Safety Evaluation on Harmbench
0.06Harmbench ScoreNPO
Evaluation results
| Method | Links | |
|---|---|---|
| NPOBackbone=Mistral 7B Instruct-v0.22025.04 | 0.06 | |
| Safety PromptingBackbone=Llama3 8B Instruct2025.04 | 0.31 | |
| REPBENDBackbone=Llama3 8B Instruct2025.04 | 0.31 | |
| REPBENDBackbone=Mistral 7B Instruct-v0.22025.04 | 1.56 | |
| SFTBackbone=Llama3 8B Instruct2025.04 | 1.56 | |
| TABackbone=Llama3 8B Instruct2025.04 | 1.87 | |
| SafetyBase Model=Llama-3.1-8B2026.01 | 2 | |
| LEDMerging Protocol=LED2026.01 | 2 | |
| ReasonAnyMerging Protocol=ReasonAny2026.01 | 2 | |
| NPOBackbone=Llama3 8B Instruct2025.04 | 2.19 | |
| REDIPOModel=Qwen3-4B2026.05 | 2.9 | |
| DAREModel Family=Qwen2.5-14B2026.01 | 3 | |
| ReasonAnyModel Family=Qwen2.5-14B2026.01 | 3 | |
| DPOBackbone=Llama3 8B Instruct2025.04 | 3.13 | |
| TABackbone=Mistral 7B Instruct-v0.22025.04 | 3.75 | |
| RMUBackbone=Mistral 7B Instruct-v0.22025.04 | 3.75 | |
| CBBackbone=Llama3 8B Instruct2025.04 | 3.75 | |
| Qwen2.5-32B-Instruct (Safety)Model Family=Qwen2.5-32B2026.01 | 4 | |
| ReasonAnyModel Family=Qwen2.5-32B2026.01 | 4 | |
| LinearMerging Protocol=Linear2026.01 | 4 | |
| DAREMerging Protocol=DARE2026.01 | 4 | |
| InstructModel=Qwen3-4B2026.05 | 4.2 | |
| SFTBackbone=Mistral 7B Instruct-v0.22025.04 | 4.69 | |
| DivPOModel=Qwen3-4B2026.05 | 5 | |
| NPO (W/O safe set)Backbone=Mistral 7B Instruct-v0.22025.04 | 5.63 | |
| R2D2*Backbone=Mistral 7B Instruct-v0.2, publicly_available_safety_tuned=true2025.04 | 5.63 | |
| LinearModel Family=Qwen2.5-32B2026.01 | 6 | |
| DAREModel Family=Qwen2.5-32B2026.01 | 6 | |
| Qwen2.5-14B-Instruct (Safety)Model Family=Qwen2.5-14B2026.01 | 6 | |
| DPOModel=Qwen3-4B2026.05 | 6.3 | |
| REDIPOModel=OLMo-3-7B2026.05 | 8.3 | |
| Task ArithmeticModel Family=Qwen2.5-14B2026.01 | 9 | |
| DPOModel=OLMo-3-7B2026.05 | 9.2 | |
| DivPOModel=OLMo-3-7B2026.05 | 9.2 | |
| RMUBackbone=Llama3 8B Instruct2025.04 | 9.37 | |
| Surgery2026.02 | 9.5 | |
| LinearModel Family=Qwen2.5-14B2026.01 | 10 | |
| InstructModel=OLMo-3-7B2026.05 | 10.4 | |
| Task ArithmeticModel Family=Qwen2.5-32B2026.01 | 11 | |
| NPO (W/O safe set)Backbone=Llama3 8B Instruct2025.04 | 11.25 | |
| WHPBackbone=Llama3 8B Instruct2025.04 | 12.5 | |
| FuseLLMMerging Protocol=FuseLLM2026.01 | 13 | |
| BaseModel=Qwen2.5-14B-it, Fine-tuning Task=AGNews2026.04 | 13 | |
| BaseModel=Qwen2.5-14B-it, Fine-tuning Task=MedicalQA2026.04 | 13 | |
| BaseModel=Qwen2.5-14B-it, Fine-tuning Task=GSM8K2026.04 | 13 | |
| SPAModel=Qwen2.5-14B-it, Fine-tuning Task=GSM8K2026.04 | 13.1 | |
| CB*Backbone=Mistral 7B Instruct-v0.2, publicly_available_safety_tuned=true2025.04 | 13.44 | |
| CB*Backbone=Llama3 8B Instruct, publicly_available_safety_tuned=true2025.04 | 13.44 | |
| SPAModel=Qwen2.5-14B-it, Fine-tuning Task=MedicalQA2026.04 | 14 | |
| SPAModel=Qwen2.5-14B-it, Fine-tuning Task=AGNews2026.04 | 14.1 | |
| BaseModel=Llama3-8B-it, Fine-tuning Task=AGNews2026.04 | 15 | |
| BaseModel=Llama3-8B-it, Fine-tuning Task=MedicalQA2026.04 | 15 | |
| BaseModel=Llama3-8B-it, Fine-tuning Task=GSM8K2026.04 | 15 | |
| SPAModel=Llama3-8B-it, Fine-tuning Task=GSM8K2026.04 | 15.6 | |
| SPAModel=Llama3-8B-it, Fine-tuning Task=AGNews2026.04 | 15.8 | |
| Task ArithmeticMerging Protocol=Task Arithmetic2026.01 | 16 | |
| SPAModel=Llama3-8B-it, Fine-tuning Task=MedicalQA2026.04 | 16.1 | |
| CBBackbone=Mistral 7B Instruct-v0.22025.04 | 16.25 | |
| WHP (W/O safe set)Backbone=Llama3 8B Instruct2025.04 | 18.75 | |
| REDIPOModel=LLaMA-3.1-8B2026.05 | 19.2 | |
| Safety PromptingBackbone=Mistral 7B Instruct-v0.22025.04 | 20 | |
| TIESMerging Protocol=TIES2026.01 | 20 | |
| RSN-TuneModel=Qwen2.5-14B-it, Fine-tuning Task=MedicalQA2026.04 | 20.7 | |
| Lisa2026.02 | 20.75 | |
| DeepSeek-R1-Distill-Qwen-14B (Reasoning)Model Family=Qwen2.5-14B2026.01 | 21 | |
| RSN-TuneModel=Qwen2.5-14B-it, Fine-tuning Task=AGNews2026.04 | 21.2 | |
| ConstrainedSFT2026.02 | 21.25 | |
| RandomModel=Qwen2.5-14B-it, Fine-tuning Task=MedicalQA2026.04 | 21.8 | |
| OriginalBackbone=Llama3 8B Instruct2025.04 | 22.19 | |
| RSN-TuneModel=Qwen2.5-14B-it, Fine-tuning Task=GSM8K2026.04 | 22.3 | |
| AsFT2026.02 | 22.5 | |
| InstructModel=LLaMA-3.1-8B2026.05 | 22.5 | |
| RandomModel=Qwen2.5-14B-it, Fine-tuning Task=AGNews2026.04 | 22.6 | |
| RSN-TuneModel=Llama3-8B-it, Fine-tuning Task=MedicalQA2026.04 | 22.8 | |
| SafeGrad2026.02 | 23.5 | |
| RandomModel=Qwen2.5-14B-it, Fine-tuning Task=GSM8K2026.04 | 23.7 | |
| RSN-TuneModel=Llama3-8B-it, Fine-tuning Task=AGNews2026.04 | 23.9 | |
| RandomModel=Llama3-8B-it, Fine-tuning Task=MedicalQA2026.04 | 24.1 | |
| DSS2026.02 | 24.5 | |
| RSN-TuneModel=Llama3-8B-it, Fine-tuning Task=GSM8K2026.04 | 24.6 | |
| DivPOModel=LLaMA-3.1-8B2026.05 | 25 | |
| RandomModel=Llama3-8B-it, Fine-tuning Task=AGNews2026.04 | 25.4 | |
| DPOBackbone=Mistral 7B Instruct-v0.22025.04 | 25.63 | |
| DeepSeek-R1-Distill-Qwen-32B (Reasoning)Model Family=Qwen2.5-32B2026.01 | 26 | |
| RandomModel=Llama3-8B-it, Fine-tuning Task=GSM8K2026.04 | 26.1 | |
| SFT2026.02 | 28.75 | |
| FuseLLMModel Family=Qwen2.5-14B2026.01 | 29 | |
| SPARD2026.02 | 30 | |
| ReasoningBase Model=Llama-3.1-8B2026.01 | 30 | |
| BaseModel=Qwen2.5-7B-it, Fine-tuning Task=AGNews2026.04 | 32 | |
| BaseModel=Qwen2.5-7B-it, Fine-tuning Task=MedicalQA2026.04 | 32 | |
| BaseModel=Qwen2.5-7B-it, Fine-tuning Task=GSM8K2026.04 | 32 | |
| SPAModel=Qwen2.5-7B-it, Fine-tuning Task=GSM8K2026.04 | 32.6 | |
| LEDModel Family=Qwen2.5-32B2026.01 | 33 | |
| SPAModel=Qwen2.5-7B-it, Fine-tuning Task=MedicalQA2026.04 | 33 | |
| SPAModel=Qwen2.5-7B-it, Fine-tuning Task=AGNews2026.04 | 33.1 | |
| WHPBackbone=Mistral 7B Instruct-v0.22025.04 | 33.13 | |
| DeepSeek-R1Evaluation Source=Reproduced, Chain of Thought=visible, Risk Control System=Disabled2025.01 | 35 | |
| FuseLLMModel Family=Qwen2.5-32B2026.01 | 35 | |
| LEDModel Family=Qwen2.5-14B2026.01 | 35 |