Jailbreaking on AdvBench (test) (GPT-5 ASR & ACQ)
99ASR (GPT-4o)HMNS
Evaluation Results
| Method | Links | |||
|---|---|---|---|---|
| HMNSTarget LLM=LLaMA-3.1-70B, Zero-shot=true2026.04 | 99 | 95 | 1.8 | |
| HMNSTarget LLM=LLaMA-2-7B-Chat, Zero-shot=true2026.04 | 98 | 93 | 2 | |
| ArrAttackTarget LLM=LLaMA-3.1-70B, Zero-shot=true2026.04 | 93 | 89 | 7.4 | |
| ArrAttackTarget LLM=LLaMA-2-7B-Chat, Zero-shot=true2026.04 | 92 | 87 | 7.5 | |
| HMNSTarget LLM=Phi-3-Medium-14B (Instruct), Zero-shot=true2026.04 | 92 | 86 | 2 | |
| ArrAttackTarget LLM=Phi-3-Medium-14B (Instruct), Zero-shot=true2026.04 | 86 | 80 | 8.2 | |
| TempestTarget LLM=LLaMA-3.1-70B, Zero-shot=true2026.04 | 85.3 | 80.1 | 9.1 | |
| TempestTarget LLM=LLaMA-2-7B-Chat, Zero-shot=true2026.04 | 84.1 | 78.4 | 9.4 | |
| TempestTarget LLM=Phi-3-Medium-14B (Instruct), Zero-shot=true2026.04 | 82.1 | 75.8 | 9.7 | |
| PrisonBreakTarget LLM=LLaMA-3.1-70B, Zero-shot=true2026.04 | 78.4 | 72.6 | 11.5 | |
| PrisonBreakTarget LLM=LLaMA-2-7B-Chat, Zero-shot=true2026.04 | 77.3 | 71.2 | 11.7 | |
| AutoDANTarget LLM=LLaMA-3.1-70B, Zero-shot=true2026.04 | 74 | 67.9 | 12.4 | |
| PrisonBreakTarget LLM=Phi-3-Medium-14B (Instruct), Zero-shot=true2026.04 | 73.6 | 67.1 | 12.5 | |
| AutoDANTarget LLM=LLaMA-2-7B-Chat, Zero-shot=true2026.04 | 72.6 | 66.2 | 12.8 | |
| MasterKeyTarget LLM=LLaMA-3.1-70B, Zero-shot=true2026.04 | 71.6 | 65.7 | 10.4 | |
| MasterKeyTarget LLM=LLaMA-2-7B-Chat, Zero-shot=true2026.04 | 70.4 | 64.3 | 10.5 | |
| ADCTarget LLM=LLaMA-3.1-70B, Zero-shot=true2026.04 | 70.1 | 64.2 | 9.6 | |
| ADCTarget LLM=LLaMA-2-7B-Chat, Zero-shot=true2026.04 | 68.2 | 62.4 | 9.9 | |
| Many-shot JB (MSJ)Target LLM=LLaMA-3.1-70B, Zero-shot=true2026.04 | 66.9 | 60.9 | 10.6 | |
| AutoDANTarget LLM=Phi-3-Medium-14B (Instruct), Zero-shot=true2026.04 | 65.1 | 58.8 | 13.6 | |
| Many-shot JB (MSJ)Target LLM=LLaMA-2-7B-Chat, Zero-shot=true2026.04 | 64.8 | 58.9 | 10.9 | |
| MasterKeyTarget LLM=Phi-3-Medium-14B (Instruct), Zero-shot=true2026.04 | 62.7 | 56.3 | 11.3 | |
| ADCTarget LLM=Phi-3-Medium-14B (Instruct), Zero-shot=true2026.04 | 61.3 | 55.4 | 10.8 | |
| Many-shot JB (MSJ)Target LLM=Phi-3-Medium-14B (Instruct), Zero-shot=true2026.04 | 58.4 | 52.6 | 11.9 | |
| Foot-In-The-Door (FITD)Target LLM=LLaMA-3.1-70B, Zero-shot=true2026.04 | 46.5 | 40.8 | 15.7 | |
| Foot-In-The-Door (FITD)Target LLM=LLaMA-2-7B-Chat, Zero-shot=true2026.04 | 44 | 38 | 16.2 | |
| Foot-In-The-Door (FITD)Target LLM=Phi-3-Medium-14B (Instruct), Zero-shot=true2026.04 | 40.2 | 34.5 | 17 |