Jailbreak Defense on StrongReject
1.5Attack Success RateR2D
Evaluation results
| Method | Links | |||||
|---|---|---|---|---|---|---|
| R2DBase Model=Qwen-8B2026.03 | 1.5 | — | — | — | — | |
| PreSafeBase Model=Qwen-34B2026.03 | 2.9 | — | — | — | — | |
| PreSafeBase Model=Qwen-8B2026.03 | 4.5 | — | — | — | — | |
| PreSafeBase Model=DS-R1-14B2026.03 | 4.8 | — | — | — | — | |
| PreSafeBase Model=DS-R1-7B2026.03 | 5.4 | — | — | — | — | |
| R2DBase Model=DS-R1-14B2026.03 | 5.8 | — | — | — | — | |
| PreSafeBase Model=Skywork-7B2026.03 | 7 | — | — | — | — | |
| PreSafeBase Model=DS-R1-8B2026.03 | 7.1 | — | — | — | — | |
| R2DBase Model=DS-R1-8B2026.03 | 8.1 | — | — | — | — | |
| Perplexity FilterBase Model=Qwen-8B2026.03 | 8.4 | — | — | — | — | |
| R2DBase Model=Qwen-34B2026.03 | 9.4 | — | — | — | — | |
| R2DBase Model=Skywork-7B2026.03 | 16 | — | — | — | — | |
| R2DBase Model=DS-R1-7B2026.03 | 16.3 | — | — | — | — | |
| Erase And CheckBase Model=DS-R1-7B2026.03 | 18.8 | — | — | — | — | |
| Erase And CheckBase Model=DS-R1-14B2026.03 | 19.9 | — | — | — | — | |
| Erase And CheckBase Model=DS-R1-8B2026.03 | 20.4 | — | — | — | — | |
| Erase And CheckBase Model=Qwen-34B2026.03 | 21.1 | — | — | — | — | |
| Erase And CheckBase Model=Skywork-7B2026.03 | 21.2 | — | — | — | — | |
| Erase And CheckBase Model=Qwen-8B2026.03 | 22.1 | — | — | — | — | |
| Remove Non DictionaryBase Model=Qwen-8B2026.03 | 22.4 | — | — | — | — | |
| Perplexity FilterBase Model=Qwen-34B2026.03 | 24.4 | — | — | — | — | |
| Smooth LLMBase Model=Qwen-8B2026.03 | 24.4 | — | — | — | — | |
| NoneBase Model=Qwen-34B2026.03 | 26 | — | — | — | — | |
| NoneBase Model=Qwen-8B2026.03 | 26.4 | — | — | — | — | |
| Remove Non DictionaryBase Model=Qwen-34B2026.03 | 26.9 | — | — | — | — | |
| Smooth LLMBase Model=Qwen-34B2026.03 | 31.4 | — | — | — | — | |
| Synonym SubstitutionBase Model=Qwen-8B2026.03 | 37.5 | — | — | — | — | |
| SafeChainBase Model=DS-R1-8B2026.03 | 38.8 | — | — | — | — | |
| Perplexity FilterBase Model=DS-R1-14B2026.03 | 39.1 | — | — | — | — | |
| SafeChainBase Model=Qwen-8B2026.03 | 40.7 | — | — | — | — | |
| Smooth LLMBase Model=DS-R1-14B2026.03 | 41.3 | — | — | — | — | |
| Synonym SubstitutionBase Model=DS-R1-14B2026.03 | 43.6 | — | — | — | — | |
| Smooth LLMBase Model=DS-R1-8B2026.03 | 43.9 | — | — | — | — | |
| Synonym SubstitutionBase Model=DS-R1-8B2026.03 | 44.9 | — | — | — | — | |
| SafeChainBase Model=DS-R1-7B2026.03 | 45.2 | — | — | — | — | |
| Synonym SubstitutionBase Model=Qwen-34B2026.03 | 46.6 | — | — | — | — | |
| Remove Non DictionaryBase Model=DS-R1-14B2026.03 | 46.9 | — | — | — | — | |
| SafeChainBase Model=DS-R1-14B2026.03 | 47.1 | — | — | — | — | |
| SafeChainBase Model=Skywork-7B2026.03 | 48.7 | — | — | — | — | |
| Smooth LLMBase Model=DS-R1-7B2026.03 | 48.9 | — | — | — | — | |
| NoneBase Model=DS-R1-14B2026.03 | 50.6 | — | — | — | — | |
| Perplexity FilterBase Model=DS-R1-8B2026.03 | 51.3 | — | — | — | — | |
| SafeChainBase Model=Qwen-34B2026.03 | 51.6 | — | — | — | — | |
| Remove Non DictionaryBase Model=DS-R1-8B2026.03 | 52.2 | — | — | — | — | |
| Synonym SubstitutionBase Model=DS-R1-7B2026.03 | 52.9 | — | — | — | — | |
| NoneBase Model=DS-R1-8B2026.03 | 52.9 | — | — | — | — | |
| Smooth LLMBase Model=Skywork-7B2026.03 | 55.8 | — | — | — | — | |
| Perplexity FilterBase Model=Skywork-7B2026.03 | 59.9 | — | — | — | — | |
| Remove Non DictionaryBase Model=DS-R1-7B2026.03 | 62.2 | — | — | — | — | |
| Synonym SubstitutionBase Model=Skywork-7B2026.03 | 63.2 | — | — | — | — | |
| Perplexity FilterBase Model=DS-R1-7B2026.03 | 64.7 | — | — | — | — | |
| NoneBase Model=DS-R1-7B2026.03 | 66 | — | — | — | — | |
| NoneBase Model=Skywork-7B2026.03 | 67 | — | — | — | — | |
| Remove Non DictionaryBase Model=Skywork-7B2026.03 | 67.6 | — | — | — | — | |
| DefaultSystemLLM=zephyr-7b-beta2025.06 | — | 6.67 | 31.91 | 25.24 | — | |
| DefaultSystemLLM=Llama-2-7b-chat2025.06 | — | 66.67 | 98.94 | 32.27 | — | |
| DefaultSystemLLM=Llama-3.1-8b2025.06 | — | 30 | 100 | 70 | — | |
| DefaultSystemLLM=Phi-3.5-mini2025.06 | — | 3.33 | 21.28 | 17.95 | — | |
| DefaultSystemLLM=Mistral-7B-v0.22025.06 | — | 13.33 | 93.62 | 80.29 | — | |
| KLAlignment Strategy=Deliberative Alignment (GRPO)2026.04 | — | — | — | — | 24.8 | |
| Latent Similarity- Best LayerAlignment Strategy=Deliberative Alignment (GRPO)2026.04 | — | — | — | — | 75 | |
| Latent Similarity- Layer 12Alignment Strategy=Deliberative Alignment (GRPO)2026.04 | — | — | — | — | 48 | |
| LoRA*LLM=zephyr-7b-beta2025.06 | — | 20 | 92.55 | 72.55 | — | |
| LoRA*LLM=Llama-2-7b-chat2025.06 | — | 10 | 100 | 90 | — | |
| LoRA*LLM=Llama-3.1-8b2025.06 | — | 0 | 100 | 100 | — | |
| LoRA*LLM=Phi-3.5-mini2025.06 | — | 6.67 | 48.94 | 42.27 | — | |
| LoRA*LLM=Mistral-7B-v0.22025.06 | — | 10 | 100 | 90 | — | |
| PerplexityAlignment Strategy=Deliberative Alignment (GRPO)2026.04 | — | — | — | — | -40.1 | |
| RandomAlignment Strategy=Deliberative Alignment (GRPO)2026.04 | — | — | — | — | 3.5 | |
| Self CertaintyAlignment Strategy=Deliberative Alignment (GRPO)2026.04 | — | — | — | — | -146.4 | |
| SysformerLLM=zephyr-7b-beta2025.06 | — | 13.33 | 75.53 | 62.2 | — | |
| SysformerLLM=Llama-2-7b-chat2025.06 | — | 3.33 | 80.85 | 77.52 | — | |
| SysformerLLM=Llama-3.1-8b2025.06 | — | 3.33 | 100 | 96.67 | — | |
| SysformerLLM=Phi-3.5-mini2025.06 | — | 6.67 | 58.51 | 51.84 | — | |
| SysformerLLM=Mistral-7B-v0.22025.06 | — | 10 | 100 | 90 | — | |
| SystemEmbedderLLM=zephyr-7b-beta2025.06 | — | 6.67 | 34.04 | 27.37 | — | |
| SystemEmbedderLLM=Llama-2-7b-chat2025.06 | — | 6.67 | 40 | 33.33 | — | |
| SystemEmbedderLLM=Llama-3.1-8b2025.06 | — | 30 | 100 | 70 | — | |
| SystemEmbedderLLM=Phi-3.5-mini2025.06 | — | 6.67 | 26.6 | 19.93 | — | |
| SystemEmbedderLLM=Mistral-7B-v0.22025.06 | — | 13.33 | 93.62 | 80.29 | — |