Malicious Fine-tuning Attack on HEx-PHI
95.1Attack Success Rate (ASR)SFT
Evaluation results
| Method | Links | |
|---|---|---|
| SFTModel=Qwen2.5-7B-Instruct2026.06 | 95.1 | |
| SFTModel=Gemma-2-9B-IT2026.06 | 91.5 | |
| SFTModel=Llama-2-7B-Chat2026.06 | 87.8 | |
| LisaModel=Qwen2.5-7B-Instruct2026.06 | 81.3 | |
| VaccineTest-time Attack Dataset=PKU-SafeRLHF-unsafe2026.06 | 72.3 | |
| VaccineTest-time Attack Dataset=Beavertails-unsafe2026.06 | 71.7 | |
| SFTTest-time Attack Dataset=Toxic-DPO2026.06 | 71.1 | |
| VaccineTest-time Attack Dataset=Toxic-DPO2026.06 | 71.1 | |
| BoosterTest-time Attack Dataset=Toxic-DPO2026.06 | 67.9 | |
| SFTTest-time Attack Dataset=PKU-SafeRLHF-unsafe2026.06 | 66.6 | |
| BoosterTest-time Attack Dataset=PKU-SafeRLHF-unsafe2026.06 | 66.5 | |
| BoosterTest-time Attack Dataset=Beavertails-unsafe2026.06 | 63.9 | |
| LisaModel=Llama-2-7B-Chat2026.06 | 60.9 | |
| SFTTest-time Attack Dataset=Beavertails-unsafe2026.06 | 58.6 | |
| PatcherTest-time Attack Dataset=Toxic-DPO2026.06 | 57.3 | |
| PatcherTest-time Attack Dataset=PKU-SafeRLHF-unsafe2026.06 | 47.8 | |
| LisaModel=Gemma-2-9B-IT2026.06 | 28.7 | |
| PatcherTest-time Attack Dataset=Beavertails-unsafe2026.06 | 26.5 | |
| Constrained SFTModel=Llama-2-7B-Chat2026.06 | 25.2 | |
| Constrained SFTModel=Qwen2.5-7B-Instruct2026.06 | 21.5 | |
| Constrained SFTModel=Gemma-2-9B-IT2026.06 | 10.1 | |
| DR-SFTModel=Gemma-2-9B-IT2026.06 | 3.9 | |
| DR-SFTModel=Llama-2-7B-Chat2026.06 | 2.1 | |
| DR-SFTModel=Qwen2.5-7B-Instruct2026.06 | 1.8 |