Multi-turn Jailbreak Defense on HarmBench
81.8Crescendo ScoreNo Defense
Evaluation results
| Method | Links | ||||||
|---|---|---|---|---|---|---|---|
| No DefenseVictim LLM=GPT-4o, Defense Category=None2026.05 | 81.8 | 75.5 | 37.1 | 24.1 | 73 | 58.3 | |
| ParaphraseVictim LLM=GPT-4o, Defense Category=Input Preprocessing2026.05 | 79.9 | 72.3 | 30.8 | 19.5 | 70.4 | 54.6 | |
| TCAVictim LLM=GPT-4o, Defense Category=Multi-turn Detection2026.05 | 76.1 | 73.6 | 34 | 19.5 | 67.7 | 54.2 | |
| NBFVictim LLM=GPT-4o, Defense Category=Multi-turn Detection2026.05 | 75.5 | 64.2 | 28.9 | 17.7 | 64.8 | 50.2 | |
| SmoothLLMVictim LLM=GPT-4o, Defense Category=Input Preprocessing2026.05 | 73.6 | 73.4 | 35.2 | 21.5 | 72.2 | 55.2 | |
| ProActVictim LLM=GPT-4o, Defense Category=Output Postprocessing2026.05 | 72.9 | 43.4 | 34.2 | 18.5 | 43 | 42.4 | |
| LlamaGuardVictim LLM=GPT-4o, Defense Category=Single-turn Guard2026.05 | 71.1 | 64.2 | 25.8 | 17 | 62.4 | 48.1 | |
| AlignerVictim LLM=GPT-4o, Defense Category=Output Postprocessing2026.05 | 68.6 | 66 | 23.9 | 14.6 | 63.2 | 47.3 | |
| WildGuardVictim LLM=GPT-4o, Defense Category=Single-turn Guard2026.05 | 63.5 | 60.4 | 34 | 13.2 | 59.5 | 46.1 | |
| BacktranslationVictim LLM=GPT-4o, Defense Category=Input Preprocessing2026.05 | 61.2 | 60.4 | 24.5 | 17.7 | 59.1 | 44.6 | |
| QwenGuardVictim LLM=GPT-4o, Defense Category=Single-turn Guard2026.05 | 54.7 | 54.1 | 20.1 | 15.1 | 58 | 40.4 | |
| D-Judge-GPTVictim LLM=GPT-4o, Defense Category=Output Postprocessing2026.05 | 13.8 | 15.1 | 3.1 | 11.3 | 18.2 | 12.3 | |
| D-JudgeVictim LLM=GPT-4o, Defense Category=Output Postprocessing2026.05 | 12 | 6.3 | 2.5 | 5 | 17 | 8.6 |