Safety Evaluation on DAN
91Safety Score (DAN)VCL
Evaluation results
| Method | Links | ||||
|---|---|---|---|---|---|
| VCLBase Model=Llama-3.1-8B2026.03 | 91 | — | — | — | |
| Vector AblationBase Model=Llama-3.1-8B2026.03 | 86 | — | — | — | |
| DROBase Model=Llama-3.1-8B2026.03 | 83 | — | — | — | |
| Llama-3.1-8B-SFTBase Model=Llama-3.1-8B2026.03 | 82 | — | — | — | |
| System PromptBase Model=Llama-3.1-8B2026.03 | 82 | — | — | — | |
| Self-CDBase Model=Llama-3.1-8B2026.03 | 80 | — | — | — | |
| Causal-DRPolicy Model=LLaMA2-7B2026.03 | 0.807 | 12.2 | — | — | |
| Causal-IPSPolicy Model=LLaMA2-7B2026.03 | 0.795 | 10.5 | — | — | |
| SelectiveRMBackbone=LLaMA2-7B2026.05 | 0.795 | 1.66 | — | — | |
| ILDEBackbone=LLaMA2-7B2026.05 | 0.786 | 0.51 | — | — | |
| CSGNBackbone=LLaMA2-7B2026.05 | 0.784 | 0.18 | — | — | |
| SDRPolicy Model=LLaMA2-7B2026.03 | 0.782 | 8.7 | — | — | |
| NaiveBackbone=LLaMA2-7B2026.05 | 0.782 | — | — | — | |
| ILDEPolicy Model=LLaMA2-7B2026.03 | 0.776 | 7.8 | — | — | |
| IPSPolicy Model=LLaMA2-7B2026.03 | 0.751 | 4.4 | — | — | |
| NaivePolicy Model=LLaMA2-7B2026.03 | 0.72 | — | — | — | |
| SelectiveRMBackbone=Qwen2.5-7B2026.05 | 0.684 | 3.89 | — | — | |
| Causal-DRPolicy Model=Qwen2.5-7B2026.03 | 0.68 | 19.6 | — | — | |
| ILDEBackbone=Qwen2.5-7B2026.05 | 0.671 | 1.94 | — | — | |
| CSGNBackbone=Qwen2.5-7B2026.05 | 0.668 | 1.5 | — | — | |
| Causal-IPSPolicy Model=Qwen2.5-7B2026.03 | 0.663 | 16.7 | — | — | |
| NaiveBackbone=Qwen2.5-7B2026.05 | 0.658 | — | — | — | |
| ILDEPolicy Model=Qwen2.5-7B2026.03 | 0.656 | 15.4 | — | — | |
| SDRPolicy Model=Qwen2.5-7B2026.03 | 0.653 | 14.9 | — | — | |
| IPSPolicy Model=Qwen2.5-7B2026.03 | 0.602 | 5.9 | — | — | |
| NaivePolicy Model=Qwen2.5-7B2026.03 | 0.569 | — | — | — | |
| AdvGameAttacker=Qwen2.5-7B2026.06 | — | — | — | 0.103 | |
| AdvGRPO (ST)Attacker=Qwen2.5-7B2026.06 | — | — | — | 0.073 | |
| AdvGRPO (ST)Attacker=Qwen2.5-14B2026.06 | — | — | — | 0.04 | |
| BaseAttacker=None2026.06 | — | — | — | 0.393 | |
| KLSelection Criterion=KL2026.04 | — | — | 19.1 | — | |
| Latent SimilaritySelection Criterion=Latent Similarity, Layer=122026.04 | — | — | 28.2 | — | |
| Latent SimilaritySelection Criterion=Latent Similarity, Layer=Best Layer2026.04 | — | — | 42.2 | — | |
| PerplexitySelection Criterion=Perplexity2026.04 | — | — | -26.2 | — | |
| RandomSelection Criterion=Random2026.04 | — | — | -1.5 | — | |
| Self CertaintySelection Criterion=Self Certainty2026.04 | — | — | -46.2 | — | |
| Self-RedTeamAttacker=Qwen2.5-7B2026.06 | — | — | — | 0.366 |