Safety Evaluation on WildJailbreak (held-out)
0Attack Success Rate (ASR)NeST
Evaluation Results
| Method | Links | |
|---|---|---|
| NeSTTarget Model=Phi-42026.02 | 0 | |
| Full FTTarget Model=gemma-2b-it2026.02 | 0.1 | |
| Full FTTarget Model=Phi-4-mini2026.02 | 0.3 | |
| Full FTTarget Model=gemma-7b-it2026.02 | 0.4 | |
| Full FTTarget Model=Qwen3-14B2026.02 | 0.6 | |
| NeSTTarget Model=gemma-2b-it2026.02 | 0.7 | |
| Full FTTarget Model=Qwen3-4B2026.02 | 0.7 | |
| Full FTTarget Model=Qwen2.5-14B2026.02 | 0.8 | |
| LoRATarget Model=Llama-3.2-1B2026.02 | 1.4 | |
| NeSTTarget Model=Qwen3-4B2026.02 | 1.5 | |
| Full FTTarget Model=Qwen2.5-7B2026.02 | 1.6 | |
| LoRATarget Model=Qwen3-4B2026.02 | 1.6 | |
| NeSTTarget Model=Llama-3.2-1B2026.02 | 1.7 | |
| Full FTTarget Model=Llama-3.2-3B2026.02 | 1.9 | |
| Full FTTarget Model=Phi-42026.02 | 1.9 | |
| Full FTTarget Model=Llama-3.2-1B2026.02 | 2.1 | |
| NeSTTarget Model=Llama-3.2-3B2026.02 | 2.8 | |
| LoRATarget Model=Qwen3-14B2026.02 | 2.8 | |
| NeSTTarget Model=Qwen2.5-14B2026.02 | 2.9 | |
| LoRATarget Model=Llama-3.2-3B2026.02 | 3.4 | |
| NeSTTarget Model=gemma-7b-it2026.02 | 4.1 | |
| LoRATarget Model=gemma-2b-it2026.02 | 4.2 | |
| LoRATarget Model=Phi-4-mini2026.02 | 5.7 | |
| LoRATarget Model=gemma-7b-it2026.02 | 6.6 | |
| NeSTTarget Model=Phi-4-mini2026.02 | 6.7 | |
| NeSTTarget Model=Qwen2.5-7B2026.02 | 11 | |
| NeSTTarget Model=Qwen3-14B2026.02 | 12.2 | |
| LoRATarget Model=Qwen2.5-14B2026.02 | 13 | |
| LoRATarget Model=Phi-42026.02 | 17.8 | |
| LoRATarget Model=Qwen2.5-7B2026.02 | 19.2 | |
| BaselineTarget Model=gemma-2b-it2026.02 | 22 | |
| BaselineTarget Model=Phi-42026.02 | 25.2 | |
| BaselineTarget Model=Phi-4-mini2026.02 | 25.7 | |
| BaselineTarget Model=gemma-7b-it2026.02 | 34 | |
| Circuit BreakerTarget Model=gemma-2b-it, Protocol=Exp.2026.02 | 39.7 | |
| BaselineTarget Model=Llama-3.2-1B2026.02 | 40.5 | |
| Circuit BreakerTarget Model=gemma-7b-it, Protocol=Exp.2026.02 | 40.6 | |
| Circuit BreakerTarget Model=Phi-4-mini, Protocol=Exp.2026.02 | 44.5 | |
| BaselineTarget Model=Qwen3-14B2026.02 | 50.9 | |
| BaselineTarget Model=Llama-3.2-3B2026.02 | 54.2 | |
| Circuit BreakerTarget Model=Llama-3.2-1B, Protocol=Exp.2026.02 | 58.1 | |
| BaselineTarget Model=Qwen2.5-14B2026.02 | 58.1 | |
| BaselineTarget Model=Qwen3-4B2026.02 | 65.1 | |
| Circuit BreakerTarget Model=Qwen2.5-14B, Protocol=Exp.2026.02 | 65.2 | |
| Circuit BreakerTarget Model=Phi-4, Protocol=Exp.2026.02 | 68.2 | |
| BaselineTarget Model=Qwen2.5-7B2026.02 | 69.4 | |
| Circuit BreakerTarget Model=Qwen3-14B, Protocol=Exp.2026.02 | 72.1 | |
| Circuit BreakerTarget Model=Llama-3.2-3B, Protocol=Exp.2026.02 | 74.8 | |
| Circuit BreakerTarget Model=Qwen3-4B, Protocol=Exp.2026.02 | 76.4 | |
| Circuit BreakerTarget Model=Qwen2.5-7B, Protocol=Exp.2026.02 | 79.1 |