Jailbreak Defense on HarmBench
0PAIR ASRICD
Evaluation results
| Method | Links | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ICDModel=meta-llama/Llama-2-7b-chat-hf, Judge Model=gpt-4o2026.03 | 0 | 0 | 0.5 | — | 0 | 5 | 0 | 0 | 0 | 2.93 | — | — | — | |
| GUARD-SLMModel=meta-llama/Llama-2-7b-chat-hf, Judge Model=gpt-4o2026.03 | 0 | 0 | 0 | — | 0 | 0 | 0 | 0 | 0 | 0.74 | — | — | — | |
| EVA (text)Base Model=Llama2-7B-chat2026.05 | 0 | 0 | 0 | — | — | — | — | — | — | — | — | — | — | |
| SafeDecodingBase Model=Llama3.1-8B-Instruct2026.05 | 0 | 0 | 4 | — | — | — | — | — | — | — | — | — | — | |
| LEDBase Model=Llama3.1-8B-Instruct2026.05 | 0 | 1 | 6 | — | — | — | — | — | — | — | — | — | — | |
| EVA (text)Base Model=Llama3.1-8B-Instruct2026.05 | 0 | 0 | 0 | — | — | — | — | — | — | — | — | — | — | |
| IBProtectorModel=Claude-4.5-haiku2026.05 | 0.3 | — | — | — | 0 | — | — | — | — | — | — | — | 0.6 | |
| GoalPriorModel=meta-llama/Llama-2-7b-chat-hf, Judge Model=gpt-4o2026.03 | 0.5 | 0 | 3.5 | — | 1.5 | 0.13 | 0 | 0 | 0 | 3.79 | — | — | — | |
| SmoothLLMModel=Claude-4.5-haiku2026.05 | 0.9 | — | — | — | 0.6 | — | — | — | — | — | — | — | 2.8 | |
| SafeDecodingBase Model=Llama2-7B-chat2026.05 | 1 | 0 | 0 | — | — | — | — | — | — | — | — | — | — | |
| LEDBase Model=Llama2-7B-chat2026.05 | 1 | 2 | 2 | — | — | — | — | — | — | — | — | — | — | |
| Circuit BreakersBase Model=Llama2-7B-chat2026.05 | 1 | 0 | 2 | — | — | — | — | — | — | — | — | — | — | |
| SelfdefenseModel=Claude-4.5-haiku2026.05 | 1.6 | — | — | — | 0.6 | — | — | — | — | — | — | — | 1.3 | |
| EvoDefenseModel=Claude-4.5-haiku2026.05 | 1.6 | — | — | — | 0.6 | — | — | — | — | — | — | — | 2.2 | |
| Semantic SmoothModel=Claude-4.5-haiku2026.05 | 1.9 | — | — | — | 1.3 | — | — | — | — | — | — | — | 2.2 | |
| VanillaBase Model=Llama2-7B-chat2026.05 | 2 | 42 | 23 | — | — | — | — | — | — | — | — | — | — | |
| LoRABase Model=Llama2-7B-chat2026.05 | 2 | 13 | 1 | — | — | — | — | — | — | — | — | — | — | |
| NoneModel=Claude-4.5-haiku2026.05 | 2.2 | — | — | — | 0.6 | — | — | — | — | — | — | — | 4.1 | |
| EvoDefenseModel=GPT-5-chat2026.05 | 2.2 | — | — | — | 3.8 | — | — | — | — | — | — | — | 0.9 | |
| SelfReminderModel=meta-llama/Llama-2-7b-chat-hf, Judge Model=gpt-4o2026.03 | 2.5 | 0 | 1.5 | — | 4.5 | 1.12 | 0 | 25.5 | 0 | 4.5 | — | — | — | |
| RobustAlignModel=meta-llama/Llama-2-7b-chat-hf, Judge Model=gpt-4o2026.03 | 2.51 | 1.5 | 0 | — | 5.5 | 11.25 | 9 | 38 | 0 | 1.25 | — | — | — | |
| Circuit BreakersBase Model=Vicuna-7B-v1.52026.05 | 3 | 9 | 10 | — | — | — | — | — | — | — | — | — | — | |
| Circuit BreakersBase Model=Llama3.1-8B-Instruct2026.05 | 3 | 0 | 4 | — | — | — | — | — | — | — | — | — | — | |
| EVA (text)Base Model=Qwen2.5-7B-Instruct2026.05 | 3 | 0 | 0 | — | — | — | — | — | — | — | — | — | — | |
| LEDBase Model=Vicuna-7B-v1.52026.05 | 4 | 3 | 11 | — | — | — | — | — | — | — | — | — | — | |
| Circuit BreakersBase Model=Qwen2.5-7B-Instruct2026.05 | 4 | 0 | 3 | — | — | — | — | — | — | — | — | — | — | |
| Semantic SmoothModel=GPT-5-chat2026.05 | 4.1 | — | — | — | 4.7 | — | — | — | — | — | — | — | 4.4 | |
| LEDBase Model=Qwen2.5-7B-Instruct2026.05 | 5 | 1 | 0 | — | — | — | — | — | — | — | — | — | — | |
| Semantic SmoothModel=LLaMA3-8B-instruct2026.05 | 5.3 | 2.5 | 18.8 | — | 5.3 | — | — | — | — | — | — | — | 10.3 | |
| IBProtectorModel=GPT-5-chat2026.05 | 5.6 | — | — | — | 5.6 | — | — | — | — | — | — | — | 5.9 | |
| EvoDefenseModel=LLaMA3-8B-instruct2026.05 | 5.9 | 0 | 0.9 | — | 2.5 | — | — | — | — | — | — | — | 6.2 | |
| SelfdefenseModel=GPT-5-chat2026.05 | 5.9 | — | — | — | 5.9 | — | — | — | — | — | — | — | 2.2 | |
| EvoDefenseModel=Gemini-3-flash2026.05 | 6.3 | — | — | — | 10.3 | — | — | — | — | — | — | — | 8.4 | |
| SelfEvalModel=meta-llama/Llama-2-7b-chat-hf, Judge Model=gpt-4o2026.03 | 6.5 | 3 | 1 | — | 7 | 16.5 | 7.5 | 28 | 0 | 3 | — | — | — | |
| AlignerModel=meta-llama/Llama-2-7b-chat-hf, Judge Model=gpt-4o2026.03 | 6.5 | 1.01 | 4.71 | — | 15.08 | 1.58 | 18.5 | 22.5 | 1.01 | 3.66 | — | — | — | |
| Semantic SmoothModel=Qwen-7B-chat2026.05 | 7.5 | 7.2 | 10 | — | 6.9 | — | — | — | — | — | — | — | 19.4 | |
| EvoDefenseModel=Qwen-7B-chat2026.05 | 8.1 | 2.5 | 0.6 | — | 6.9 | — | — | — | — | — | — | — | 4.4 | |
| RA-LLMModel=LLaMA3-8B-instruct2026.05 | 8.8 | 5.3 | 46.3 | — | 4.7 | — | — | — | — | — | — | — | 7.5 | |
| EvoDefenseModel=Mistral-7B-v0.22026.05 | 8.8 | 0.6 | 0.6 | — | 0.6 | — | — | — | — | — | — | — | 8.8 | |
| EvoDefenseModel=Vicuna-7B-v1.52026.05 | 9.1 | 1.6 | 0.9 | — | 9.1 | — | — | — | — | — | — | — | 4.4 | |
| EVA (text)Base Model=Vicuna-7B-v1.52026.05 | 10 | 11 | 4 | — | — | — | — | — | — | — | — | — | — | |
| SmoothLLMModel=GPT-5-chat2026.05 | 11.9 | — | — | — | 14.7 | — | — | — | — | — | — | — | 10.9 | |
| VanillaBase Model=Llama3.1-8B-Instruct2026.05 | 12 | 56 | 20 | — | — | — | — | — | — | — | — | — | — | |
| NoneModel=GPT-5-chat2026.05 | 13.1 | — | — | — | 15.6 | — | — | — | — | — | — | — | 10 | |
| SelfdefenseModel=LLaMA3-8B-instruct2026.05 | 13.8 | 10.9 | 37.8 | — | 12.5 | — | — | — | — | — | — | — | 17.2 | |
| IBProtectorModel=LLaMA3-8B-instruct2026.05 | 13.8 | 6.6 | 34.1 | — | 7.8 | — | — | — | — | — | — | — | 15 | |
| LoRABase Model=Llama3.1-8B-Instruct2026.05 | 14 | 41 | 27 | — | — | — | — | — | — | — | — | — | — | |
| EVA (text)Base Model=Mistral-7B-Instruct-v0.22026.05 | 15 | 6 | 8 | — | — | — | — | — | — | — | — | — | — | |
| SafeDecodingBase Model=Vicuna-7B-v1.52026.05 | 16 | 7 | 17 | — | — | — | — | — | — | — | — | — | — | |
| SmoothLLMModel=LLaMA3-8B-instruct2026.05 | 16.3 | 10.9 | 45.9 | — | 16.3 | — | — | — | — | — | — | — | 17.2 | |
| Circuit BreakersBase Model=Mistral-7B-Instruct-v0.22026.05 | 17 | 8 | 5 | — | — | — | — | — | — | — | — | — | — | |
| Semantic SmoothModel=Vicuna-7B-v1.52026.05 | 18.8 | 14.4 | 41.3 | — | 16.6 | — | — | — | — | — | — | — | 15.3 | |
| IBProtectorModel=Gemini-3-flash2026.05 | 18.8 | — | — | — | 16.6 | — | — | — | — | — | — | — | 13.8 | |
| LEDBase Model=Mistral-7B-Instruct-v0.22026.05 | 19 | 20 | 18 | — | — | — | — | — | — | — | — | — | — | |
| SafeDecodingBase Model=Mistral-7B-Instruct-v0.22026.05 | 20 | 16 | 15 | — | — | — | — | — | — | — | — | — | — | |
| Semantic SmoothModel=Gemini-3-flash2026.05 | 21.9 | — | — | — | 19.7 | — | — | — | — | — | — | — | 17.2 | |
| Semantic SmoothModel=Mistral-7B-v0.22026.05 | 23.1 | 17.8 | 37.8 | — | 25 | — | — | — | — | — | — | — | 31.6 | |
| SmoothLLMModel=Gemini-3-flash2026.05 | 23.8 | — | — | — | 20.9 | — | — | — | — | — | — | — | 22.8 | |
| IBProtectorModel=Qwen-7B-chat2026.05 | 24.1 | 26.9 | 40.6 | — | 29.1 | — | — | — | — | — | — | — | 23.8 | |
| SelfdefenseModel=Gemini-3-flash2026.05 | 24.4 | — | — | — | 22.2 | — | — | — | — | — | — | — | 20.6 | |
| SmoothLLMModel=meta-llama/Llama-2-7b-chat-hf, Judge Model=gpt-4o2026.03 | 24.5 | 4 | 10.5 | — | 35 | 3.12 | 22 | 6 | 0 | 9 | — | — | — | |
| RA-LLMModel=Vicuna-7B-v1.52026.05 | 25.9 | 18.8 | 48.8 | — | 26.3 | — | — | — | — | — | — | — | 8.4 | |
| LoRABase Model=Vicuna-7B-v1.52026.05 | 26 | 40 | 22 | — | — | — | — | — | — | — | — | — | — | |
| RA-LLMModel=Qwen-7B-chat2026.05 | 26.3 | 27.8 | 38.8 | — | 28.1 | — | — | — | — | — | — | — | 15.6 | |
| NoneModel=LLaMA3-8B-instruct2026.05 | 26.6 | 43.1 | 5 | — | 14.1 | — | — | — | — | — | — | — | 43.4 | |
| Self DefendModel=GPT-5-chat2026.05 | 30.3 | — | — | — | 35 | — | — | — | — | — | — | — | 65 | |
| NoneModel=Gemini-3-flash2026.05 | 30.6 | — | — | — | 29.1 | — | — | — | — | — | — | — | 29.4 | |
| Self DefenseModel=Qwen-7B-chat2026.05 | 31.9 | 44.7 | 40.6 | — | 38.8 | — | — | — | — | — | — | — | 31.6 | |
| LoRABase Model=Qwen2.5-7B-Instruct2026.05 | 32 | 21 | 65 | — | — | — | — | — | — | — | — | — | — | |
| SelfdefenseModel=Vicuna-7B-v1.52026.05 | 32.5 | 49.7 | 46.9 | — | 34.7 | — | — | — | — | — | — | — | 23.8 | |
| IBProtectorModel=Vicuna-7B-v1.52026.05 | 32.5 | 19.7 | 56.9 | — | 26.6 | — | — | — | — | — | — | — | 10.9 | |
| SelfdefenseModel=Mistral-7B-v0.22026.05 | 33.1 | 41.9 | 52.8 | — | 37.5 | — | — | — | — | — | — | — | 25.6 | |
| Smooth LLMModel=Qwen-7B-chat2026.05 | 34.4 | 31.9 | 49.4 | — | 35.9 | — | — | — | — | — | — | — | 28.4 | |
| RA-LLMModel=Mistral-7B-v0.22026.05 | 34.4 | 26.6 | 58.1 | — | 36.9 | — | — | — | — | — | — | — | 19.1 | |
| Self DefendModel=Qwen-7B-chat2026.05 | 34.7 | 32.5 | 11.9 | — | 29.7 | — | — | — | — | — | — | — | 65.9 | |
| Self DefendModel=Vicuna-7B-v1.52026.05 | 35.6 | 32.8 | 17.2 | — | 30.3 | — | — | — | — | — | — | — | 67.5 | |
| Self DefendModel=Mistral-7B-v0.22026.05 | 36.6 | 27.8 | 8.8 | — | 30.3 | — | — | — | — | — | — | — | 60.6 | |
| SmoothLLMModel=Mistral-7B-v0.22026.05 | 38.4 | 40.3 | 64.1 | — | 45 | — | — | — | — | — | — | — | 27.5 | |
| Self DefendModel=Gemini-3-flash2026.05 | 41.3 | — | — | — | 28.4 | — | — | — | — | — | — | — | 72.8 | |
| IBProtectorModel=Mistral-7B-v0.22026.05 | 41.6 | 28.1 | 68.8 | — | 45 | — | — | — | — | — | — | — | 37.8 | |
| NoneModel=Qwen-7B-chat2026.05 | 41.9 | 59.1 | 50.9 | — | 44.7 | — | — | — | — | — | — | — | 39.7 | |
| LoRABase Model=Mistral-7B-Instruct-v0.22026.05 | 42 | 35 | 55 | — | — | — | — | — | — | — | — | — | — | |
| SmoothLLMModel=Vicuna-7B-v1.52026.05 | 42.2 | 31.3 | 56.6 | — | 39.1 | — | — | — | — | — | — | — | 23.1 | |
| Self DefendModel=Claude-4.5-haiku2026.05 | 46.3 | — | — | — | 29.7 | — | — | — | — | — | — | — | 73.8 | |
| Self DefendModel=LLaMA3-8B-instruct2026.05 | 50.3 | 31.3 | 17.2 | — | 30.3 | — | — | — | — | — | — | — | 73.8 | |
| NoneModel=Mistral-7B-v0.22026.05 | 52.2 | 69.1 | 72.5 | — | 58.8 | — | — | — | — | — | — | — | 45.9 | |
| NoneModel=Vicuna-7B-v1.52026.05 | 53.8 | 66.9 | 67.2 | — | 50.9 | — | — | — | — | — | — | — | 40 | |
| SafeDecodingBase Model=Qwen2.5-7B-Instruct2026.05 | 56 | 19 | 77 | — | — | — | — | — | — | — | — | — | — | |
| VanillaBase Model=Qwen2.5-7B-Instruct2026.05 | 66 | 49 | 74 | — | — | — | — | — | — | — | — | — | — | |
| VanillaBase Model=Vicuna-7B-v1.52026.05 | 80 | 92 | 69 | — | — | — | — | — | — | — | — | — | — | |
| VanillaBase Model=Mistral-7B-Instruct-v0.22026.05 | 88 | 80 | 87 | — | — | — | — | — | — | — | — | — | — | |
| BaselineModel Configuration=BASE2026.04 | — | — | — | — | — | — | — | — | — | — | 55 | — | — | |
| Dream2025.09 | — | 0.25 | 0 | 0 | — | — | — | — | — | — | — | — | — | |
| Dream + DIFFUGUARDBase Model=Dream2025.09 | — | 0 | 0 | 0 | — | — | — | — | — | — | — | — | — | |
| LLaDA2025.09 | — | 7.94 | 20.84 | 50.37 | — | — | — | — | — | — | — | — | — | |
| LLaDA + DIFFUGUARDBase Model=LLaDA2025.09 | — | 2.48 | 17.37 | 14.39 | — | — | — | — | — | — | — | — | — | |
| SAE-augmented modelsModel Configuration=SAE2026.04 | — | — | — | — | — | — | — | — | — | — | 19.05 | 0.0087 | — |