Jailbreaking on AdvBench (ASR)
0ASRGPTFuzzer
Evaluation results
| Method | Links | |
|---|---|---|
| GPTFuzzerTarget Model=o1-pro, Attack Method=GPTFuzzer2025.06 | 0 | |
| GPTFuzzerTarget Model=o3-mini, Attack Method=GPTFuzzer2025.06 | 0.2 | |
| DeepInceptionTarget Model=o3-mini, Attack Method=DeepInception2025.06 | 1 | |
| Persuade-ATarget Model=Grok-3-Reasoner, Attack Method=Persuade-A2025.06 | 1.4 | |
| PastTarget Model=Grok-3-Reasoner, Attack Method=Past2025.06 | 2.1 | |
| Persuade-LTarget Model=o3-mini, Attack Method=Persuade-L2025.06 | 2.4 | |
| Persuade-LTarget Model=Grok-3-Reasoner, Attack Method=Persuade-L2025.06 | 4.3 | |
| Persuade-ATarget Model=o3-mini, Attack Method=Persuade-A2025.06 | 4.5 | |
| GPTFuzzerTarget Model=Qwen3-8B, Attack Method=GPTFuzzer2025.06 | 7.1 | |
| Persuade-LTarget Model=Gemini-2.5-pro, Attack Method=Persuade-L2025.06 | 8.4 | |
| Persuade-ATarget Model=Qwen3-8B, Attack Method=Persuade-A2025.06 | 8.5 | |
| GPTFuzzerTarget Model=Qwen3-32B, Attack Method=GPTFuzzer2025.06 | 10.1 | |
| Persuade-ATarget Model=Gemini-2.5-pro, Attack Method=Persuade-A2025.06 | 11 | |
| Persuade-LTarget Model=o1-pro, Attack Method=Persuade-L2025.06 | 11.6 | |
| Persuade-ATarget Model=o1-pro, Attack Method=Persuade-A2025.06 | 12.4 | |
| Persuade-ATarget Model=Qwen3-32B, Attack Method=Persuade-A2025.06 | 12.8 | |
| Persuade-LTarget Model=Qwen3-8B, Attack Method=Persuade-L2025.06 | 15.1 | |
| Persuade-ATarget Model=QwQ-32B, Attack Method=Persuade-A2025.06 | 16.7 | |
| Persuade-ATarget Model=DeepSeek-R1, Attack Method=Persuade-A2025.06 | 19.6 | |
| Persuade-LTarget Model=Qwen3-32B, Attack Method=Persuade-L2025.06 | 19.9 | |
| PastTarget Model=o3-mini, Attack Method=Past2025.06 | 21.9 | |
| DeepInceptionTarget Model=Gemini-2.5-pro, Attack Method=DeepInception2025.06 | 22.4 | |
| GPTFuzzerTarget Model=R1-Distill-Llama-8B, Attack Method=GPTFuzzer2025.06 | 24.7 | |
| Persuade-LTarget Model=QwQ-32B, Attack Method=Persuade-L2025.06 | 25.3 | |
| GPTFuzzerTarget Model=R1-Distill-Qwen-7B, Attack Method=GPTFuzzer2025.06 | 27.7 | |
| Persuade-LTarget Model=DeepSeek-R1, Attack Method=Persuade-L2025.06 | 28.3 | |
| GPTFuzzerTarget Model=Gemini-2.5-pro, Attack Method=GPTFuzzer2025.06 | 29.6 | |
| DeepInceptionTarget Model=o1-pro, Attack Method=DeepInception2025.06 | 31 | |
| DeepInceptionTarget Model=Grok-3-Reasoner, Attack Method=DeepInception2025.06 | 32.1 | |
| Persuade-ATarget Model=R1-Distill-Llama-8B, Attack Method=Persuade-A2025.06 | 35.4 | |
| Persuade-ATarget Model=R1-Distill-Qwen-7B, Attack Method=Persuade-A2025.06 | 37 | |
| GPTFuzzerTarget Model=R1-Distill-Qwen-1.5B, Attack Method=GPTFuzzer2025.06 | 38.4 | |
| Persuade-LTarget Model=R1-Distill-Llama-8B, Attack Method=Persuade-L2025.06 | 42.4 | |
| Persuade-LTarget Model=R1-Distill-Qwen-7B, Attack Method=Persuade-L2025.06 | 42.8 | |
| PastTarget Model=Qwen3-8B, Attack Method=Past2025.06 | 44.3 | |
| PastTarget Model=R1-Distill-Qwen-7B, Attack Method=Past2025.06 | 44.9 | |
| GPTFuzzerTarget Model=QwQ-32B, Attack Method=GPTFuzzer2025.06 | 48.4 | |
| PastTarget Model=o1-pro, Attack Method=Past2025.06 | 49.4 | |
| HAUNTATTACKTarget Model=o3-mini, Attack Method=Haunt-Avg2025.06 | 49.7 | |
| DeepInceptionTarget Model=Qwen3-32B, Attack Method=DeepInception2025.06 | 54.1 | |
| HAUNTATTACKTarget Model=Grok-3-Reasoner, Attack Method=Haunt-Avg2025.06 | 55.3 | |
| Persuade-LTarget Model=R1-Distill-Qwen-1.5B, Attack Method=Persuade-L2025.06 | 57.4 | |
| HAUNTATTACKTarget Model=R1-Distill-Qwen-1.5B, Attack Method=Haunt-Avg2025.06 | 59.2 | |
| PastTarget Model=Qwen3-32B, Attack Method=Past2025.06 | 59.2 | |
| DeepInceptionTarget Model=Qwen3-8B, Attack Method=DeepInception2025.06 | 61.3 | |
| HAUNTATTACKTarget Model=o1-pro, Attack Method=Haunt-Avg2025.06 | 63.9 | |
| Persuade-ATarget Model=R1-Distill-Qwen-1.5B, Attack Method=Persuade-A2025.06 | 64.6 | |
| GPTFuzzerTarget Model=DeepSeek-R1, Attack Method=GPTFuzzer2025.06 | 64.7 | |
| HAUNTATTACKTarget Model=Gemini-2.5-pro, Attack Method=Haunt-Avg2025.06 | 65.3 | |
| HAUNTATTACKTarget Model=o3-mini, Attack Method=Haunt-Best2025.06 | 68.7 | |
| HAUNTATTACKTarget Model=Grok-3-Reasoner, Attack Method=Haunt-Best2025.06 | 68.9 | |
| HAUNTATTACKTarget Model=R1-Distill-Qwen-7B, Attack Method=Haunt-Avg2025.06 | 72.6 | |
| PastTarget Model=Gemini-2.5-pro, Attack Method=Past2025.06 | 73.2 | |
| DeepInceptionTarget Model=QwQ-32B, Attack Method=DeepInception2025.06 | 76.8 | |
| PastTarget Model=QwQ-32B, Attack Method=Past2025.06 | 77.1 | |
| HAUNTATTACKTarget Model=R1-Distill-Llama-8B, Attack Method=Haunt-Avg2025.06 | 77.8 | |
| HAUNTATTACKTarget Model=Qwen3-8B, Attack Method=Haunt-Avg2025.06 | 78.5 | |
| PastTarget Model=R1-Distill-Llama-8B, Attack Method=Past2025.06 | 79.1 | |
| HAUNTATTACKTarget Model=Gemini-2.5-pro, Attack Method=Haunt-Best2025.06 | 79.7 | |
| DeepInceptionTarget Model=DeepSeek-R1, Attack Method=DeepInception2025.06 | 81.7 | |
| PastTarget Model=R1-Distill-Qwen-1.5B, Attack Method=Past2025.06 | 83.6 | |
| HAUNTATTACKTarget Model=o1-pro, Attack Method=Haunt-Best2025.06 | 84.5 | |
| HAUNTATTACKTarget Model=Qwen3-32B, Attack Method=Haunt-Avg2025.06 | 84.6 | |
| PastTarget Model=DeepSeek-R1, Attack Method=Past2025.06 | 84.9 | |
| HAUNTATTACKTarget Model=DeepSeek-R1, Attack Method=Haunt-Avg2025.06 | 86.4 | |
| HAUNTATTACKTarget Model=R1-Distill-Qwen-1.5B, Attack Method=Haunt-Best2025.06 | 86.8 | |
| HAUNTATTACKTarget Model=QwQ-32B, Attack Method=Haunt-Avg2025.06 | 87.2 | |
| HAUNTATTACKTarget Model=R1-Distill-Qwen-7B, Attack Method=Haunt-Best2025.06 | 89.1 | |
| DeepInceptionTarget Model=R1-Distill-Qwen-7B, Attack Method=DeepInception2025.06 | 89.8 | |
| HAUNTATTACKTarget Model=R1-Distill-Llama-8B, Attack Method=Haunt-Best2025.06 | 90.4 | |
| DeepInceptionTarget Model=R1-Distill-Llama-8B, Attack Method=DeepInception2025.06 | 91.6 | |
| HAUNTATTACKTarget Model=Qwen3-32B, Attack Method=Haunt-Best2025.06 | 92.3 | |
| DeepInceptionTarget Model=R1-Distill-Qwen-1.5B, Attack Method=DeepInception2025.06 | 93.4 | |
| GPTFuzzerTarget Model=Grok-3-Reasoner, Attack Method=GPTFuzzer2025.06 | 93.6 | |
| HAUNTATTACKTarget Model=DeepSeek-R1, Attack Method=Haunt-Best2025.06 | 94.8 | |
| HAUNTATTACKTarget Model=Grok-3-Reasoner, Attack Method=Haunt-Multi2025.06 | 95.6 | |
| HAUNTATTACKTarget Model=QwQ-32B, Attack Method=Haunt-Best2025.06 | 95.8 | |
| HAUNTATTACKTarget Model=Qwen3-8B, Attack Method=Haunt-Best2025.06 | 96.6 | |
| HAUNTATTACKTarget Model=o3-mini, Attack Method=Haunt-Multi2025.06 | 97.1 | |
| HAUNTATTACKTarget Model=R1-Distill-Qwen-1.5B, Attack Method=Haunt-Multi2025.06 | 98.5 | |
| HAUNTATTACKTarget Model=o1-pro, Attack Method=Haunt-Multi2025.06 | 98.9 | |
| HAUNTATTACKTarget Model=Gemini-2.5-pro, Attack Method=Haunt-Multi2025.06 | 99.2 | |
| HAUNTATTACKTarget Model=R1-Distill-Qwen-7B, Attack Method=Haunt-Multi2025.06 | 99.4 | |
| HAUNTATTACKTarget Model=R1-Distill-Llama-8B, Attack Method=Haunt-Multi2025.06 | 99.7 | |
| HAUNTATTACKTarget Model=Qwen3-32B, Attack Method=Haunt-Multi2025.06 | 99.7 | |
| HAUNTATTACKTarget Model=Qwen3-8B, Attack Method=Haunt-Multi2025.06 | 99.9 | |
| HAUNTATTACKTarget Model=QwQ-32B, Attack Method=Haunt-Multi2025.06 | 100 | |
| HAUNTATTACKTarget Model=DeepSeek-R1, Attack Method=Haunt-Multi2025.06 | 100 |