Safety Evaluation on AdvBench (Step-wise ASR and Monotonicity)
1.35ASR (S1)LARF
Evaluation results
| Method | Links | |||||||
|---|---|---|---|---|---|---|---|---|
| LARFBackbone=Llama2-7b-Chat, Fine-tuning Dataset=Dolly2026.05 | 1.35 | 0.58 | 6.54 | 1.15 | 0.58 | 0.77 | — | |
| Self-Inf-NBackbone=Qwen3-8B, Fine-tuning Dataset=Alpaca2026.05 | 2.69 | 2.69 | 13.27 | 18.85 | 43.27 | -40.58 | — | |
| Self-Inf-NBackbone=Llama3.1-8B-Instruct, Fine-tuning Dataset=Dolly2026.05 | 2.88 | 44.42 | 47.31 | 54.23 | 15.96 | -13.08 | — | |
| Self-Inf-NBackbone=Qwen3-8B, Fine-tuning Dataset=Dolly2026.05 | 3.65 | 0.96 | 13.08 | 14.62 | 9.04 | -5.39 | — | |
| Bi-Anchor(Grad)Backbone=Qwen3-8B, Fine-tuning Dataset=Dolly2026.05 | 3.85 | 10.96 | 20.19 | 11.92 | 14.81 | -10.96 | — | |
| Self-Inf-NBackbone=Llama2-7b-Chat, Fine-tuning Dataset=Dolly2026.05 | 3.85 | 0.96 | 0.58 | 4.23 | 0.38 | 3.47 | — | |
| Bi-Anchor(Reps)Backbone=Llama2-7b-Chat, Fine-tuning Dataset=Dolly2026.05 | 5.38 | 7.5 | 0.77 | 0.58 | 8.08 | -2.7 | — | |
| Bi-Anchor(Grad)Backbone=Qwen3-8B, Fine-tuning Dataset=Alpaca2026.05 | 5.58 | 11.73 | 28.65 | 9.42 | 20.77 | -15.19 | — | |
| LARFBackbone=Llama2-7b-Chat, Fine-tuning Dataset=Alpaca2026.05 | 7.31 | 1.73 | 3.46 | 10.96 | 3.65 | 3.66 | — | |
| Bi-Anchor(Reps)Backbone=Llama3.1-8B-Instruct, Fine-tuning Dataset=Alpaca2026.05 | 7.5 | 5.19 | 14.62 | 10.96 | 54.04 | -46.54 | — | |
| Self-Inf-NBackbone=Llama2-7b-Chat, Fine-tuning Dataset=Alpaca2026.05 | 7.69 | 0.58 | 5.96 | 12.88 | 8.08 | -0.39 | — | |
| Bi-Anchor(Reps)Backbone=Qwen3-8B, Fine-tuning Dataset=Dolly2026.05 | 8.27 | 8.08 | 8.65 | 21.73 | 10 | -1.73 | — | |
| Bi-Anchor(Reps)Backbone=Qwen3-8B, Fine-tuning Dataset=Alpaca2026.05 | 11.35 | 29.04 | 43.08 | 16.92 | 6.92 | 4.43 | — | |
| Bi-Anchor(Reps)Backbone=Llama2-7b-Chat, Fine-tuning Dataset=Alpaca2026.05 | 11.54 | 9.62 | 3.85 | 4.81 | 13.08 | -1.54 | — | |
| Bi-Anchor(Grad)Backbone=Llama3.1-8B-Instruct, Fine-tuning Dataset=Alpaca2026.05 | 11.92 | 16.15 | 7.88 | 35 | 31.54 | -19.62 | — | |
| Bi-Anchor(Grad)Backbone=Llama2-7b-Chat, Fine-tuning Dataset=Alpaca2026.05 | 14.04 | 7.12 | 2.12 | 3.46 | 6.54 | 7.5 | — | |
| Bi-Anchor(Grad)Backbone=Llama2-7b-Chat, Fine-tuning Dataset=Dolly2026.05 | 15.19 | 0.96 | 0.77 | 0.77 | 2.69 | 12.5 | — | |
| SQSD(Beaver)Backbone=Llama2-7b-Chat, Fine-tuning Dataset=Alpaca2026.05 | 29.81 | 5.96 | 3.65 | 0.38 | 1.15 | 28.66 | — | |
| SQSD(Beaver)Backbone=Llama2-7b-Chat, Fine-tuning Dataset=Dolly2026.05 | 35 | 7.31 | 2.31 | 0.77 | 0 | 35 | — | |
| Reward ModelBackbone=Llama2-7b-Chat, Fine-tuning Dataset=Alpaca2026.05 | 35 | 2.69 | 1.73 | 0.58 | 0.58 | 34.42 | — | |
| SQSD(Aegis)Backbone=Llama2-7b-Chat, Fine-tuning Dataset=Dolly2026.05 | 37.31 | 4.23 | 1.54 | 0.96 | 0 | 37.31 | — | |
| SQSD(Aegis)Backbone=Qwen3-8B, Fine-tuning Dataset=Dolly2026.05 | 38.65 | 18.85 | 6.35 | 2.88 | 0.77 | 37.88 | — | |
| LARFBackbone=Qwen3-8B, Fine-tuning Dataset=Alpaca2026.05 | 39.04 | 23.85 | 7.69 | 5.38 | 3.85 | 35.19 | — | |
| Bi-Anchor(Reps)Backbone=Llama3.1-8B-Instruct, Fine-tuning Dataset=Dolly2026.05 | 39.42 | 45.58 | 42.88 | 36.92 | 19.62 | 19.8 | — | |
| Reward ModelBackbone=Qwen3-8B, Fine-tuning Dataset=Dolly2026.05 | 46.73 | 15 | 2.69 | 6.54 | 1.35 | 45.38 | — | |
| LARFBackbone=Qwen3-8B, Fine-tuning Dataset=Dolly2026.05 | 50.19 | 22.88 | 5.96 | 0.77 | 0.19 | 50 | — | |
| SQSD(Aegis)Backbone=Llama2-7b-Chat, Fine-tuning Dataset=Alpaca2026.05 | 53.27 | 3.85 | 2.5 | 1.15 | 0.96 | 52.31 | — | |
| LARFBackbone=Llama3.1-8B-Instruct, Fine-tuning Dataset=Dolly2026.05 | 56.92 | 79.23 | 17.31 | 35.38 | 2.69 | 54.23 | — | |
| SQSD(Aegis)Backbone=Qwen3-8B, Fine-tuning Dataset=Alpaca2026.05 | 57.12 | 24.62 | 14.62 | 7.12 | 2.69 | 54.43 | — | |
| Reward ModelBackbone=Llama2-7b-Chat, Fine-tuning Dataset=Dolly2026.05 | 58.27 | 1.73 | 1.73 | 0.19 | 0.19 | 58.08 | — | |
| Bi-Anchor(Grad)Backbone=Llama3.1-8B-Instruct, Fine-tuning Dataset=Dolly2026.05 | 62.5 | 57.12 | 36.73 | 17.31 | 6.15 | 56.35 | — | |
| SQSD(Aegis)Backbone=Llama3.1-8B-Instruct, Fine-tuning Dataset=Alpaca2026.05 | 68.46 | 21.15 | 11.92 | 8.27 | 5.58 | 62.88 | — | |
| SQSD(Beaver)Backbone=Qwen3-8B, Fine-tuning Dataset=Alpaca2026.05 | 70 | 17.69 | 75.96 | 8.65 | 2.88 | 67.12 | — | |
| Reward ModelBackbone=Llama3.1-8B-Instruct, Fine-tuning Dataset=Dolly2026.05 | 73.27 | 47.12 | 15.77 | 38.65 | 21.54 | 51.73 | — | |
| SQSD(Beaver)Backbone=Qwen3-8B, Fine-tuning Dataset=Dolly2026.05 | 73.65 | 18.65 | 12.12 | 4.81 | 0.58 | 73.07 | — | |
| LARFBackbone=Llama3.1-8B-Instruct, Fine-tuning Dataset=Alpaca2026.05 | 74.23 | 37.88 | 26.73 | 2.5 | 8.46 | 65.77 | — | |
| Reward ModelBackbone=Llama3.1-8B-Instruct, Fine-tuning Dataset=Alpaca2026.05 | 75.96 | 2.12 | 22.12 | 4.04 | 11.92 | 64.04 | — | |
| Reward ModelBackbone=Qwen3-8B, Fine-tuning Dataset=Alpaca2026.05 | 77.12 | 6.92 | 13.27 | 12.31 | 9.81 | 67.31 | — | |
| SQSD(Beaver)Backbone=Llama3.1-8B-Instruct, Fine-tuning Dataset=Alpaca2026.05 | 77.5 | 10.19 | 9.04 | 3.27 | 0.38 | 77.12 | — | |
| Self-Inf-NBackbone=Llama3.1-8B-Instruct, Fine-tuning Dataset=Alpaca2026.05 | 86.92 | 14.62 | 14.62 | 63.65 | 81.15 | 5.77 | — | |
| SQSD(Beaver)Backbone=Llama3.1-8B-Instruct, Fine-tuning Dataset=Dolly2026.05 | 89.23 | 58.65 | 33.65 | 4.62 | 1.15 | 88.08 | — | |
| SQSD(Aegis)Backbone=Llama3.1-8B-Instruct, Fine-tuning Dataset=Dolly2026.05 | 90.19 | 18.08 | 31.92 | 5.77 | 4.81 | 85.38 | — |