Safety Evaluation on HEx-PHI (Attack Success Rate (%))
1.8Attack Success Rate (ASR)DR-SFT
Evaluation results
| Method | Links | |
|---|---|---|
| DR-SFTBackbone=Llama-2-7B-Chat, Fine-tuning protocol=LoRA2026.06 | 1.8 | |
| Constrained SFTBackbone=Llama-2-7B-Chat, Fine-tuning protocol=LoRA2026.06 | 4.6 | |
| RandomModel=Llama3.1, Fine-tuning Source=Alpaca, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 5.17 | |
| RandomModel=Llama3.1, Fine-tuning Source=Dolly, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 5.17 | |
| InstructModel=Llama3, Fine-tuning Source=Alpaca, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 5.86 | |
| InstructModel=Llama3, Fine-tuning Source=Dolly, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 5.86 | |
| Base ModelBackbone=Llama3-8B-Instruct, Fine-tuning Dataset=None, Filtering Method=None2026.05 | 5.86 | |
| GradSafeModel=Llama3.1, Fine-tuning Source=Alpaca, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 5.88 | |
| DataShieldBackbone=Llama3-8B-Instruct, Fine-tuning Dataset=Alpaca Dataset, Filtering Method=Ours2026.05 | 6.21 | |
| Bi-AnchorModel=Qwen2.5, Fine-tuning Source=Alpaca, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 6.55 | |
| SEALModel=Llama3, Fine-tuning Source=Alpaca, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 6.9 | |
| SEALModel=Llama3.1, Fine-tuning Source=Alpaca, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 6.9 | |
| SEALModel=Llama3, Fine-tuning Source=Dolly, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 7.24 | |
| InstructModel=Llama3.1, Fine-tuning Source=Alpaca, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 7.93 | |
| InstructModel=Llama3.1, Fine-tuning Source=Dolly, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 7.93 | |
| Base ModelBackbone=Llama3.1-8B-Instruct, Fine-tuning Dataset=None, Filtering Method=None2026.05 | 7.93 | |
| LARFBackbone=Llama3-8B-Instruct, Fine-tuning Dataset=Alpaca Dataset, Filtering Method=LARF2026.05 | 8.62 | |
| RandomModel=Qwen2.5, Fine-tuning Source=Alpaca, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 9.31 | |
| RandomModel=Qwen2.5, Fine-tuning Source=Dolly, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 9.31 | |
| Bi-AnchoringBackbone=Llama3-8B-Instruct, Fine-tuning Dataset=Alpaca Dataset, Filtering Method=Bi-Anchoring2026.05 | 9.31 | |
| RandomModel=Llama3, Fine-tuning Source=Alpaca, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 9.66 | |
| RandomModel=Llama3, Fine-tuning Source=Dolly, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 9.66 | |
| SEALBackbone=Llama3-8B-Instruct, Fine-tuning Dataset=Alpaca Dataset, Filtering Method=SEAL2026.05 | 10 | |
| DataShieldBackbone=Llama3.1-8B-Instruct, Fine-tuning Dataset=Alpaca Dataset, Filtering Method=Ours2026.05 | 10.34 | |
| GradSafeBackbone=Llama3-8B-Instruct, Fine-tuning Dataset=Alpaca Dataset, Filtering Method=GradSafe2026.05 | 10.34 | |
| InstructModel=Qwen2.5, Fine-tuning Source=Alpaca, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 10.69 | |
| InstructModel=Qwen2.5, Fine-tuning Source=Dolly, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 10.69 | |
| Base ModelBackbone=Qwen2.5-7B-Instruct, Fine-tuning Dataset=None, Filtering Method=None2026.05 | 10.69 | |
| DataShieldBackbone=Qwen2.5-7B-Instruct, Fine-tuning Dataset=Alpaca Dataset, Filtering Method=Ours2026.05 | 11.03 | |
| Bi-AnchorModel=Llama3.1, Fine-tuning Source=Alpaca, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 11.38 | |
| GradSafeModel=Llama3, Fine-tuning Source=Alpaca, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 12.41 | |
| LARFBackbone=Llama3.1-8B-Instruct, Fine-tuning Dataset=Alpaca Dataset, Filtering Method=LARF2026.05 | 14.14 | |
| GradSafeModel=Qwen2.5, Fine-tuning Source=Alpaca, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 14.83 | |
| Without FilteringBackbone=Llama3-8B-Instruct, Fine-tuning Dataset=Alpaca Dataset, Filtering Method=Without Filtering2026.05 | 14.83 | |
| LARFBackbone=Qwen2.5-7B-Instruct, Fine-tuning Dataset=Alpaca Dataset, Filtering Method=LARF2026.05 | 14.83 | |
| SEALModel=Qwen2.5, Fine-tuning Source=Alpaca, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 15.17 | |
| GuardModel=Llama3.1, Fine-tuning Source=Alpaca, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 16.21 | |
| SEALBackbone=Llama3.1-8B-Instruct, Fine-tuning Dataset=Alpaca Dataset, Filtering Method=SEAL2026.05 | 16.55 | |
| LARFModel=Llama3.1, Fine-tuning Source=Alpaca, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 17.93 | |
| DataShieldBackbone=Llama3.1-8B-Instruct, Fine-tuning Dataset=Dolly Dataset, Filtering Method=Ours2026.05 | 17.93 | |
| LisaBackbone=Llama-2-7B-Chat, Fine-tuning protocol=LoRA2026.06 | 18.1 | |
| GuardModel=Llama3, Fine-tuning Source=Alpaca, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 20 | |
| SEALBackbone=Qwen2.5-7B-Instruct, Fine-tuning Dataset=Alpaca Dataset, Filtering Method=SEAL2026.05 | 20.68 | |
| DataShieldModel=Llama3.1, Fine-tuning Source=Alpaca, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 22.41 | |
| DataShieldModel=Qwen2.5, Fine-tuning Source=Alpaca, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 23.45 | |
| GuardModel=Qwen2.5, Fine-tuning Source=Alpaca, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 24.14 | |
| Bi-AnchorModel=Llama3, Fine-tuning Source=Alpaca, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 24.48 | |
| LARFModel=Qwen2.5, Fine-tuning Source=Alpaca, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 25.52 | |
| GGROModel=LLaMA-3.1-8B-Instruct + Skywork-Reward-V2-LLaMA-3.1-8B2026.06 | 26.2 | |
| LARFBackbone=Llama3.1-8B-Instruct, Fine-tuning Dataset=Dolly Dataset, Filtering Method=LARF2026.05 | 26.89 | |
| LARFModel=Llama3, Fine-tuning Source=Alpaca, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 26.9 | |
| Bi-AnchoringBackbone=Llama3.1-8B-Instruct, Fine-tuning Dataset=Alpaca Dataset, Filtering Method=Bi-Anchoring2026.05 | 27.93 | |
| SEALBackbone=Llama3.1-8B-Instruct, Fine-tuning Dataset=Dolly Dataset, Filtering Method=SEAL2026.05 | 29.65 | |
| GuardModel=Llama3.1, Fine-tuning Source=Dolly, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 30.34 | |
| GradSafeModel=Llama3.1, Fine-tuning Source=Dolly, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 31.03 | |
| GradSafeBackbone=Llama3.1-8B-Instruct, Fine-tuning Dataset=Alpaca Dataset, Filtering Method=GradSafe2026.05 | 31.38 | |
| BoN (N=64)Model=LLaMA-3.1-8B-Instruct + Skywork-Reward-V2-LLaMA-3.1-8B2026.06 | 34.3 | |
| Without FilteringBackbone=Llama3.1-8B-Instruct, Fine-tuning Dataset=Alpaca Dataset, Filtering Method=Without Filtering2026.05 | 34.48 | |
| CBSModel=LLaMA-3.1-8B-Instruct + Skywork-Reward-V2-LLaMA-3.1-8B2026.06 | 34.9 | |
| CARDSModel=LLaMA-3.1-8B-Instruct + Skywork-Reward-V2-LLaMA-3.1-8B2026.06 | 35.6 | |
| DataShieldBackbone=Qwen2.5-7B-Instruct, Fine-tuning Dataset=Dolly Dataset, Filtering Method=Ours2026.05 | 37.59 | |
| SEALModel=Llama3.1, Fine-tuning Source=Dolly, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 38.62 | |
| GradSafeModel=Qwen2.5, Fine-tuning Source=Dolly, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 38.97 | |
| DataShieldModel=Llama3, Fine-tuning Source=Alpaca, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 39.66 | |
| DataShieldBackbone=Llama3-8B-Instruct, Fine-tuning Dataset=Dolly Dataset, Filtering Method=Ours2026.05 | 40.69 | |
| SEAModel=LLaMA-3.1-8B-Instruct + Skywork-Reward-V2-LLaMA-3.1-8B2026.06 | 42.2 | |
| GradSafeBackbone=Qwen2.5-7B-Instruct, Fine-tuning Dataset=Alpaca Dataset, Filtering Method=GradSafe2026.05 | 42.41 | |
| LARFBackbone=Qwen2.5-7B-Instruct, Fine-tuning Dataset=Dolly Dataset, Filtering Method=LARF2026.05 | 43.1 | |
| ARGS-GModel=LLaMA-3.1-8B-Instruct + Skywork-Reward-V2-LLaMA-3.1-8B2026.06 | 43.1 | |
| LARFBackbone=Llama3-8B-Instruct, Fine-tuning Dataset=Dolly Dataset, Filtering Method=LARF2026.05 | 44.8 | |
| RSModel=LLaMA-3.1-8B-Instruct + Skywork-Reward-V2-LLaMA-3.1-8B2026.06 | 47.1 | |
| Bi-AnchoringBackbone=Llama3.1-8B-Instruct, Fine-tuning Dataset=Dolly Dataset, Filtering Method=Bi-Anchoring2026.05 | 47.59 | |
| SEALBackbone=Llama3-8B-Instruct, Fine-tuning Dataset=Dolly Dataset, Filtering Method=SEAL2026.05 | 48.27 | |
| SEALBackbone=Qwen2.5-7B-Instruct, Fine-tuning Dataset=Dolly Dataset, Filtering Method=SEAL2026.05 | 48.27 | |
| Bi-AnchoringBackbone=Qwen2.5-7B-Instruct, Fine-tuning Dataset=Alpaca Dataset, Filtering Method=Bi-Anchoring2026.05 | 48.28 | |
| Bi-AnchoringBackbone=Qwen2.5-7B-Instruct, Fine-tuning Dataset=Dolly Dataset, Filtering Method=Bi-Anchoring2026.05 | 48.97 | |
| LARFModel=Llama3.1, Fine-tuning Source=Dolly, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 49.66 | |
| SEALModel=Qwen2.5, Fine-tuning Source=Dolly, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 51.03 | |
| Without FilteringBackbone=Qwen2.5-7B-Instruct, Fine-tuning Dataset=Alpaca Dataset, Filtering Method=Without Filtering2026.05 | 51.38 | |
| Vanilla LLMModel=LLaMA-3.1-8B-Instruct + Skywork-Reward-V2-LLaMA-3.1-8B2026.06 | 54 | |
| Bi-AnchorModel=Llama3.1, Fine-tuning Source=Dolly, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 54.14 | |
| GradSafeBackbone=Llama3.1-8B-Instruct, Fine-tuning Dataset=Dolly Dataset, Filtering Method=GradSafe2026.05 | 54.14 | |
| Bi-AnchorModel=Qwen2.5, Fine-tuning Source=Dolly, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 56.9 | |
| GGROModel=LLaMA-3.2-3B-Instruct + GRM-LLaMA-3.2-3B-rewardmodel-ft2026.06 | 59.4 | |
| Standard SFTBackbone=Llama3.1-8B-Instruct, Fine-tuning Dataset=Dolly Dataset, Filtering Method=Standard SFT2026.05 | 59.66 | |
| CARDSModel=LLaMA-3.2-3B-Instruct + GRM-LLaMA-3.2-3B-rewardmodel-ft2026.06 | 60.5 | |
| CBSModel=LLaMA-3.2-3B-Instruct + GRM-LLaMA-3.2-3B-rewardmodel-ft2026.06 | 63.5 | |
| SEAModel=LLaMA-3.2-3B-Instruct + GRM-LLaMA-3.2-3B-rewardmodel-ft2026.06 | 64.1 | |
| ARGS-GModel=LLaMA-3.2-3B-Instruct + GRM-LLaMA-3.2-3B-rewardmodel-ft2026.06 | 64.8 | |
| DataShieldModel=Llama3.1, Fine-tuning Source=Dolly, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 65.52 | |
| LARFModel=Qwen2.5, Fine-tuning Source=Dolly, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 65.86 | |
| BoN (N=64)Model=LLaMA-3.2-3B-Instruct + GRM-LLaMA-3.2-3B-rewardmodel-ft2026.06 | 65.9 | |
| GradSafeBackbone=Llama3-8B-Instruct, Fine-tuning Dataset=Dolly Dataset, Filtering Method=GradSafe2026.05 | 67.59 | |
| GradSafeBackbone=Qwen2.5-7B-Instruct, Fine-tuning Dataset=Dolly Dataset, Filtering Method=GradSafe2026.05 | 67.59 | |
| Vanilla LLMModel=LLaMA-3.2-3B-Instruct + GRM-LLaMA-3.2-3B-rewardmodel-ft2026.06 | 67.8 | |
| RSModel=LLaMA-3.2-3B-Instruct + GRM-LLaMA-3.2-3B-rewardmodel-ft2026.06 | 68.6 | |
| Without FilteringBackbone=Llama3-8B-Instruct, Fine-tuning Dataset=Dolly Dataset, Filtering Method=Without Filtering2026.05 | 70.69 | |
| GuardModel=Llama3, Fine-tuning Source=Dolly, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 71.38 | |
| GuardModel=Qwen2.5, Fine-tuning Source=Dolly, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 74.14 | |
| LARFModel=Llama3, Fine-tuning Source=Dolly, Selection Protocol=Top-1000 safety-degrading samples2026.05 | 75.86 |