Jailbreak Defense on jailbreak defense dataset
0ASRGradient-guided Token Masking
Evaluation results
| Method | Links | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Gradient-guided Token Maskingε (perturbation limit)=162026.05 | 0 | — | — | — | — | — | — | — | — | |
| Gradient-guided Token Maskingε (perturbation limit)=642026.05 | 0 | — | — | — | — | — | — | — | — | |
| GUARDε (perturbation limit)=162026.05 | 0.91 | — | — | — | — | — | — | — | — | |
| GUARDε (perturbation limit)=642026.05 | 0.91 | — | — | — | — | — | — | — | — | |
| GUARDε (perturbation limit)=∞2026.05 | 0.91 | — | — | — | — | — | — | — | — | |
| Gradient-guided Token Maskingε (perturbation limit)=322026.05 | 0.91 | — | — | — | — | — | — | — | — | |
| Gradient-guided Token Maskingε (perturbation limit)=∞2026.05 | 0.91 | — | — | — | — | — | — | — | — | |
| GUARDε (perturbation limit)=322026.05 | 1.82 | — | — | — | — | — | — | — | — | |
| ECSOε (perturbation limit)=162026.05 | 6.36 | — | — | — | — | — | — | — | — | |
| ECSOε (perturbation limit)=322026.05 | 9.09 | — | — | — | — | — | — | — | — | |
| ECSOε (perturbation limit)=642026.05 | 10 | — | — | — | — | — | — | — | — | |
| CIDERε (perturbation limit)=642026.05 | 10.9 | — | — | — | — | — | — | — | — | |
| ECSOε (perturbation limit)=∞2026.05 | 13.63 | — | — | — | — | — | — | — | — | |
| ASTRAε (perturbation limit)=162026.05 | 13.64 | — | — | — | — | — | — | — | — | |
| ASTRAε (perturbation limit)=322026.05 | 15.45 | — | — | — | — | — | — | — | — | |
| CIDERε (perturbation limit)=322026.05 | 17.27 | — | — | — | — | — | — | — | — | |
| ASTRAε (perturbation limit)=∞2026.05 | 20 | — | — | — | — | — | — | — | — | |
| CIDERε (perturbation limit)=162026.05 | 20.91 | — | — | — | — | — | — | — | — | |
| ASTRAε (perturbation limit)=642026.05 | 31.81 | — | — | — | — | — | — | — | — | |
| W/O DEFENSEε (perturbation limit)=642026.05 | 68.18 | — | — | — | — | — | — | — | — | |
| W/O DEFENSEε (perturbation limit)=162026.05 | 78.18 | — | — | — | — | — | — | — | — | |
| W/O DEFENSEε (perturbation limit)=322026.05 | 82.73 | — | — | — | — | — | — | — | — | |
| CIDERε (perturbation limit)=∞2026.05 | 94.55 | — | — | — | — | — | — | — | — | |
| W/O DEFENSEε (perturbation limit)=∞2026.05 | 97.27 | — | — | — | — | — | — | — | — | |
| AlphaSteerBase Model=Llama-3.1-8B-Instruct, Defense Method=AlphaSteer2026.04 | — | 100 | 96 | 59 | 97 | 89 | 98 | 100 | 91.29 | |
| AlphaSteerBase Model=Qwen2.5-7B-Instruct, Defense Method=AlphaSteer2026.04 | — | 100 | 100 | 97 | 97 | 95 | 95 | 98 | 97.43 | |
| BiPOBase Model=Llama-3.1-8B-Instruct, Defense Method=BiPO2026.04 | — | 100 | 100 | 100 | 100 | 94 | 99 | 100 | 99 | |
| BiPOBase Model=Qwen2.5-7B-Instruct, Defense Method=BiPO2026.04 | — | 100 | 100 | 100 | 100 | 99 | 99 | 100 | 99.71 | |
| CASTBase Model=Llama-3.1-8B-Instruct, Defense Method=CAST2026.04 | — | 92 | 51 | 67 | 99 | 81 | 96 | 96 | 83.14 | |
| CASTBase Model=Qwen2.5-7B-Instruct, Defense Method=CAST2026.04 | — | 25 | 27 | 33 | 96 | 91 | 99 | 100 | 67.29 | |
| FineSteerBase Model=Llama-3.1-8B-Instruct, Defense Method=FineSteer2026.04 | — | 100 | 100 | 93 | 100 | 95 | 100 | 99 | 98.14 | |
| FineSteerBase Model=Qwen2.5-7B-Instruct, Defense Method=FineSteer2026.04 | — | 100 | 100 | 98 | 100 | 97 | 100 | 100 | 99.28 | |
| Jailbreak AntidoteBase Model=Llama-3.1-8B-Instruct, Defense Method=Jailbreak Antidote2026.04 | — | 100 | 97 | 0 | 100 | 86 | 93 | 63 | 77 | |
| Jailbreak AntidoteBase Model=Qwen2.5-7B-Instruct, Defense Method=Jailbreak Antidote2026.04 | — | 91 | 4 | 26 | 90 | 5 | 41 | 73 | 47.14 | |
| Llama-3.1-8B-InstructBase Model=Llama-3.1-8B-Instruct, Defense Method=None2026.04 | — | 92 | 48 | 0 | 58 | 75 | 45 | 28 | 49.43 | |
| Qwen2.5-7B-InstructBase Model=Qwen2.5-7B-Instruct, Defense Method=None2026.04 | — | 25 | 2 | 1 | 22 | 71 | 19 | 4 | 20.57 | |
| SurgicalBase Model=Llama-3.1-8B-Instruct, Defense Method=Surgical2026.04 | — | 100 | 76 | 61 | 98 | 88 | 90 | 67 | 82.86 | |
| SurgicalBase Model=Qwen2.5-7B-Instruct, Defense Method=Surgical2026.04 | — | 77 | 81 | 67 | 100 | 79 | 88 | 70 | 71.71 | |
| TruthFlowBase Model=Llama-3.1-8B-Instruct, Defense Method=TruthFlow2026.04 | — | 96 | 90 | 47 | 98 | 86 | 91 | 73 | 83 | |
| TruthFlowBase Model=Qwen2.5-7B-Instruct, Defense Method=TruthFlow2026.04 | — | 99 | 100 | 90 | 100 | 97 | 100 | 99 | 97.85 |