Jailbreaking Attack on AdvBench (ASR + GPT)
97.7ASRPiF
Evaluation results
| Method | Links | ||
|---|---|---|---|
| PiFTarget Model=GPT-42025.12 | 97.7 | 63.6 | |
| CHaRSBase Model=Llama3.1-8B-Instruct2026.02 | 92.31 | — | |
| CHaRS-PCTBase Model=Llama3.1-8B-Instruct2026.02 | 92.31 | — | |
| CHaRSBase Model=Qwen2.5-3B-Instruct2026.02 | 92.31 | — | |
| CHaRS-PCTBase Model=Qwen2.5-3B-Instruct2026.02 | 92.31 | — | |
| APAsTarget Model=GPT-42025.12 | 92 | 60 | |
| DirAblBase Model=Llama3.1-8B-Instruct2026.02 | 91.35 | — | |
| CHaRS-PCTBase Model=Qwen2.5-7B-Instruct2026.02 | 91.35 | — | |
| DirAblBase Model=Qwen2.5-3B-Instruct2026.02 | 90.38 | — | |
| CHaRSBase Model=Qwen2.5-7B-Instruct2026.02 | 90.38 | — | |
| DirAblBase Model=Qwen2.5-7B-Instruct2026.02 | 89.42 | — | |
| CHaRSBase Model=Llama3.2-3B-Instruct2026.02 | 86.54 | — | |
| CHaRS-PCTBase Model=Llama3.2-3B-Instruct2026.02 | 86.54 | — | |
| RIPPLETarget Model=GPT-42025.12 | 86 | — | |
| CHaRS-PCTBase Model=Gemma2-9B-Instruct2026.02 | 85.58 | — | |
| CHaRSBase Model=Qwen2.5-32B-Instruct2026.02 | 85.58 | — | |
| CHaRSBase Model=Gemma2-9B-Instruct2026.02 | 84.62 | — | |
| DirAblBase Model=Llama3.2-3B-Instruct2026.02 | 83.65 | — | |
| CHaRS-PCTBase Model=Qwen2.5-32B-Instruct2026.02 | 83.65 | — | |
| DirAblBase Model=Qwen2.5-32B-Instruct2026.02 | 82.69 | — | |
| CHaRSBase Model=Qwen2.5-14B-Instruct2026.02 | 80.77 | — | |
| CHaRS-PCTBase Model=Qwen2.5-14B-Instruct2026.02 | 80.77 | — | |
| DirAblBase Model=Gemma2-9B-Instruct2026.02 | 79.81 | — | |
| DirAblBase Model=Qwen2.5-14B-Instruct2026.02 | 78.85 | — | |
| ReNeLLMTarget Model=GPT-42025.12 | 71.6 | 58.9 | |
| LLM-FUZZERTarget Model=GPT-42025.12 | 60 | — | |
| AutoDANTarget Model=GPT-42025.12 | 26.4 | 17.7 | |
| AmpleGCGTarget Model=GPT-42025.12 | — | 12 |