DefendModel=Gemini-3-flash2026.05 | 33.3 | — | — | — | — | — | — | — | — | — | 5 | 65.8 | |
| SmoothLLMTarget LLM=GPT-3.5-turbo2026.05 | 34 | — | — | — | — | — | — | — | 56 | — | — | — | |
| SmoothLLMModel=Qwen-7B-chat2026.05 | 35.8 | — | — | 50 | — | — | — | 17.5 | — | — | 30.8 | 29.2 | |
| DR-Smoothing-UniformTarget LLM=Vicuna2026.05 | 36 | — | — | — | — | — | — | 3.4 | 51 | — | — | — | |
| VanillaBase Model=Qwen2.5-7B-Instruct2026.05 | 39 | — | — | 80 | — | — | — | 46 | — | — | — | — | |
| SmoothLLMModel=Mistral-7B-v0.22026.05 | 39.2 | — | — | 94.2 | — | — | — | 39.2 | — | — | 42.5 | 28.3 | |
| Perplexity FilterTarget LLM=GPT-3.5-turbo2026.05 | 42 | — | — | — | — | — | — | — | 64 | — | — | — |