# Perturbation-based Jailbreak Attack Defense on Perturbation-based Attack adversarial variants Source: [Perturbation-based Jailbreak Attack Defense on Perturbation-based Attack adversarial variants]() Collection index: [llms.txt]() Data updated: 2026-03-24T17:07:46.877Z Evaluation of model defense performance against perturbation-based jailbreak attacks, measuring Attack Success Rate (ASR) under various gradient-based adversarial methods (PGD, Auto-PGD, MI-FGSM) at different perturbation budgets (eps=16/255, eps=32/255). A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. | Scope | Recorded value | | --- | --- | | Task | Perturbation-based Jailbreak Attack Defense | | Dataset (including any stated split) | Perturbation-based Attack adversarial variants | | Metric | ASR (PGD, eps=16/255) | | Unit | PERCENT | | Direction | Higher is better | | Results loaded | 9 of 9 | | Coverage | All results currently returned for this benchmark | Evaluation settings may differ between results. The original papers and recorded configurations are needed to establish comparability. A shared metric name alone does not establish an identical protocol. ## Metrics - [ASR (PGD, eps=16/255)](): Higher is better; unit: PERCENT. - [ASR (PGD, eps=32/255)](): Higher is better; unit: PERCENT. - [ASR (Auto-PGD, eps=16/255)](): Higher is better; unit: PERCENT. - [ASR (Auto-PGD, eps=32/255)](): Higher is better; unit: PERCENT. - [ASR (MI-FGSM, eps=16/255)](): Higher is better; unit: PERCENT. - [ASR (MI-FGSM, eps=32/255)](): Higher is better; unit: PERCENT. ## Recorded results | Method | ASR (PGD, eps=16/255) | Result date | Report paper | | --- | --- | --- | --- | | w/o defense | 74.55 | Not recorded | 69c21ad30636e5bf4afc4d16 | | w/o defense | 70.91 | Not recorded | 69c21ad30636e5bf4afc4d16 | | w/o defense | 69.09 | Not recorded | 69c21ad30636e5bf4afc4d16 | | ASTRA | 21.82 | Not recorded | 69c21ad30636e5bf4afc4d16 | | NullSteer | 19.95 | Not recorded | 69c21ad30636e5bf4afc4d16 | | ASTRA | 5.45 | Not recorded | 69c21ad30636e5bf4afc4d16 | | NullSteer | 3.28 | Not recorded | 69c21ad30636e5bf4afc4d16 | | ASTRA | 1.82 | Not recorded | 69c21ad30636e5bf4afc4d16 | | NullSteer | 1.74 | Not recorded | 69c21ad30636e5bf4afc4d16 | ### w/o defense ASR (PGD, eps=16/255): 74.55. Result ID: 69c2c4ca47f34ce924ac813b. [Reporting paper]() Recorded evaluation configuration: {"Backbone":"Qwen2-VL"}. This record does not assert independent reproduction. ### w/o defense ASR (PGD, eps=16/255): 70.91. Result ID: 69c2c4ca47f34ce924ac8138. [Reporting paper]() Recorded evaluation configuration: {"Backbone":"MiniGPT-4"}. This record does not assert independent reproduction. ### w/o defense ASR (PGD, eps=16/255): 69.09. Result ID: 69c2c4ca47f34ce924ac813e. [Reporting paper]() Recorded evaluation configuration: {"Backbone":"LLaVA-v1.5"}. This record does not assert independent reproduction. ### ASTRA ASR (PGD, eps=16/255): 21.82. Result ID: 69c2c4ca47f34ce924ac813c. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Backbone":"Qwen2-VL"}. This record does not assert independent reproduction. ### NullSteer ASR (PGD, eps=16/255): 19.95. Result ID: 69c2c4ca47f34ce924ac813d. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Backbone":"Qwen2-VL"}. This record does not assert independent reproduction. ### ASTRA ASR (PGD, eps=16/255): 5.45. Result ID: 69c2c4ca47f34ce924ac8139. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Backbone":"MiniGPT-4"}. This record does not assert independent reproduction. ### NullSteer ASR (PGD, eps=16/255): 3.28. Result ID: 69c2c4ca47f34ce924ac813a. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Backbone":"MiniGPT-4"}. This record does not assert independent reproduction. ### ASTRA ASR (PGD, eps=16/255): 1.82. Result ID: 69c2c4ca47f34ce924ac813f. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Backbone":"LLaVA-v1.5"}. This record does not assert independent reproduction. ### NullSteer ASR (PGD, eps=16/255): 1.74. Result ID: 69c2c4ca47f34ce924ac8140. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Backbone":"LLaVA-v1.5"}. This record does not assert independent reproduction. Page 1 of 1. This is an index page, not the full collection.