Safety Evaluation (Detailed Attack Metrics) on HarmBench
93.25PAIRReSA-SFT (Ours)
Evaluation results
| Method | Links | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ReSA-SFT (Ours)Base Model=Llama3.1-8B-Instruct, Evaluator=Harm-Bench Classifier2025.09 | 93.25 | 99.75 | 97 | 99.25 | 98.5 | 98.25 | 93.5 | 98.75 | 97.28 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| VanillaGuardrail Category=Unguarded, Target LLM=Qwen3-8B2026.06 | 91.9 | — | — | 87.2 | — | 76.9 | 93.8 | — | — | — | — | 1.6 | 15 | 1.6 | 22.7 | 1.3 | 11.8 | 0.9 | 37.5 | 81.3 | 1.3 | 31.5 | 88.4 | 1.3 | 20.7 | |
| SmoothLLMGuardrail Category=Prompt-level guardrails, Target LLM=Qwen3-8B2026.06 | 90.9 | — | — | 89.4 | — | 99.7 | 90 | — | — | — | — | 2.5 | 16.6 | 2.8 | 19.2 | 2.5 | 18.1 | 3.1 | 0.6 | 94.4 | 2.5 | 10.6 | 93.1 | 2.8 | 12.8 | |
| ReSA-SFT (Ours)Base Model=Qwen2.5-7B-Instruct, Evaluator=Harm-Bench Classifier2025.09 | 89.75 | 99.5 | 97.25 | 98.5 | 99.25 | 97.5 | 93.25 | 99.25 | 96.78 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ReSA-SFT (Ours)Base Model=Llama3.1-8B-Instruct, Evaluator=Fine-tuned StrongREJECT Evaluator [38]2025.09 | 82.99 | 99.56 | 92.64 | 97.61 | 98.65 | 94.49 | 93.46 | 91.37 | 93.85 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ReSA-SFT (Ours)Base Model=Qwen2.5-7B-Instruct, Evaluator=Fine-tuned StrongREJECT Evaluator [38]2025.09 | 82.13 | 99.49 | 94.27 | 96.55 | 98.99 | 92.26 | 92.17 | 88.8 | 93.08 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Post-hoc (LlamaGuard)Base Model=Qwen2.5-7B-Instruct, Evaluator=Harm-Bench Classifier2025.09 | 79.75 | 96 | 72.5 | 76.75 | 98.5 | 98.25 | 76.25 | 94.5 | 86.56 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| STAIR-DPOBase Model=Llama3.1-8B-Instruct, Evaluator=Harm-Bench Classifier2025.09 | 78.75 | 96.25 | 83.75 | 95 | 97 | 87.25 | 77.25 | 99 | 89.28 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Post-hoc (LlamaGuard)Base Model=Qwen2.5-7B-Instruct, Evaluator=Fine-tuned StrongREJECT Evaluator [38]2025.09 | 77.58 | 92.91 | 62.91 | 64.06 | 98.41 | 95.62 | 80.29 | 83.33 | 81.89 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Post-hoc (LlamaGuard)Base Model=Llama3.1-8B-Instruct, Evaluator=Harm-Bench Classifier2025.09 | 75.5 | 97 | 75.25 | 81.5 | 96.75 | 96.5 | 76 | 96.25 | 86.84 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| WJ-SFTBase Model=Llama3.1-8B-Instruct, Evaluator=Harm-Bench Classifier2025.09 | 74.75 | 99.25 | 81 | 89.75 | 97.5 | 93.75 | 73.75 | 100 | 88.72 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| WJ-SFTBase Model=Qwen2.5-7B-Instruct, Evaluator=Harm-Bench Classifier2025.09 | 72.5 | 99 | 73.75 | 89.5 | 100 | 85.25 | 58.5 | 98 | 84.56 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Post-hoc (LlamaGuard)Base Model=Llama3.1-8B-Instruct, Evaluator=Fine-tuned StrongREJECT Evaluator [38]2025.09 | 71.09 | 97.42 | 65.56 | 73.39 | 98.03 | 95.22 | 79.38 | 82.57 | 82.83 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| STAIR-DPO*Base Model=Qwen2.5-7B-Instruct, Evaluator=Harm-Bench Classifier2025.09 | 70.5 | 87.75 | 80.75 | 92.25 | 97.75 | 68.5 | 65 | 98.5 | 82.63 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| STAIR-DPOBase Model=Llama3.1-8B-Instruct, Evaluator=Fine-tuned StrongREJECT Evaluator [38]2025.09 | 69.97 | 96.76 | 77.61 | 92.71 | 98.2 | 84.73 | 77.8 | 93.05 | 86.35 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| WJ-SFTBase Model=Llama3.1-8B-Instruct, Evaluator=Fine-tuned StrongREJECT Evaluator [38]2025.09 | 68.99 | 98.59 | 73.53 | 84.5 | 96.95 | 91.1 | 76.34 | 91.68 | 85.21 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| WJ-SFTBase Model=Qwen2.5-7B-Instruct, Evaluator=Fine-tuned StrongREJECT Evaluator [38]2025.09 | 67.83 | 98.77 | 67.57 | 82.94 | 99.06 | 80.93 | 66.85 | 90.43 | 81.8 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Post-hoc (LlamaGuard)Base Model=Qwen2.5-7B-Instruct, Evaluator=Llama Guard2025.09 | 65 | 99.75 | 39.75 | 52 | 98 | 86.5 | 77.25 | 84.5 | 75.34 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| STAIR-DPO*Base Model=Qwen2.5-7B-Instruct, Evaluator=Fine-tuned StrongREJECT Evaluator [38]2025.09 | 64.62 | 91.5 | 75.53 | 89.72 | 97.06 | 71.9 | 72.38 | 91.46 | 81.77 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ReSA-SFT (Ours)Base Model=Llama3.1-8B-Instruct, Evaluator=Llama Guard2025.09 | 64.5 | 100 | 84.5 | 96.75 | 97 | 79.25 | 88 | 88.75 | 87.34 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| ReSA-SFT (Ours)Base Model=Qwen2.5-7B-Instruct, Evaluator=Llama Guard2025.09 | 63 | 99.5 | 88 | 94.25 | 96.25 | 70.5 | 88.25 | 78.75 | 84.81 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| SelfDefendGuardrail Category=Prompt-level guardrails, Target LLM=Qwen3-8B2026.06 | 60.3 | — | — | 87.2 | — | 37.5 | 48.8 | — | — | — | — | 0.6 | 56.7 | 0.9 | 22.7 | 0.9 | 67.6 | 0.6 | 76.7 | 43.1 | 0.9 | 72.3 | 59.4 | 1.3 | 57.6 | |
| BaseBase Model=Llama3.1-8B-Instruct, Evaluator=Fine-tuned StrongREJECT Evaluator [38]2025.09 | 55.04 | 86.13 | 53.54 | 67.87 | 66.09 | 71.9 | 62.92 | 51 | 64.31 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| BaseBase Model=Llama3.1-8B-Instruct, Evaluator=Harm-Bench Classifier2025.09 | 51.75 | 77 | 61.5 | 73.75 | 43 | 70.5 | 47.5 | 79.5 | 63.06 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Post-hoc (LlamaGuard)Base Model=Llama3.1-8B-Instruct, Evaluator=Llama Guard2025.09 | 51.25 | 100 | 47 | 60.5 | 98 | 88.5 | 72.25 | 85.5 | 75.38 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| BaseBase Model=Qwen2.5-7B-Instruct, Evaluator=Fine-tuned StrongREJECT Evaluator [38]2025.09 | 45.69 | 80.04 | 49.57 | 49.84 | 70.19 | 55.13 | 44.39 | 47.9 | 55.34 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| LlamaGuard3Guardrail Category=Fine-tuned guardrails, Target LLM=Qwen3-8B2026.06 | 41.6 | — | — | 46.9 | — | 28.8 | 45.3 | — | — | — | — | 3.4 | 72.8 | 3.4 | 68.5 | 3.4 | 69.8 | 3.4 | 82 | 45 | 3.4 | 70.1 | 67.2 | 3.4 | 49 | |
| BaseBase Model=Qwen2.5-7B-Instruct, Evaluator=Harm-Bench Classifier2025.09 | 39.75 | 71 | 56.25 | 58.75 | 58.75 | 52.75 | 21.5 | 65.5 | 53.03 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Self-ReminderGuardrail Category=Prompt-level guardrails, Target LLM=Qwen3-8B2026.06 | 39.4 | — | — | 35.9 | — | 82.2 | 42.5 | — | — | — | — | 17.5 | 69.9 | 15.9 | 72.7 | 20 | 66.9 | 17.8 | 29.3 | 85.9 | 17.8 | 24 | 52.5 | 19.4 | 59.8 | |
| RADGuardrail Category=Memory-augmented guardrails, Target LLM=Qwen3-8B2026.06 | 36.9 | — | — | 45.9 | — | 11.3 | 30 | — | — | — | — | 3.8 | 76.2 | 3.4 | 69.3 | 3.1 | 81.3 | 3.1 | 92.6 | 31.3 | 2.8 | 80.5 | 60.6 | 4.4 | 55.8 | |
| STAIR-DPOBase Model=Llama3.1-8B-Instruct, Evaluator=Llama Guard2025.09 | 31 | 90.75 | 52.25 | 77.25 | 96.25 | 62 | 57.5 | 75 | 67.75 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| WildGuardGuardrail Category=Fine-tuned guardrails, Target LLM=Qwen3-8B2026.06 | 28.4 | — | — | 32.8 | — | 50.3 | 25 | — | — | — | — | 12.2 | 78.9 | 12.2 | 76.1 | 12.2 | 80.9 | 12.2 | 63.5 | 35.3 | 12.2 | 74.5 | 31.6 | 11.9 | 77 | |
| WJ-SFTBase Model=Llama3.1-8B-Instruct, Evaluator=Llama Guard2025.09 | 28.25 | 100 | 42.5 | 71.5 | 94 | 53 | 59 | 78 | 65.78 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| WJ-SFTBase Model=Qwen2.5-7B-Instruct, Evaluator=Llama Guard2025.09 | 25 | 100 | 34.75 | 69 | 99.5 | 37 | 45.25 | 73.75 | 60.53 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| STAIR-DPO*Base Model=Qwen2.5-7B-Instruct, Evaluator=Llama Guard2025.09 | 24 | 75.25 | 43 | 73.75 | 96.75 | 28.5 | 47.25 | 69 | 57.19 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| GuardReasonerGuardrail Category=Fine-tuned guardrails, Target LLM=Qwen3-8B2026.06 | 21.3 | — | — | 30.9 | — | 60.6 | 29.1 | — | — | — | — | 6.9 | 85.3 | 6.9 | 79.3 | 6.9 | 80.5 | 6.9 | 55.3 | 7.8 | 6.9 | 92.7 | 19.1 | 7.2 | 86.5 | |
| BaseBase Model=Llama3.1-8B-Instruct, Evaluator=Llama Guard2025.09 | 20 | 71 | 24.25 | 50.5 | 38.5 | 40.25 | 39 | 38.25 | 40.22 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| MEMBRANEGuardrail Category=Memory-augmented guardrails, Target LLM=Qwen3-8B2026.06 | 16 | — | — | 22.3 | — | 0.3 | 8.2 | — | — | — | — | 4.1 | 89.5 | 6.1 | 85 | 4.9 | 93.4 | 4.1 | 97.8 | 0 | 3.8 | 98.1 | 20.5 | 2.9 | 87.4 | |
| BaseBase Model=Qwen2.5-7B-Instruct, Evaluator=Llama Guard2025.09 | 8.5 | 68 | 14.75 | 26.5 | 33 | 6.75 | 11.25 | 27.25 | 24.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| cDPOBackbone=Llama-3-8B2026.03 | — | — | — | — | — | — | — | — | — | 61 | 44 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| cDPOBackbone=Qwen-2.5-7B2026.03 | — | — | — | — | — | — | — | — | — | 45.5 | 19.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DPOBackbone=Llama-3-8B2026.03 | — | — | — | — | — | — | — | — | — | 41 | 28.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| DPOBackbone=Qwen-2.5-7B2026.03 | — | — | — | — | — | — | — | — | — | 32.5 | 14 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Dr.DPOBackbone=Llama-3-8B2026.03 | — | — | — | — | — | — | — | — | — | 2 | 0 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Dr.DPOBackbone=Qwen-2.5-7B2026.03 | — | — | — | — | — | — | — | — | — | 0.5 | 0 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| IPOBackbone=Llama-3-8B2026.03 | — | — | — | — | — | — | — | — | — | 33.5 | 17.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| IPOBackbone=Qwen-2.5-7B2026.03 | — | — | — | — | — | — | — | — | — | 30.5 | 14 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Llama-3-8BBackbone=Llama-3-8B2026.03 | — | — | — | — | — | — | — | — | — | 87.5 | 23.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Llama-3.2-3BBackbone=Llama-3.2-3B, Training Dataset=PKU-SafeRLHF-30K2026.03 | — | — | — | — | — | — | — | — | — | 85 | 26.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Llama-3.2-3B + cDPOBackbone=Llama-3.2-3B, Training Dataset=PKU-SafeRLHF-30K2026.03 | — | — | — | — | — | — | — | — | — | 65.5 | 15 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Llama-3.2-3B + DPOBackbone=Llama-3.2-3B, Training Dataset=PKU-SafeRLHF-30K2026.03 | — | — | — | — | — | — | — | — | — | 14 | 4 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Llama-3.2-3B + Dr.DPOBackbone=Llama-3.2-3B, Training Dataset=PKU-SafeRLHF-30K2026.03 | — | — | — | — | — | — | — | — | — | 2 | 0.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Llama-3.2-3B + IPOBackbone=Llama-3.2-3B, Training Dataset=PKU-SafeRLHF-30K2026.03 | — | — | — | — | — | — | — | — | — | 17 | 6 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Llama-3.2-3B + rDPOBackbone=Llama-3.2-3B, Training Dataset=PKU-SafeRLHF-30K2026.03 | — | — | — | — | — | — | — | — | — | 3.5 | 1 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Llama-3.2-3B + SFTBackbone=Llama-3.2-3B, Training Dataset=PKU-SafeRLHF-30K2026.03 | — | — | — | — | — | — | — | — | — | 89.5 | 73 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Llama-3.2-3B + wDPOBackbone=Llama-3.2-3B, Training Dataset=PKU-SafeRLHF-30K2026.03 | — | — | — | — | — | — | — | — | — | 2 | 0.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Pythia-2.8BBackbone=Pythia-2.8B, Training Dataset=PKU-SafeRLHF-30K2026.03 | — | — | — | — | — | — | — | — | — | 86 | 29.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Pythia-2.8B + cDPOBackbone=Pythia-2.8B, Training Dataset=PKU-SafeRLHF-30K2026.03 | — | — | — | — | — | — | — | — | — | 76 | 14.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Pythia-2.8B + DPOBackbone=Pythia-2.8B, Training Dataset=PKU-SafeRLHF-30K2026.03 | — | — | — | — | — | — | — | — | — | 65 | 15 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Pythia-2.8B + Dr.DPOBackbone=Pythia-2.8B, Training Dataset=PKU-SafeRLHF-30K2026.03 | — | — | — | — | — | — | — | — | — | 17.5 | 4.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Pythia-2.8B + IPOBackbone=Pythia-2.8B, Training Dataset=PKU-SafeRLHF-30K2026.03 | — | — | — | — | — | — | — | — | — | 73 | 16.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Pythia-2.8B + rDPOBackbone=Pythia-2.8B, Training Dataset=PKU-SafeRLHF-30K2026.03 | — | — | — | — | — | — | — | — | — | 55.5 | 17 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Pythia-2.8B + SFTBackbone=Pythia-2.8B, Training Dataset=PKU-SafeRLHF-30K2026.03 | — | — | — | — | — | — | — | — | — | 81 | 28 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Pythia-2.8B + wDPOBackbone=Pythia-2.8B, Training Dataset=PKU-SafeRLHF-30K2026.03 | — | — | — | — | — | — | — | — | — | 21.5 | 1.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| Qwen-2.5-7BBackbone=Qwen-2.5-7B2026.03 | — | — | — | — | — | — | — | — | — | 44.5 | 27 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| rDPOBackbone=Llama-3-8B2026.03 | — | — | — | — | — | — | — | — | — | 6 | 1.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| rDPOBackbone=Qwen-2.5-7B2026.03 | — | — | — | — | — | — | — | — | — | 3 | 1 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| SFTBackbone=Llama-3-8B2026.03 | — | — | — | — | — | — | — | — | — | 93.5 | 81.5 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| SFTBackbone=Qwen-2.5-7B2026.03 | — | — | — | — | — | — | — | — | — | 95 | 74 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| wDPOBackbone=Llama-3-8B2026.03 | — | — | — | — | — | — | — | — | — | 1.5 | 0 | — | — | — | — | — | — | — | — | — | — | — | — | — | — | |
| wDPOBackbone=Qwen-2.5-7B2026.03 | — | — | — | — | — | — | — | — | — | 0 | 0 | — | — | — | — | — | — | — | — | — | — | — | — | — | — |