Jailbreak Defense on AutoDAN
0ASRSafeDecoding
Evaluation results
| Method | Links | ||
|---|---|---|---|
| SafeDecodingModel=Vicuna2024.02 | 0 | 1.08 | |
| Self-ExaminationModel=Llama22024.02 | 0 | 1.04 | |
| ParaphraseModel=Llama22024.02 | 0 | 1 | |
| Self-ReminderModel=Llama22024.02 | 0 | 1.06 | |
| ICDModel=Llama22024.02 | 0 | 1 | |
| SafeDecodingModel=Llama22024.02 | 0 | 1 | |
| SAGEModel=Gemma22025.05 | 0 | 1 | |
| Goal PrioritizationModel=Qwen2.52025.05 | 0 | 1 | |
| SAGEModel=Llama3.12025.05 | 0 | 1 | |
| CBModel=Mistral-7B2026.04 | 0 | — | |
| BeamModel=Mistral-7B2026.04 | 0.67 | — | |
| SAGEModel=Qwen2.52025.05 | 1 | 1.02 | |
| No DefenseModel=Llama22024.02 | 2 | 1.08 | |
| PPLModel=Llama22024.02 | 2 | 1.04 | |
| Self-ExaminationModel=Gemma22025.05 | 2 | 1.08 | |
| Self-ExaminationModel=Llama3.12025.05 | 2 | 1 | |
| GoalModel=Mistral-7B2026.04 | 2 | — | |
| JPUBase Model Architecture=Llama2-7B-Chat2026.01 | 3.46 | — | |
| Self-ExaminationModel=Vicuna2024.02 | 4 | 1.14 | |
| Self-ExaminationModel=Qwen2.52025.05 | 4 | 1.12 | |
| JPUBase Model Architecture=Llama3-8B-Instruct2026.01 | 5.77 | — | |
| CKUBase Model Architecture=Llama3-8B-Instruct2026.01 | 5.96 | — | |
| Goal PrioritizationModel=Gemma22025.05 | 6 | 1.22 | |
| CKUBase Model Architecture=Llama2-7B-Chat2026.01 | 6.54 | — | |
| RSFTBase Model Architecture=Llama3-8B-Instruct2026.01 | 6.54 | — | |
| Safe UnlearningBase Model Architecture=Llama2-7B-Chat2026.01 | 6.92 | — | |
| Circuit BreakerBase Model Architecture=Llama2-7B-Chat2026.01 | 7.12 | — | |
| Safe UnlearningBase Model Architecture=Llama3-8B-Instruct2026.01 | 7.12 | — | |
| Circuit BreakerBase Model Architecture=Llama3-8B-Instruct2026.01 | 7.5 | — | |
| EraserBase Model Architecture=Llama3-8B-Instruct2026.01 | 7.88 | — | |
| Self-ReminderModel=Llama3.12025.05 | 8 | 1.28 | |
| RSFTBase Model Architecture=Llama2-7B-Chat2026.01 | 8.85 | — | |
| EraserBase Model Architecture=Llama2-7B-Chat2026.01 | 9.23 | — | |
| RetokenizationModel=Llama22024.02 | 10 | 1.14 | |
| IAModel=Llama3.12025.05 | 10 | 1.36 | |
| ICDModel=Llama3.12025.05 | 14 | 1.48 | |
| Base modelBase Model Architecture=Llama3-8B-Instruct2026.01 | 18.65 | — | |
| Base modelBase Model Architecture=Llama2-7B-Chat2026.01 | 20.77 | — | |
| Goal PrioritizationModel=Llama3.12025.05 | 22 | 1.18 | |
| No DefenseModel=Llama3.12025.05 | 24 | 1.86 | |
| IAModel=Qwen2.52025.05 | 26 | 1.5 | |
| Self-ReminderModel=Gemma22025.05 | 38 | 3.62 | |
| IAModel=Gemma22025.05 | 38 | 2.5 | |
| BaseModel=Mistral-7B2026.04 | 45.7 | — | |
| Self-ReminderModel=Qwen2.52025.05 | 58 | 2.22 | |
| No DefenseModel=Gemma22025.05 | 66 | 3.28 | |
| ParaphraseModel=Vicuna2024.02 | 70 | 3.32 | |
| Self-ReminderModel=Vicuna2024.02 | 70 | 4.64 | |
| RetokenizationModel=Vicuna2024.02 | 76 | 2.62 | |
| ICDModel=Vicuna2024.02 | 80 | 4.5 | |
| ICDModel=Qwen2.52025.05 | 82 | 4.1 | |
| No DefenseModel=Vicuna2024.02 | 88 | 4.92 | |
| PPLModel=Vicuna2024.02 | 88 | 4.92 | |
| ICDModel=Gemma22025.05 | 88 | 4.74 | |
| No DefenseModel=Qwen2.52025.05 | 94 | 4.64 |