Jailbreak Evaluation on WildJailbreak
98.5Performance RateLLM w/o cascade
Evaluation results
| Method | Links | |||||||
|---|---|---|---|---|---|---|---|---|
| LLM w/o cascadeCascade system=Qwen2.5 + BERT-base + Mistral-7B + BERT-base + Phi-3.5-MoE2026.05 | 98.5 | 40.04 | 3.49 | 100 | 100 | — | — | |
| LLM w/o cascadeCascade System=Qwen2.5-3B + DistilBERT-base + Phi-3.5-MoE 16x3.8B2026.05 | 98.5 | 40.04 | 3.49 | — | — | 100 | — | |
| InitialCascade system=Qwen2.5 + BERT-base + Mistral-7B + BERT-base + Phi-3.5-MoE2026.05 | 98 | 20.73 | 2.11 | 58 | 34 | — | — | |
| InitialCascade System=Qwen2.5-3B + DistilBERT-base + Phi-3.5-MoE 16x3.8B2026.05 | 97 | 24.8 | 2.39 | — | — | 67 | — | |
| Joint-target attackCascade system=Qwen2.5 + BERT-base + Mistral-7B + BERT-base + Phi-3.5-MoE, Setting=P=12026.05 | 88.5 | 39.17 | 3.04 | 88.5 | 37 | — | — | |
| Joint-target attackCascade System=Qwen2.5-3B + DistilBERT-base + Phi-3.5-MoE 16x3.8B, Setting=P=12026.05 | 86.5 | 37.44 | 3.18 | — | — | 91.5 | — | |
| Random noiseCascade System=Qwen2.5-3B + DistilBERT-base + Phi-3.5-MoE 16x3.8B2026.05 | 84.5 | 28.97 | 2.54 | — | — | 77.5 | — | |
| Random noiseCascade system=Qwen2.5 + BERT-base + Mistral-7B + BERT-base + Phi-3.5-MoE2026.05 | 82 | 23.85 | 2.24 | 61.5 | 11.5 | — | — | |
| Single-target attackCascade System=Qwen2.5-3B + DistilBERT-base + Phi-3.5-MoE 16x3.8B, Setting=SLM only2026.05 | 81 | 29.63 | 2.67 | — | — | 78.5 | — | |
| Single-target attackCascade system=Qwen2.5 + BERT-base + Mistral-7B + BERT-base + Phi-3.5-MoE, Setting=SLM only2026.05 | 79 | 30.12 | 2.55 | 61.5 | 37.5 | — | — | |
| Joint-target attackCascade system=Qwen2.5 + BERT-base + Mistral-7B + BERT-base + Phi-3.5-MoE, Setting=P=0.82026.05 | 74.5 | 32.04 | 2.62 | 74 | 33.5 | — | — | |
| Joint-target attackCascade System=Qwen2.5-3B + DistilBERT-base + Phi-3.5-MoE 16x3.8B, Setting=P=0.82026.05 | 73 | 30.98 | 2.71 | — | — | 79 | — | |
| Single-target attackCascade System=Qwen2.5-3B + DistilBERT-base + Phi-3.5-MoE 16x3.8B, Setting=DM only2026.05 | 66 | 19.27 | 2.16 | — | — | 53 | — | |
| Single-target attackCascade system=Qwen2.5 + BERT-base + Mistral-7B + BERT-base + Phi-3.5-MoE, Setting=DM only2026.05 | 64 | 17.8 | 1.94 | 46.5 | 14 | — | — | |
| Joint-target attackCascade system=Qwen2.5 + BERT-base + Mistral-7B + BERT-base + Phi-3.5-MoE, Setting=P=0.62026.05 | 61.5 | 26.55 | 2.44 | 66 | 27 | — | — | |
| Joint-target attackCascade System=Qwen2.5-3B + DistilBERT-base + Phi-3.5-MoE 16x3.8B, Setting=P=0.62026.05 | 58.5 | 25.12 | 2.44 | — | — | 67.5 | — | |
| Joint-target attackCascade system=Qwen2.5 + BERT-base + Mistral-7B + BERT-base + Phi-3.5-MoE, Setting=P=0.42026.05 | 50 | 20.94 | 1.94 | 54 | 30.5 | — | — | |
| Joint-target attackCascade System=Qwen2.5-3B + DistilBERT-base + Phi-3.5-MoE 16x3.8B, Setting=P=0.42026.05 | 47.5 | 19.89 | 2.08 | — | — | 54.5 | — | |
| Joint-target attackCascade system=Qwen2.5 + BERT-base + Mistral-7B + BERT-base + Phi-3.5-MoE, Setting=P=0.22026.05 | 41.5 | 13.8 | 1.68 | 43.5 | 20.5 | — | — | |
| Joint-target attackCascade System=Qwen2.5-3B + DistilBERT-base + Phi-3.5-MoE 16x3.8B, Setting=P=0.22026.05 | 38.5 | 13.7 | 1.69 | — | — | 38.5 | — | |
| Joint-target attackCascade system=Qwen2.5 + BERT-base + Mistral-7B + BERT-base + Phi-3.5-MoE, Setting=P=02026.05 | 31 | 7.91 | 1.22 | 28.5 | 16 | — | — | |
| Joint-target attackCascade System=Qwen2.5-3B + DistilBERT-base + Phi-3.5-MoE 16x3.8B, Setting=P=02026.05 | 18 | 6.43 | 1.11 | — | — | 22.5 | — | |
| BaseBackbone=Qwen3-4B2026.06 | — | — | — | — | — | — | 69.46 | |
| ICLBackbone=Qwen3-4B2026.06 | — | — | — | — | — | — | 21.09 | |
| PolicyAlignBackbone=Qwen3-4B2026.06 | — | — | — | — | — | — | 8.51 | |
| SFTBackbone=Qwen3-4B2026.06 | — | — | — | — | — | — | 9.73 |