Jailbreak on HarmBench
1.01Toxicity ScoreFigStep
Evaluation results
| Method | Links | ||||||
|---|---|---|---|---|---|---|---|
| FigStepVictim Model=GPT-5.4-mini2026.05 | 1.01 | 0.61 | 0.27 | 0.53 | — | — | |
| HADESVictim Model=Claude Haiku 4.52026.05 | 1.01 | 0.06 | 0.67 | 1.47 | — | — | |
| FlipAttackVictim Model=Claude Haiku 4.52026.05 | 1.01 | 0.11 | 0.53 | 1.07 | — | — | |
| HADESVictim Model=GPT-5.4-mini2026.05 | 1.02 | 0.49 | 0.67 | 1.73 | — | — | |
| FigStepVictim Model=Claude Haiku 4.52026.05 | 1.03 | 0.08 | 0.53 | 1.33 | — | — | |
| FlipAttackVictim Model=GPT-5.4-mini2026.05 | 1.04 | 0.66 | 0.53 | 1.87 | — | — | |
| HADESVictim Model=GPT-5.4-nano2026.05 | 1.05 | 0.88 | 1.33 | 1.73 | — | — | |
| SIVictim Model=GPT-5.4-nano2026.05 | 1.05 | 0.89 | 1.2 | 1.92 | — | — | |
| SIVictim Model=Claude Haiku 4.52026.05 | 1.05 | 0.2 | 1.28 | 1.84 | — | — | |
| SIVictim Model=GPT-5.4-mini2026.05 | 1.06 | 0.54 | 1.84 | 2.32 | — | — | |
| FigStepVictim Model=GPT-5.4-nano2026.05 | 1.11 | 1.23 | 3.2 | 3.33 | — | — | |
| FlipAttackVictim Model=GPT-5.4-nano2026.05 | 1.16 | 0.72 | 4.8 | 5.6 | — | — | |
| TxtV-GDIVictim Model=Claude Haiku 4.52026.05 | 1.22 | 0.54 | 5.79 | 6.45 | — | — | |
| CS-DJVictim Model=Claude Haiku 4.52026.05 | 1.28 | 0.8 | 6.8 | 5.73 | — | — | |
| CS-DJVictim Model=GPT-5.4-mini2026.05 | 1.4 | 1.83 | 11.2 | 7.6 | — | — | |
| TxtVVictim Model=Claude Haiku 4.52026.05 | 1.4 | 0.99 | 10.59 | 10.11 | — | — | |
| TTV-GDIVictim Model=Claude Haiku 4.52026.05 | 1.54 | 1.28 | 14.48 | 14.13 | — | — | |
| TxtVVictim Model=GPT-5.4-nano2026.05 | 1.61 | 1.78 | 16.24 | 11.25 | — | — | |
| TypVVictim Model=Claude Haiku 4.52026.05 | 1.65 | 1.48 | 17.6 | 18.21 | — | — | |
| TTVVictim Model=Claude Haiku 4.52026.05 | 1.65 | 1.52 | 17.15 | 17.12 | — | — | |
| CS-DJVictim Model=GPT-5.4-nano2026.05 | 1.86 | 2.75 | 25.73 | 14.4 | — | — | |
| SIVictim Model=Gemini-2.5-Flash2026.05 | 1.92 | 2.01 | 23.07 | 23.31 | — | — | |
| TxtV-GDIVictim Model=GPT-5.4-mini2026.05 | 1.98 | 2.24 | 24.96 | 24.37 | — | — | |
| TypVVictim Model=GPT-5.4-mini2026.05 | 1.99 | 2.63 | 26.11 | 24.88 | — | — | |
| TypVVictim Model=GPT-5.4-nano2026.05 | 2 | 2.49 | 26.27 | 21.18 | — | — | |
| TxtVVictim Model=GPT-5.4-mini2026.05 | 2.16 | 2.74 | 30.72 | 29.06 | — | — | |
| HADESVictim Model=Gemini-2.5-Flash2026.05 | 2.18 | 2.68 | 31.33 | 27.33 | — | — | |
| TxtV-GDIVictim Model=GPT-5.4-nano2026.05 | 2.28 | 3.14 | 33.57 | 25.76 | — | — | |
| TTVVictim Model=GPT-5.4-mini2026.05 | 2.31 | 3.01 | 34.26 | 33.12 | — | — | |
| TTVVictim Model=GPT-5.4-nano2026.05 | 2.33 | 3.18 | 34.96 | 30.06 | — | — | |
| TTV-GDIVictim Model=GPT-5.4-nano2026.05 | 2.55 | 3.72 | 40.29 | 34.21 | — | — | |
| TTV-GDIVictim Model=GPT-5.4-mini2026.05 | 2.61 | 3.47 | 41.94 | 41.41 | — | — | |
| HADESVictim Model=Gemini-3.1-Flash-Lite2026.05 | 2.75 | 3.96 | 45.87 | 42.13 | — | — | |
| FigStepVictim Model=Gemini-3.1-Flash-Lite2026.05 | 2.92 | 4.15 | 50.13 | 49.2 | — | — | |
| SIVictim Model=Gemini-3.1-Flash-Lite2026.05 | 3.14 | 4.87 | 55.81 | 43.65 | — | — | |
| CS-DJVictim Model=Gemini-3.1-Flash-Lite2026.05 | 3.46 | 5.7 | 64.27 | 37.07 | — | — | |
| CS-DJVictim Model=Gemini-2.5-Flash2026.05 | 3.71 | 6.14 | 75.2 | 44.93 | — | — | |
| TTVVictim Model=Gemini-2.5-Flash2026.05 | 4.03 | 6.87 | 78.19 | 70.72 | — | — | |
| TypVVictim Model=Gemini-3.1-Flash-Lite2026.05 | 4.12 | 7.12 | 80.59 | 77.89 | — | — | |
| TypVVictim Model=Gemini-2.5-Flash2026.05 | 4.13 | 7.01 | 80.24 | 74.96 | — | — | |
| TTVVictim Model=Gemini-3.1-Flash-Lite2026.05 | 4.25 | 7.31 | 82.91 | 81.06 | — | — | |
| TTV-GDIVictim Model=Gemini-2.5-Flash2026.05 | 4.27 | 7.35 | 84.03 | 75.65 | — | — | |
| TxtV-GDIVictim Model=Gemini-2.5-Flash2026.05 | 4.34 | 7.71 | 85.95 | 74.56 | — | — | |
| TTV-GDIVictim Model=Gemini-3.1-Flash-Lite2026.05 | 4.34 | 7.51 | 85.73 | 83.01 | — | — | |
| TxtVVictim Model=Gemini-2.5-Flash2026.05 | 4.36 | 7.64 | 85.87 | 80.77 | — | — | |
| TxtV-GDIVictim Model=Gemini-3.1-Flash-Lite2026.05 | 4.44 | 7.66 | 88.48 | 85.55 | — | — | |
| FigStepVictim Model=Gemini-2.5-Flash2026.05 | 4.49 | 7.71 | 89.2 | 88.27 | — | — | |
| TxtVVictim Model=Gemini-3.1-Flash-Lite2026.05 | 4.58 | 7.99 | 91.33 | 89.47 | — | — | |
| FlipAttackVictim Model=Gemini-3.1-Flash-Lite2026.05 | 4.72 | 8.52 | 94.53 | 93.2 | — | — | |
| FlipAttackVictim Model=Gemini-2.5-Flash2026.05 | 4.78 | 8.79 | 95.07 | 83.07 | — | — | |
| AGRTarget Model=Qwen3-1.7B2026.05 | — | — | — | — | 96 | 94 | |
| AGRTarget Model=Qwen3-8B2026.05 | — | — | — | — | 96 | 96.7 | |
| AGRTarget Model=DS-R1-Distill-Llama-8B2026.05 | — | — | — | — | 98 | 97.3 | |
| AutoDANTarget Model=Qwen3-1.7B2026.05 | — | — | — | — | 42.7 | 41.3 | |
| AutoDANTarget Model=Qwen3-8B2026.05 | — | — | — | — | 37.3 | 36 | |
| AutoDANTarget Model=DS-R1-Distill-Llama-8B2026.05 | — | — | — | — | 33.3 | 32.7 | |
| AutoRANTarget Model=Qwen3-1.7B2026.05 | — | — | — | — | 90.7 | 89.3 | |
| AutoRANTarget Model=Qwen3-8B2026.05 | — | — | — | — | 87.3 | 88 | |
| AutoRANTarget Model=DS-R1-Distill-Llama-8B2026.05 | — | — | — | — | 90.7 | 90.7 | |
| GCGTarget Model=Qwen3-1.7B2026.05 | — | — | — | — | 32 | 30.7 | |
| GCGTarget Model=Qwen3-8B2026.05 | — | — | — | — | 20.7 | 19.3 | |
| GCGTarget Model=DS-R1-Distill-Llama-8B2026.05 | — | — | — | — | 30 | 30 | |
| H-CoTTarget Model=Qwen3-1.7B2026.05 | — | — | — | — | 90 | 90.7 | |
| H-CoTTarget Model=Qwen3-8B2026.05 | — | — | — | — | 90 | 90.7 | |
| H-CoTTarget Model=DS-R1-Distill-Llama-8B2026.05 | — | — | — | — | 89.3 | 90 | |
| PAIRTarget Model=Qwen3-1.7B2026.05 | — | — | — | — | 34 | 33.3 | |
| PAIRTarget Model=Qwen3-8B2026.05 | — | — | — | — | 29.3 | 28.7 | |
| PAIRTarget Model=DS-R1-Distill-Llama-8B2026.05 | — | — | — | — | 22.7 | 22.7 | |
| ReNeLLMTarget Model=Qwen3-1.7B2026.05 | — | — | — | — | 60 | 60 | |
| ReNeLLMTarget Model=Qwen3-8B2026.05 | — | — | — | — | 52 | 52.7 | |
| ReNeLLMTarget Model=DS-R1-Distill-Llama-8B2026.05 | — | — | — | — | 67.3 | 68 |