Jailbreaking on StrongReject (test)
89.8Attack Success Rate (ASR)PAD
Evaluation results
| Method | Links | |||||
|---|---|---|---|---|---|---|
| PADVictim=Dream-Instruct2026.06 | 89.8 | — | — | — | 4.47 | |
| PADVictim=MMaDA-CoT2026.06 | 87.9 | — | — | — | 4.5 | |
| DIJAVictim=MMaDA-CoT2026.06 | 87.5 | — | — | — | 4.55 | |
| DIJAVictim=Dream-Instruct2026.06 | 87.2 | — | — | — | 4.64 | |
| MASKFORGEVictim=LLaDA-Instruct2026.06 | 87 | — | — | — | 4.68 | |
| AutoDANVictim=MMaDA-CoT2026.06 | 83.5 | — | — | — | 3.66 | |
| DIJAVictim=LLaDA-Instruct2026.06 | 83.1 | — | — | — | 4.55 | |
| MASKFORGEVictim=LLaDA 1.52026.06 | 83 | — | — | — | 4.63 | |
| PADVictim=LLaDA 1.52026.06 | 82.1 | — | — | — | 4.29 | |
| PADVictim=LLaDA-Instruct2026.06 | 81.8 | — | — | — | 4.42 | |
| MASKFORGEVictim=Dream-Instruct2026.06 | 81 | — | — | — | 4.55 | |
| MASKFORGEVictim=AVG2026.06 | 81 | — | — | — | 4.58 | |
| DIJAVictim=LLaDA 1.52026.06 | 80.8 | — | — | — | 4.51 | |
| MASKFORGEVictim=LLaDA2.0-mini2026.06 | 79 | — | — | — | 4.64 | |
| DIRECTVictim=MMaDA-CoT2026.06 | 75.7 | — | — | — | 4 | |
| MASKFORGEVictim=MMaDA-CoT2026.06 | 75 | — | — | — | 4.4 | |
| AutoDANVictim=LLaDA-Instruct2026.06 | 74.5 | — | — | — | 3.41 | |
| DIJAVictim=AVG2026.06 | 74.3 | — | — | — | 4.34 | |
| PAIRVictim=MMaDA-CoT2026.06 | 72.5 | — | — | — | 3.75 | |
| PADVictim=AVG2026.06 | 72.5 | — | — | — | 4.15 | |
| AutoDANVictim=LLaDA 1.52026.06 | 72 | — | — | — | 3.36 | |
| AutoDANVictim=AVG2026.06 | 62.5 | — | — | — | 3.18 | |
| AutoDANVictim=Dream-Instruct2026.06 | 46.5 | — | — | — | 2.93 | |
| AutoDANVictim=LLaDA2.0-mini2026.06 | 36 | — | — | — | 2.54 | |
| DIJAVictim=LLaDA2.0-mini2026.06 | 32.9 | — | — | — | 3.46 | |
| PAIRVictim=LLaDA 1.52026.06 | 32.5 | — | — | — | 2.04 | |
| PAIRVictim=LLaDA-Instruct2026.06 | 31 | — | — | — | 1.97 | |
| PAIRVictim=AVG2026.06 | 30.7 | — | — | — | 2.11 | |
| AIMVictim=MMaDA-CoT2026.06 | 26 | — | — | — | 2.1 | |
| PADVictim=LLaDA2.0-mini2026.06 | 20.8 | — | — | — | 3.09 | |
| DIRECTVictim=AVG2026.06 | 15.7 | — | — | — | 1.63 | |
| AIMVictim=LLaDA-Instruct2026.06 | 12 | — | — | — | 1.72 | |
| AIMVictim=AVG2026.06 | 10.8 | — | — | — | 1.57 | |
| AIMVictim=LLaDA 1.52026.06 | 10.5 | — | — | — | 1.68 | |
| PAIRVictim=LLaDA2.0-mini2026.06 | 9.5 | — | — | — | 1.3 | |
| PAIRVictim=Dream-Instruct2026.06 | 8 | — | — | — | 1.47 | |
| AIMVictim=LLaDA2.0-mini2026.06 | 4 | — | — | — | 1.2 | |
| DIRECTVictim=LLaDA 1.52026.06 | 1.6 | — | — | — | 1.08 | |
| AIMVictim=Dream-Instruct2026.06 | 1.5 | — | — | — | 1.15 | |
| DIRECTVictim=LLaDA-Instruct2026.06 | 0.6 | — | — | — | 1.04 | |
| DIRECTVictim=LLaDA2.0-mini2026.06 | 0.3 | — | — | — | 1.02 | |
| DIRECTVictim=Dream-Instruct2026.06 | 0 | — | — | — | 1.02 | |
| ADCTarget LLM=LLaMA-2-7B-Chat, Zero-shot=true2026.04 | — | 61.5 | 56.4 | 10.9 | — | |
| ADCTarget LLM=Phi-3-Medium-14B (Instruct), Zero-shot=true2026.04 | — | 55 | 50.1 | 11.6 | — | |
| ADCTarget LLM=LLaMA-3.1-70B, Zero-shot=true2026.04 | — | 63.9 | 58.8 | 10.6 | — | |
| ArrAttackTarget LLM=LLaMA-2-7B-Chat, Zero-shot=true2026.04 | — | 88 | 89.09 | 8 | — | |
| ArrAttackTarget LLM=Phi-3-Medium-14B (Instruct), Zero-shot=true2026.04 | — | 80 | 74 | 8.6 | — | |
| ArrAttackTarget LLM=LLaMA-3.1-70B, Zero-shot=true2026.04 | — | 90 | 86 | 7.9 | — | |
| AutoDANTarget LLM=LLaMA-2-7B-Chat, Zero-shot=true2026.04 | — | 66.2 | 60.4 | 13.6 | — | |
| AutoDANTarget LLM=Phi-3-Medium-14B (Instruct), Zero-shot=true2026.04 | — | 58.8 | 53.2 | 14.2 | — | |
| AutoDANTarget LLM=LLaMA-3.1-70B, Zero-shot=true2026.04 | — | 67.9 | 62.3 | 13.1 | — | |
| Foot-In-The-Door (FITD)Target LLM=LLaMA-2-7B-Chat, Zero-shot=true2026.04 | — | 38.7 | 33.4 | 17.1 | — | |
| Foot-In-The-Door (FITD)Target LLM=Phi-3-Medium-14B (Instruct), Zero-shot=true2026.04 | — | 34.7 | 30.1 | 17.9 | — | |
| Foot-In-The-Door (FITD)Target LLM=LLaMA-3.1-70B, Zero-shot=true2026.04 | — | 40.1 | 35.1 | 16.5 | — | |
| HMNSTarget LLM=LLaMA-2-7B-Chat, Zero-shot=true2026.04 | — | 94 | 89 | 2.2 | — | |
| HMNSTarget LLM=Phi-3-Medium-14B (Instruct), Zero-shot=true2026.04 | — | 86 | 80 | 2.2 | — | |
| HMNSTarget LLM=LLaMA-3.1-70B, Zero-shot=true2026.04 | — | 96 | 92 | 2.1 | — | |
| Many-shot JB (MSJ)Target LLM=LLaMA-2-7B-Chat, Zero-shot=true2026.04 | — | 58.3 | 53.1 | 11.8 | — | |
| Many-shot JB (MSJ)Target LLM=Phi-3-Medium-14B (Instruct), Zero-shot=true2026.04 | — | 52.6 | 47.9 | 12.7 | — | |
| Many-shot JB (MSJ)Target LLM=LLaMA-3.1-70B, Zero-shot=true2026.04 | — | 60.8 | 55.9 | 11.5 | — | |
| MasterKeyTarget LLM=LLaMA-2-7B-Chat, Zero-shot=true2026.04 | — | 63.6 | 58.2 | 11.2 | — | |
| MasterKeyTarget LLM=Phi-3-Medium-14B (Instruct), Zero-shot=true2026.04 | — | 56 | 50.8 | 12 | — | |
| MasterKeyTarget LLM=LLaMA-3.1-70B, Zero-shot=true2026.04 | — | 65 | 59.8 | 11.1 | — | |
| PrisonBreakTarget LLM=LLaMA-2-7B-Chat, Zero-shot=true2026.04 | — | 71 | 65.4 | 12.4 | — | |
| PrisonBreakTarget LLM=Phi-3-Medium-14B (Instruct), Zero-shot=true2026.04 | — | 66.9 | 61 | 13 | — | |
| PrisonBreakTarget LLM=LLaMA-3.1-70B, Zero-shot=true2026.04 | — | 72 | 66.9 | 12.2 | — | |
| TempestTarget LLM=LLaMA-2-7B-Chat, Zero-shot=true2026.04 | — | 78.6 | 73.2 | 9.9 | — | |
| TempestTarget LLM=Phi-3-Medium-14B (Instruct), Zero-shot=true2026.04 | — | 76 | 70.4 | 10.2 | — | |
| TempestTarget LLM=LLaMA-3.1-70B, Zero-shot=true2026.04 | — | 79.2 | 74.6 | 9.8 | — |