Jailbreak Defense on Wild Jailbreak
0.1ASRDream + DIFFUGUARD
Evaluation Results
| Method | Links | |||
|---|---|---|---|---|
| Dream + DIFFUGUARDdefense=DIFFUGUARD2025.09 | 0.1 | — | — | |
| Dream2025.09 | 0.4 | — | — | |
| OursModel=GPT-4-0125 (2024)2023.11 | 0.5 | — | — | |
| Dream-v0-Instruct-7B + Self-reminder + DIFFUGUARDBase Model=Dream-v0-Instruct-7B, Defense Method=Self-reminder + DIFFUGUARD2025.09 | 1.05 | — | — | |
| Dream-v0-Instruct-7B + Self-reminderBase Model=Dream-v0-Instruct-7B, Defense Method=Self-reminder2025.09 | 1.7 | — | — | |
| Self-ReminderModel=GPT-4-0125 (2024)2023.11 | 2.3 | — | — | |
| Dream-v0-Instruct-7B + DIFFUGUARDBase Model=Dream-v0-Instruct-7B, Defense Method=DIFFUGUARD2025.09 | 2.35 | — | — | |
| LLaDA + DIFFUGUARDdefense=DIFFUGUARD2025.09 | 2.45 | — | — | |
| OursModel=GPT-4-0613 (2023)2023.11 | 3.1 | — | — | |
| Dream-v0-Instruct-7BBase Model=Dream-v0-Instruct-7B, Defense Method=None2025.09 | 3.3 | — | — | |
| Dream-v0-Instruct-7B + PPL-FilterBase Model=Dream-v0-Instruct-7B, Defense Method=PPL-Filter2025.09 | 3.3 | — | — | |
| OursModel=ChatGPT-0613 (2023)2023.11 | 3.6 | — | — | |
| OursModel=ChatGPT-0125 (2024)2023.11 | 3.6 | — | — | |
| Self-GuardModel Scale=Qwen3-14B2026.01 | 4.8 | — | — | |
| ReasoningGuardModel Scale=Qwen3-14B2026.01 | 4.9 | — | — | |
| Self-ReminderModel Scale=Qwen3-14B2026.01 | 6.3 | — | — | |
| Self-ReminderModel=GPT-4-0613 (2023)2023.11 | 7.2 | — | — | |
| LLaDA2025.09 | 7.75 | — | — | |
| Self-GuardModel Scale=Qwen3-8B2026.01 | 8 | — | — | |
| ReasoningGuardModel Scale=Qwen3-8B2026.01 | 8.5 | — | — | |
| LLaDA-8B-Instruct + Self-reminder + DIFFUGUARDBase Model=LLaDA-8B-Instruct, Defense Method=Self-reminder + DIFFUGUARD2025.09 | 8.5 | — | — | |
| STAR-1Model Scale=Qwen3-14B2026.01 | 8.9 | — | — | |
| SafeKeyModel Scale=Qwen3-14B2026.01 | 9.8 | — | — | |
| Self-ReminderModel Scale=Qwen3-8B2026.01 | 10.4 | — | — | |
| LLaDA-1.5 + Self-reminder + DIFFUGUARDBase Model=LLaDA-1.5, Defense Method=Self-reminder + DIFFUGUARD2025.09 | 10.95 | — | — | |
| VanillaModel=GPT-4-0125 (2024)2023.11 | 11.9 | — | — | |
| SafeKeyModel Scale=Qwen3-8B2026.01 | 12.3 | — | — | |
| LLaDA-1.5 + Self-reminderBase Model=LLaDA-1.5, Defense Method=Self-reminder2025.09 | 12.65 | — | — | |
| Self-GuardModel Scale=Qwen3-4B2026.01 | 12.9 | — | — | |
| ReasoningGuardModel Scale=Qwen3-4B2026.01 | 13 | — | — | |
| STAR-1Model Scale=Qwen3-8B2026.01 | 13 | — | — | |
| PreSafeBase Model=Qwen-34B2026.03 | 14 | — | — | |
| MMaDA-8B-MixCoT + Self-reminder + DIFFUGUARDBase Model=MMaDA-8B-MixCoT, Defense Method=Self-reminder + DIFFUGUARD2025.09 | 14.25 | — | — | |
| SafeKeyModel Scale=Qwen3-4B2026.01 | 14.5 | — | — | |
| STAR-1Model Scale=Qwen3-4B2026.01 | 15.4 | — | — | |
| LLaDA-8B-Instruct + Self-reminderBase Model=LLaDA-8B-Instruct, Defense Method=Self-reminder2025.09 | 16 | — | — | |
| Self-ReminderModel Scale=Qwen3-4B2026.01 | 16.9 | — | — | |
| MMaDA-8B-MixCoT + Self-reminderBase Model=MMaDA-8B-MixCoT, Defense Method=Self-reminder2025.09 | 18.3 | — | — | |
| PreSafeBase Model=DS-R1-7B2026.03 | 18.8 | — | — | |
| PreSafeBase Model=Qwen-8B2026.03 | 18.8 | — | — | |
| PreSafeBase Model=DS-R1-14B2026.03 | 19.2 | — | — | |
| Self-ReminderModel=ChatGPT-0125 (2024)2023.11 | 20.2 | — | — | |
| LLaDA-8B-Instruct + DIFFUGUARDBase Model=LLaDA-8B-Instruct, Defense Method=DIFFUGUARD2025.09 | 21 | — | — | |
| LLaDA-8B-Instruct + PPL-FilterBase Model=LLaDA-8B-Instruct, Defense Method=PPL-Filter2025.09 | 22.75 | — | — | |
| PreSafeBase Model=DS-R1-8B2026.03 | 22.8 | — | — | |
| LLaDA-8B-InstructBase Model=LLaDA-8B-Instruct, Defense Method=None2025.09 | 23.95 | — | — | |
| LLaDA-1.5 + DIFFUGUARDBase Model=LLaDA-1.5, Defense Method=DIFFUGUARD2025.09 | 24.65 | — | — | |
| PreSafeBase Model=Skywork-7B2026.03 | 24.8 | — | — | |
| Erase And CheckBase Model=DS-R1-8B2026.03 | 25.2 | — | — | |
| Erase And CheckBase Model=DS-R1-7B2026.03 | 25.6 | — | — | |
| Perplexity FilterBase Model=Qwen-8B2026.03 | 26 | — | — | |
| Erase And CheckBase Model=Skywork-7B2026.03 | 26 | — | — | |
| LLaDA-1.5 + PPL-FilterBase Model=LLaDA-1.5, Defense Method=PPL-Filter2025.09 | 26.15 | — | — | |
| Erase And CheckBase Model=Qwen-8B2026.03 | 26.4 | — | — | |
| Erase And CheckBase Model=Qwen-34B2026.03 | 27.2 | — | — | |
| LLaDA-1.5Base Model=LLaDA-1.5, Defense Method=None2025.09 | 27.4 | — | — | |
| Alpha-steerModel Scale=Qwen3-14B2026.01 | 27.7 | — | — | |
| Self-ReminderModel=ChatGPT-0613 (2023)2023.11 | 28.1 | — | — | |
| Erase And CheckBase Model=DS-R1-14B2026.03 | 30.4 | — | — | |
| R2DBase Model=Qwen-8B2026.03 | 32.6 | — | — | |
| InstructModel Scale=Qwen3-14B2026.01 | 33.1 | — | — | |
| SafeChainModel Scale=Qwen3-4B2026.01 | 33.9 | — | — | |
| SafeChainModel Scale=Qwen3-8B2026.01 | 34.4 | — | — | |
| SafeChainModel Scale=Qwen3-14B2026.01 | 34.4 | — | — | |
| SafeChainBase Model=Skywork-7B2026.03 | 36.8 | — | — | |
| InstructModel Scale=Qwen3-8B2026.01 | 40.3 | — | — | |
| SafeChainBase Model=DS-R1-8B2026.03 | 40.4 | — | — | |
| SafeChainBase Model=Qwen-8B2026.03 | 42 | — | — | |
| SafeChainBase Model=DS-R1-14B2026.03 | 42.8 | — | — | |
| R2DBase Model=DS-R1-14B2026.03 | 42.9 | — | — | |
| Alpha-steerModel Scale=Qwen3-4B2026.01 | 43.9 | — | — | |
| InstructModel Scale=Qwen3-4B2026.01 | 44.3 | — | — | |
| Alpha-steerModel Scale=Qwen3-8B2026.01 | 44.6 | — | — | |
| Perplexity FilterBase Model=DS-R1-14B2026.03 | 46 | — | — | |
| SafeChainBase Model=Qwen-34B2026.03 | 46 | — | — | |
| SafeChainBase Model=DS-R1-7B2026.03 | 48 | — | — | |
| VanillaModel=GPT-4-0613 (2023)2023.11 | 48.3 | — | — | |
| Smooth LLMBase Model=Qwen-8B2026.03 | 49.6 | — | — | |
| Remove Non DictionaryBase Model=Qwen-8B2026.03 | 49.6 | — | — | |
| Smooth LLMBase Model=DS-R1-14B2026.03 | 50.4 | — | — | |
| NoneBase Model=Qwen-8B2026.03 | 51.2 | — | — | |
| VanillaModel=ChatGPT-0125 (2024)2023.11 | 52.1 | — | — | |
| Remove Non DictionaryBase Model=Qwen-34B2026.03 | 52.8 | — | — | |
| R2DBase Model=Qwen-34B2026.03 | 52.8 | — | — | |
| Remove Non DictionaryBase Model=DS-R1-14B2026.03 | 53.6 | — | — | |
| Perplexity FilterBase Model=Qwen-34B2026.03 | 53.6 | — | — | |
| NoneBase Model=DS-R1-14B2026.03 | 54 | — | — | |
| NoneBase Model=Qwen-34B2026.03 | 54 | — | — | |
| Synonym SubstitutionBase Model=DS-R1-14B2026.03 | 55.6 | — | — | |
| Remove Non DictionaryBase Model=DS-R1-8B2026.03 | 57.2 | — | — | |
| Smooth LLMBase Model=DS-R1-8B2026.03 | 57.6 | — | — | |
| Synonym SubstitutionBase Model=Qwen-8B2026.03 | 58.4 | — | — | |
| NoneBase Model=DS-R1-8B2026.03 | 59.2 | — | — | |
| Smooth LLMBase Model=Qwen-34B2026.03 | 59.6 | — | — | |
| MMaDA-8B-MixCoT + PPL-FilterBase Model=MMaDA-8B-MixCoT, Defense Method=PPL-Filter2025.09 | 59.85 | — | — | |
| R2DBase Model=Skywork-7B2026.03 | 60.2 | — | — | |
| Synonym SubstitutionBase Model=Qwen-34B2026.03 | 60.8 | — | — | |
| Remove Non DictionaryBase Model=Skywork-7B2026.03 | 60.8 | — | — | |
| Synonym SubstitutionBase Model=DS-R1-8B2026.03 | 61.2 | — | — | |
| MMaDA-8B-MixCoT + DIFFUGUARDBase Model=MMaDA-8B-MixCoT, Defense Method=DIFFUGUARD2025.09 | 61.55 | — | — |