Jailbreak Defense on GCG
0ASRPPL
Evaluation results
| Method | Links | ||
|---|---|---|---|
| PPLModel=Vicuna2024.02 | 0 | 1.02 | |
| PPLModel=Llama22024.02 | 0 | 1.06 | |
| Self-ReminderModel=Llama22024.02 | 0 | 1 | |
| ICDModel=Llama22024.02 | 0 | 1 | |
| SafeDecodingModel=Llama22024.02 | 0 | 1 | |
| Self-ExaminationModel=Gemma22025.05 | 0 | 1.08 | |
| Goal PrioritizationModel=Gemma22025.05 | 0 | 1 | |
| IAModel=Gemma22025.05 | 0 | 1 | |
| SAGEModel=Gemma22025.05 | 0 | 1 | |
| Self-ExaminationModel=Qwen2.52025.05 | 0 | 1 | |
| Goal PrioritizationModel=Qwen2.52025.05 | 0 | 1 | |
| SAGEModel=Qwen2.52025.05 | 0 | 1 | |
| ICDModel=Llama3.12025.05 | 0 | 1 | |
| SAGEModel=Llama3.12025.05 | 0 | 1 | |
| PreSafeBase Model=DS-R1-7B2026.03 | 0 | — | |
| R2DBase Model=DS-R1-8B2026.03 | 0 | — | |
| PreSafeBase Model=Qwen-34B2026.03 | 0 | — | |
| R2DBase Model=Qwen-8B2026.03 | 0 | — | |
| R2DBase Model=DS-R1-7B2026.03 | 1 | — | |
| R2DBase Model=DS-R1-14B2026.03 | 1 | — | |
| PreSafeBase Model=DS-R1-14B2026.03 | 1 | — | |
| RetokenizationModel=Llama22024.02 | 2 | 1 | |
| Self-ReminderModel=Qwen2.52025.05 | 2 | 1 | |
| IAModel=Llama3.12025.05 | 2 | 1.08 | |
| Perplexity FilterBase Model=DS-R1-14B2026.03 | 3 | — | |
| PreSafeBase Model=Skywork-7B2026.03 | 3 | — | |
| SafeDecodingModel=Vicuna2024.02 | 4 | 1.12 | |
| ParaphraseModel=Llama22024.02 | 4 | 1.06 | |
| Self-ReminderModel=Gemma22025.05 | 4 | 1.1 | |
| Erase-And-CheckBase Model=Qwen-8B2026.03 | 4 | — | |
| PreSafeBase Model=Qwen-8B2026.03 | 4 | — | |
| ICDModel=Gemma22025.05 | 6 | 1.24 | |
| ICDModel=Qwen2.52025.05 | 6 | 1.18 | |
| Self-ExaminationModel=Llama3.12025.05 | 6 | 1.06 | |
| Erase-And-CheckBase Model=DS-R1-7B2026.03 | 6.1 | — | |
| PreSafeBase Model=DS-R1-8B2026.03 | 6.1 | — | |
| Perplexity FilterBase Model=Qwen-34B2026.03 | 6.1 | — | |
| Erase-And-CheckBase Model=Qwen-34B2026.03 | 6.1 | — | |
| R2DBase Model=Skywork-7B2026.03 | 6.1 | — | |
| IAModel=Qwen2.52025.05 | 7 | 1.18 | |
| Erase-And-CheckBase Model=Skywork-7B2026.03 | 7.1 | — | |
| Erase-And-CheckBase Model=DS-R1-14B2026.03 | 8.1 | — | |
| Perplexity FilterBase Model=DS-R1-8B2026.03 | 9.1 | — | |
| Erase-And-CheckBase Model=DS-R1-8B2026.03 | 9.1 | — | |
| Perplexity FilterBase Model=Qwen-8B2026.03 | 9.1 | — | |
| Self-ExaminationModel=Vicuna2024.02 | 12 | 1.4 | |
| Self-ExaminationModel=Llama22024.02 | 12 | 1.56 | |
| Self-ReminderModel=Llama3.12025.05 | 12 | 1.24 | |
| Perplexity FilterBase Model=Skywork-7B2026.03 | 12.1 | — | |
| Smooth LLMBase Model=DS-R1-8B2026.03 | 14.1 | — | |
| Perplexity FilterBase Model=DS-R1-7B2026.03 | 17.2 | — | |
| R2DBase Model=Qwen-34B2026.03 | 17.2 | — | |
| Smooth LLMBase Model=DS-R1-14B2026.03 | 18.2 | — | |
| SafeChainBase Model=Skywork-7B2026.03 | 19.2 | — | |
| ParaphraseModel=Vicuna2024.02 | 20 | 1.8 | |
| Smooth LLMBase Model=DS-R1-7B2026.03 | 21.2 | — | |
| No DefenseModel=Qwen2.52025.05 | 22 | 1.88 | |
| SafeChainBase Model=DS-R1-8B2026.03 | 23.2 | — | |
| Remove Non-DictionaryBase Model=Qwen-8B2026.03 | 25.3 | — | |
| NoneBase Model=Qwen-8B2026.03 | 26.2 | — | |
| Smooth LLMBase Model=Qwen-34B2026.03 | 26.3 | — | |
| NoneBase Model=DS-R1-14B2026.03 | 27.2 | — | |
| SafeChainBase Model=DS-R1-14B2026.03 | 27.3 | — | |
| Smooth LLMBase Model=Qwen-8B2026.03 | 27.3 | — | |
| Goal PrioritizationModel=Llama3.12025.05 | 28 | 1.36 | |
| Remove Non-DictionaryBase Model=DS-R1-14B2026.03 | 28.3 | — | |
| NoneBase Model=Qwen-34B2026.03 | 30.3 | — | |
| No DefenseModel=Llama22024.02 | 32 | 2.48 | |
| SafeChainBase Model=DS-R1-7B2026.03 | 32.3 | — | |
| Remove Non-DictionaryBase Model=Qwen-34B2026.03 | 32.3 | — | |
| Synonym SubstitutionBase Model=DS-R1-14B2026.03 | 33.3 | — | |
| Synonym SubstitutionBase Model=Qwen-34B2026.03 | 34.3 | — | |
| SafeChainBase Model=Qwen-34B2026.03 | 34.3 | — | |
| SafeChainBase Model=Qwen-8B2026.03 | 35.4 | — | |
| NoneBase Model=DS-R1-8B2026.03 | 37.4 | — | |
| Synonym SubstitutionBase Model=Qwen-8B2026.03 | 37.4 | — | |
| Remove Non-DictionaryBase Model=DS-R1-8B2026.03 | 39.4 | — | |
| Smooth LLMBase Model=Skywork-7B2026.03 | 39.4 | — | |
| RetokenizationModel=Vicuna2024.02 | 42 | 1.58 | |
| Self-ReminderModel=Vicuna2024.02 | 42 | 2.76 | |
| Synonym SubstitutionBase Model=DS-R1-8B2026.03 | 44.4 | — | |
| NoneBase Model=DS-R1-7B2026.03 | 48.5 | — | |
| Remove Non-DictionaryBase Model=DS-R1-7B2026.03 | 48.5 | — | |
| Synonym SubstitutionBase Model=Skywork-7B2026.03 | 50.5 | — | |
| Synonym SubstitutionBase Model=DS-R1-7B2026.03 | 51.5 | — | |
| NoneBase Model=Skywork-7B2026.03 | 52.5 | — | |
| Remove Non-DictionaryBase Model=Skywork-7B2026.03 | 55.6 | — | |
| No DefenseModel=Llama3.12025.05 | 60 | 3 | |
| ICDModel=Vicuna2024.02 | 70 | 3.86 | |
| No DefenseModel=Gemma22025.05 | 96 | 4.74 | |
| No DefenseModel=Vicuna2024.02 | 100 | 4.7 |