Jailbreaking on AdvBench selected models
100ASR@10Few-shot threat model
Evaluation results
| Method | Links | |
|---|---|---|
| Few-shot threat modelModel=Llama3 8B, TTT steps=5, Adaptation Method=Full fine-tuning2026.05 | 100 | |
| Few-shot threat modelModel=Qwen3 8B, TTT steps=2, Adaptation Method=LoRA2026.05 | 100 | |
| Few-shot threat modelModel=Qwen3 8B, TTT steps=5, Adaptation Method=LoRA2026.05 | 100 | |
| Few-shot threat modelModel=Qwen3 8B, TTT steps=10, Adaptation Method=LoRA2026.05 | 100 | |
| Generation-phase threat modelModel=Qwen3 8B, TTT steps=10, Adaptation Method=LoRA2026.05 | 100 | |
| Few-shot threat modelModel=Qwen2.5 1.5B, TTT steps=5, Adaptation Method=Full fine-tuning2026.05 | 98 | |
| Few-shot threat modelModel=Qwen2.5 1.5B, TTT steps=10, Adaptation Method=Full fine-tuning2026.05 | 98 | |
| Generation-phase threat modelModel=Qwen3 8B, TTT steps=2, Adaptation Method=LoRA2026.05 | 98 | |
| Few-shot threat modelModel=Qwen2.5 1.5B, TTT steps=1, Adaptation Method=Full fine-tuning2026.05 | 96 | |
| Generation-phase threat modelModel=Qwen2.5 1.5B, TTT steps=5, Adaptation Method=Full fine-tuning2026.05 | 96 | |
| Generation-phase threat modelModel=Qwen2.5 1.5B, TTT steps=10, Adaptation Method=Full fine-tuning2026.05 | 96 | |
| Few-shot threat modelModel=Gemma 7B, TTT steps=1, Adaptation Method=Full fine-tuning2026.05 | 96 | |
| Few-shot threat modelModel=Gemma 7B, TTT steps=2, Adaptation Method=Full fine-tuning2026.05 | 96 | |
| Few-shot threat modelModel=Gemma 7B, TTT steps=5, Adaptation Method=Full fine-tuning2026.05 | 96 | |
| Generation-phase threat modelModel=Qwen3 32B, TTT steps=5, Adaptation Method=LoRA2026.05 | 96 | |
| Generation-phase threat modelModel=Qwen3 32B, TTT steps=10, Adaptation Method=LoRA2026.05 | 96 | |
| Few-shot threat modelModel=Qwen2.5 1.5B, TTT steps=2, Adaptation Method=Full fine-tuning2026.05 | 94 | |
| Few-shot threat modelModel=Gemma 7B, TTT steps=10, Adaptation Method=Full fine-tuning2026.05 | 94 | |
| Few-shot threat modelModel=Llama3 8B, TTT steps=2, Adaptation Method=Full fine-tuning2026.05 | 94 | |
| Few-shot threat modelModel=Llama3 70B, TTT steps=5, Adaptation Method=LoRA2026.05 | 94 | |
| Few-shot threat modelModel=Llama3 8B, TTT steps=10, Adaptation Method=Full fine-tuning2026.05 | 92 | |
| Generation-phase threat modelModel=Qwen3 8B, TTT steps=5, Adaptation Method=LoRA2026.05 | 92 | |
| Generation-phase threat modelModel=Llama3 70B, TTT steps=5, Adaptation Method=LoRA2026.05 | 92 | |
| Generation-phase threat modelModel=Llama3 70B, TTT steps=10, Adaptation Method=LoRA2026.05 | 92 | |
| Generation-phase threat modelModel=Qwen2.5 1.5B, TTT steps=2, Adaptation Method=Full fine-tuning2026.05 | 90 | |
| Generation-phase threat modelModel=Qwen2.5 1.5B, TTT steps=1, Adaptation Method=Full fine-tuning2026.05 | 88 | |
| Few-shot threat modelModel=Llama3 70B, TTT steps=10, Adaptation Method=LoRA2026.05 | 86 | |
| Generation-phase threat modelModel=Llama3 8B, TTT steps=5, Adaptation Method=Full fine-tuning2026.05 | 84 | |
| Few-shot threat modelModel=Qwen3 8B, TTT steps=1, Adaptation Method=LoRA2026.05 | 84 | |
| Generation-phase threat modelModel=Qwen3 8B, TTT steps=1, Adaptation Method=LoRA2026.05 | 82 | |
| Generation-phase threat modelModel=Gemma 7B, TTT steps=10, Adaptation Method=Full fine-tuning2026.05 | 80 | |
| Generation-phase threat modelModel=Qwen3 32B, TTT steps=2, Adaptation Method=LoRA2026.05 | 80 | |
| Few-shot threat modelModel=Qwen3 32B, TTT steps=5, Adaptation Method=LoRA2026.05 | 78 | |
| Generation-phase threat modelModel=Llama3 8B, TTT steps=10, Adaptation Method=Full fine-tuning2026.05 | 76 | |
| Generation-phase threat modelModel=Gemma 7B, TTT steps=2, Adaptation Method=Full fine-tuning2026.05 | 68 | |
| Generation-phase threat modelModel=Gemma 7B, TTT steps=1, Adaptation Method=Full fine-tuning2026.05 | 64 | |
| Few-shot threat modelModel=Qwen3 32B, TTT steps=10, Adaptation Method=LoRA2026.05 | 60 | |
| Generation-phase threat modelModel=Llama3 70B, TTT steps=2, Adaptation Method=LoRA2026.05 | 52 | |
| Generation-phase threat modelModel=Gemma 7B, TTT steps=5, Adaptation Method=Full fine-tuning2026.05 | 38 | |
| Generation-phase threat modelModel=Llama3 8B, TTT steps=2, Adaptation Method=Full fine-tuning2026.05 | 32 | |
| Few-shot threat modelModel=Llama3 70B, TTT steps=2, Adaptation Method=LoRA2026.05 | 28 | |
| Self-supervised threat modelModel=Llama3 8B, TTT steps=2, Adaptation Method=Full fine-tuning2026.05 | 24 | |
| Self-supervised threat modelModel=Llama3 8B, TTT steps=10, Adaptation Method=Full fine-tuning2026.05 | 22 | |
| Self-supervised threat modelModel=Llama3 8B, TTT steps=5, Adaptation Method=Full fine-tuning2026.05 | 20 | |
| Generation-phase threat modelModel=Qwen3 32B, TTT steps=1, Adaptation Method=LoRA2026.05 | 20 | |
| Self-supervised threat modelModel=Qwen2.5 1.5B, TTT steps=1, Adaptation Method=Full fine-tuning2026.05 | 18 | |
| Self-supervised threat modelModel=Gemma 7B, TTT steps=1, Adaptation Method=Full fine-tuning2026.05 | 18 | |
| Self-supervised threat modelModel=Qwen3 8B, TTT steps=1, Adaptation Method=LoRA2026.05 | 16 | |
| Generation-phase threat modelModel=Llama3 70B, TTT steps=1, Adaptation Method=LoRA2026.05 | 12 | |
| Self-supervised threat modelModel=Qwen2.5 1.5B, TTT steps=2, Adaptation Method=Full fine-tuning2026.05 | 10 | |
| Self-supervised threat modelModel=Gemma 7B, TTT steps=No TTT, Adaptation Method=Full fine-tuning2026.05 | 10 | |
| Few-shot threat modelModel=Gemma 7B, TTT steps=No TTT, Adaptation Method=Full fine-tuning2026.05 | 10 | |
| Generation-phase threat modelModel=Gemma 7B, TTT steps=No TTT, Adaptation Method=Full fine-tuning2026.05 | 10 | |
| Few-shot threat modelModel=Llama3 70B, TTT steps=1, Adaptation Method=LoRA2026.05 | 10 | |
| Self-supervised threat modelModel=Qwen2.5 1.5B, TTT steps=No TTT, Adaptation Method=Full fine-tuning2026.05 | 8 | |
| Self-supervised threat modelModel=Qwen2.5 1.5B, TTT steps=5, Adaptation Method=Full fine-tuning2026.05 | 8 | |
| Few-shot threat modelModel=Qwen2.5 1.5B, TTT steps=No TTT, Adaptation Method=Full fine-tuning2026.05 | 8 | |
| Generation-phase threat modelModel=Qwen2.5 1.5B, TTT steps=No TTT, Adaptation Method=Full fine-tuning2026.05 | 8 | |
| Self-supervised threat modelModel=Gemma 7B, TTT steps=5, Adaptation Method=Full fine-tuning2026.05 | 8 | |
| Generation-phase threat modelModel=Llama3 8B, TTT steps=1, Adaptation Method=Full fine-tuning2026.05 | 8 | |
| Few-shot threat modelModel=Qwen3 32B, TTT steps=2, Adaptation Method=LoRA2026.05 | 8 | |
| Self-supervised threat modelModel=Llama3 70B, TTT steps=10, Adaptation Method=LoRA2026.05 | 8 | |
| Self-supervised threat modelModel=Gemma 7B, TTT steps=2, Adaptation Method=Full fine-tuning2026.05 | 6 | |
| Self-supervised threat modelModel=Gemma 7B, TTT steps=10, Adaptation Method=Full fine-tuning2026.05 | 6 | |
| Self-supervised threat modelModel=Llama3 70B, TTT steps=2, Adaptation Method=LoRA2026.05 | 6 | |
| Self-supervised threat modelModel=Qwen2.5 1.5B, TTT steps=10, Adaptation Method=Full fine-tuning2026.05 | 4 | |
| Self-supervised threat modelModel=Qwen3 8B, TTT steps=2, Adaptation Method=LoRA2026.05 | 4 | |
| Self-supervised threat modelModel=Llama3 70B, TTT steps=No TTT, Adaptation Method=LoRA2026.05 | 4 | |
| Self-supervised threat modelModel=Llama3 70B, TTT steps=1, Adaptation Method=LoRA2026.05 | 4 | |
| Self-supervised threat modelModel=Llama3 70B, TTT steps=5, Adaptation Method=LoRA2026.05 | 4 | |
| Few-shot threat modelModel=Llama3 70B, TTT steps=No TTT, Adaptation Method=LoRA2026.05 | 4 | |
| Generation-phase threat modelModel=Llama3 70B, TTT steps=No TTT, Adaptation Method=LoRA2026.05 | 4 | |
| Self-supervised threat modelModel=Llama3 8B, TTT steps=No TTT, Adaptation Method=Full fine-tuning2026.05 | 2 | |
| Few-shot threat modelModel=Llama3 8B, TTT steps=No TTT, Adaptation Method=Full fine-tuning2026.05 | 2 | |
| Few-shot threat modelModel=Llama3 8B, TTT steps=1, Adaptation Method=Full fine-tuning2026.05 | 2 | |
| Generation-phase threat modelModel=Llama3 8B, TTT steps=No TTT, Adaptation Method=Full fine-tuning2026.05 | 2 | |
| Self-supervised threat modelModel=Qwen3 8B, TTT steps=5, Adaptation Method=LoRA2026.05 | 2 | |
| Self-supervised threat modelModel=Qwen3 8B, TTT steps=10, Adaptation Method=LoRA2026.05 | 2 | |
| Self-supervised threat modelModel=Qwen3 32B, TTT steps=No TTT, Adaptation Method=LoRA2026.05 | 2 | |
| Self-supervised threat modelModel=Qwen3 32B, TTT steps=5, Adaptation Method=LoRA2026.05 | 2 | |
| Few-shot threat modelModel=Qwen3 32B, TTT steps=No TTT, Adaptation Method=LoRA2026.05 | 2 | |
| Generation-phase threat modelModel=Qwen3 32B, TTT steps=No TTT, Adaptation Method=LoRA2026.05 | 2 | |
| Self-supervised threat modelModel=Llama3 8B, TTT steps=1, Adaptation Method=Full fine-tuning2026.05 | 0 | |
| Self-supervised threat modelModel=Qwen3 8B, TTT steps=No TTT, Adaptation Method=LoRA2026.05 | 0 | |
| Few-shot threat modelModel=Qwen3 8B, TTT steps=No TTT, Adaptation Method=LoRA2026.05 | 0 | |
| Generation-phase threat modelModel=Qwen3 8B, TTT steps=No TTT, Adaptation Method=LoRA2026.05 | 0 | |
| Self-supervised threat modelModel=Qwen3 32B, TTT steps=1, Adaptation Method=LoRA2026.05 | 0 | |
| Self-supervised threat modelModel=Qwen3 32B, TTT steps=2, Adaptation Method=LoRA2026.05 | 0 | |
| Self-supervised threat modelModel=Qwen3 32B, TTT steps=10, Adaptation Method=LoRA2026.05 | 0 | |
| Few-shot threat modelModel=Qwen3 32B, TTT steps=1, Adaptation Method=LoRA2026.05 | 0 |