Refusal Ablation and Jailbreak Attack Success on HARMBENCH
96.27Attack Success Rate (ASR)MD
Evaluation Results
| Method | Links | |
|---|---|---|
| MDModel=Gemma2-9B2025.11 | 96.27 | |
| MDModel=Qwen2.5-7B2025.11 | 95.97 | |
| SAAModel=Qwen2.5-7B2025.11 | 94.3 | |
| MDModel=Qwen2.5-3B2025.11 | 93.71 | |
| SAAModel=Gemma2-9B2025.11 | 93.71 | |
| MDModel=Qwen-14B2025.11 | 91.82 | |
| RDOModel=Gemma2-9B2025.11 | 91.82 | |
| SAAModel=LLama3-8B2025.11 | 91.2 | |
| RDOModel=Qwen2.5-3B2025.11 | 89.3 | |
| MDModel=LLama3-8B2025.11 | 88.05 | |
| MDModel=Qwen-7B2025.11 | 88.05 | |
| SDModel=Qwen2.5-3B2025.11 | 88.05 | |
| RDOModel=Qwen-7B2025.11 | 83.01 | |
| SAAModel=Qwen-14B2025.11 | 83.01 | |
| SAAModel=Qwen-7B2025.11 | 82.4 | |
| GCGModel=Qwen-14B2025.11 | 82.4 | |
| SAAModel=Qwen2.5-3B2025.11 | 81.76 | |
| SDModel=Qwen-7B2025.11 | 81.13 | |
| GCGModel=Qwen-7B2025.11 | 79.3 | |
| SDModel=Qwen2.5-7B2025.11 | 77.98 | |
| RDOModel=Qwen2.5-7B2025.11 | 76.1 | |
| SDModel=Qwen-14B2025.11 | 74.84 | |
| MDModel=LLama2-7B2025.11 | 59.11 | |
| SAAModel=LLama2-7B2025.11 | 57.9 | |
| RDOModel=Qwen-14B2025.11 | 45.91 | |
| GCGModel=Qwen2.5-3B2025.11 | 40.25 | |
| SDModel=Gemma2-9B2025.11 | 38.93 | |
| GCGModel=Qwen2.5-7B2025.11 | 38.36 | |
| GCGModel=LLama2-7B2025.11 | 32.7 | |
| RDOModel=LLama3-8B2025.11 | 32.07 | |
| MDModel=Mistral-7B-RR2025.11 | 25.79 | |
| SDModel=LLama3-8B2025.11 | 15.09 | |
| GCGModel=Gemma2-9B2025.11 | 5.03 | |
| SDModel=Mistral-7B-RR2025.11 | 5.03 | |
| GCGModel=LLama3-8B2025.11 | 1.9 | |
| SAAModel=Mistral-7B-RR2025.11 | 1.6 | |
| RDOModel=LLama2-7B2025.11 | 1.25 | |
| RDOModel=Mistral-7B-RR2025.11 | 1.25 | |
| GCGModel=Mistral-7B-RR2025.11 | 0.6 | |
| SDModel=LLama2-7B2025.11 | 0 |