Safety Evaluation on XSTest Unsafe
0False Refusal Rate (FR)No Defense
Evaluation Results
| Method | Links | |||
|---|---|---|---|---|
| No DefenseModel=R1-Qwen-7B, Output Component=Reasoning2025.08 | 0 | 32 | 68 | |
| SafeDecodingModel=R1-Qwen-7B, Output Component=Reasoning2025.08 | 0 | 28 | 72 | |
| ParaphraseModel=R1-Qwen-7B, Output Component=Reasoning2025.08 | 0 | 24 | 76 | |
| Self-ReminderModel=R1-Qwen-7B, Output Component=Reasoning2025.08 | 0 | 8 | 92 | |
| SmoothLLMModel=R1-Qwen-7B, Output Component=Reasoning2025.08 | 0 | 20 | 80 | |
| No DefenseModel=R1-Llama-8B, Output Component=Reasoning2025.08 | 0 | 26 | 74 | |
| SafeDecodingModel=R1-Llama-8B, Output Component=Reasoning2025.08 | 0 | 24 | 76 | |
| No DefenseModel=R1-Qwen-14B, Evaluation Component=Reasoning2025.08 | 0 | 16 | 84 | |
| ParaphraseModel=R1-Qwen-14B, Evaluation Component=Reasoning2025.08 | 0 | 32 | 68 | |
| ParaphraseModel=R1-Qwen-32B, Evaluation Component=Reasoning2025.08 | 0 | 40 | 60 | |
| Self-ReminderModel=R1-Qwen-32B, Evaluation Component=Reasoning2025.08 | 0 | 14 | 86 | |
| Random featureModel=Qwen3-1.7B-it2026.06 | 0 | — | — | |
| No DefenseModel=R1-Llama-8B, Output Component=Final Answer2025.08 | 2 | 54 | 44 | |
| SafeDecodingModel=R1-Llama-8B, Output Component=Final Answer2025.08 | 2 | 50 | 48 | |
| ParaphraseModel=R1-Llama-8B, Output Component=Reasoning2025.08 | 2 | 38 | 60 | |
| ParaphraseModel=R1-Llama-8B, Output Component=Final Answer2025.08 | 2 | 54 | 44 | |
| Self-ReminderModel=R1-Llama-8B, Output Component=Reasoning2025.08 | 2 | 12 | 86 | |
| No DefenseModel=R1-Qwen-32B, Evaluation Component=Reasoning2025.08 | 2 | 24 | 74 | |
| ReasoningGuardModel=R1-Qwen-32B, Evaluation Component=Reasoning2025.08 | 2 | 2 | 96 | |
| Random featureModel=Qwen3-4B-it2026.06 | 2.3 | — | — | |
| ParaphraseModel=R1-Qwen-7B, Output Component=Final Answer2025.08 | 4 | 52 | 44 | |
| SmoothLLMModel=R1-Qwen-7B, Output Component=Final Answer2025.08 | 4 | 36 | 60 | |
| SmoothLLMModel=R1-Qwen-14B, Evaluation Component=Reasoning2025.08 | 4 | 22 | 74 | |
| ReasoningGuardModel=R1-Qwen-14B, Evaluation Component=Reasoning2025.08 | 4 | 0 | 96 | |
| SmoothLLMModel=R1-Qwen-32B, Evaluation Component=Reasoning2025.08 | 4 | 30 | 66 | |
| SafeDecodingModel=R1-Qwen-7B, Output Component=Final Answer2025.08 | 6 | 48 | 46 | |
| SmoothLLMModel=R1-Llama-8B, Output Component=Reasoning2025.08 | 6 | 32 | 62 | |
| ReasoningGuardModel=R1-Llama-8B, Output Component=Reasoning2025.08 | 6 | 2 | 92 | |
| No DefenseModel=R1-Qwen-14B, Evaluation Component=Final Answer2025.08 | 6 | 46 | 48 | |
| SAFEPATH-ZSModel=R1-Qwen-14B, Evaluation Component=Reasoning2025.08 | 6 | 14 | 80 | |
| SmoothLLMModel=R1-Qwen-32B, Evaluation Component=Final Answer2025.08 | 6 | 44 | 50 | |
| SAFEPATH-ZSModel=R1-Qwen-32B, Evaluation Component=Reasoning2025.08 | 6 | 12 | 82 | |
| ReasoningGuardModel=R1-Qwen-7B, Output Component=Reasoning2025.08 | 8 | 0 | 92 | |
| ParaphraseModel=R1-Qwen-32B, Evaluation Component=Final Answer2025.08 | 8 | 52 | 40 | |
| Self-ReminderModel=R1-Qwen-14B, Evaluation Component=Reasoning2025.08 | 10 | 10 | 80 | |
| SmoothLLMModel=R1-Qwen-14B, Evaluation Component=Final Answer2025.08 | 10 | 44 | 46 | |
| No DefenseModel=R1-Qwen-7B, Output Component=Final Answer2025.08 | 12 | 42 | 46 | |
| SAFEPATH-ZSModel=R1-Llama-8B, Output Component=Reasoning2025.08 | 12 | 16 | 72 | |
| No DefenseModel=R1-Qwen-32B, Evaluation Component=Final Answer2025.08 | 12 | 46 | 42 | |
| SmoothLLMModel=R1-Llama-8B, Output Component=Final Answer2025.08 | 14 | 40 | 46 | |
| SAFEPATH-ZSModel=R1-Qwen-7B, Output Component=Reasoning2025.08 | 16 | 6 | 78 | |
| ParaphraseModel=R1-Qwen-14B, Evaluation Component=Final Answer2025.08 | 18 | 48 | 34 | |
| SAFEPATH-ZSModel=R1-Qwen-32B, Evaluation Component=Final Answer2025.08 | 22 | 30 | 48 | |
| SafeKeyModel=R1-Llama-8B, Output Component=Reasoning2025.08 | 24 | 0 | 76 | |
| SAFEPATH-FTModel=R1-Qwen-7B, Output Component=Reasoning2025.08 | 26 | 12 | 62 | |
| Self-ReminderModel=R1-Llama-8B, Output Component=Final Answer2025.08 | 26 | 34 | 40 | |
| SAFEPATH-ZSModel=R1-Qwen-14B, Evaluation Component=Final Answer2025.08 | 26 | 28 | 46 | |
| SAFEPATH-ZSModel=R1-Llama-8B, Output Component=Final Answer2025.08 | 28 | 32 | 40 | |
| Self-ReminderModel=R1-Qwen-14B, Evaluation Component=Final Answer2025.08 | 28 | 24 | 48 | |
| ReasoningGuardModel=R1-Qwen-14B, Evaluation Component=Final Answer2025.08 | 28 | 22 | 50 | |
| Self-ReminderModel=R1-Qwen-32B, Evaluation Component=Final Answer2025.08 | 28 | 24 | 48 | |
| SAFEPATH-FTModel=R1-Qwen-7B, Output Component=Final Answer2025.08 | 30 | 16 | 54 | |
| ThinkingIModel=R1-Qwen-32B, Evaluation Component=Reasoning2025.08 | 36 | 10 | 54 | |
| ReasoningGuardModel=R1-Qwen-32B, Evaluation Component=Final Answer2025.08 | 36 | 20 | 44 | |
| RealSafe-R1Model=R1-Llama-8B, Output Component=Reasoning2025.08 | 38 | 2 | 60 | |
| ReasoningGuardModel=R1-Llama-8B, Output Component=Final Answer2025.08 | 38 | 20 | 42 | |
| SafeKeyModel=R1-Qwen-7B, Output Component=Reasoning2025.08 | 40 | 2 | 58 | |
| Self-ReminderModel=R1-Qwen-7B, Output Component=Final Answer2025.08 | 40 | 14 | 46 | |
| SAFEPATH-ZSModel=R1-Qwen-7B, Output Component=Final Answer2025.08 | 40 | 22 | 38 | |
| SafeKeyModel=R1-Qwen-14B, Evaluation Component=Reasoning2025.08 | 40 | 0 | 60 | |
| ThinkingIModel=R1-Qwen-32B, Evaluation Component=Final Answer2025.08 | 40 | 30 | 30 | |
| RealSafe-R1Model=R1-Qwen-7B, Output Component=Reasoning2025.08 | 42 | 0 | 58 | |
| SAFEPATH-FTModel=R1-Llama-8B, Output Component=Reasoning2025.08 | 42 | 6 | 52 | |
| SAFEPATH-FTModel=R1-Llama-8B, Output Component=Final Answer2025.08 | 42 | 22 | 36 | |
| RealSafe-R1Model=R1-Qwen-32B, Evaluation Component=Reasoning2025.08 | 44 | 2 | 54 | |
| RealSafe-R1Model=R1-Qwen-14B, Evaluation Component=Reasoning2025.08 | 46 | 2 | 52 | |
| SafeKeyModel=R1-Llama-8B, Output Component=Final Answer2025.08 | 48 | 2 | 50 | |
| ReasoningGuardModel=R1-Qwen-7B, Output Component=Final Answer2025.08 | 50 | 24 | 26 | |
| SafeKeyModel=R1-Qwen-7B, Output Component=Final Answer2025.08 | 56 | 8 | 36 | |
| ThinkingIModel=R1-Qwen-14B, Evaluation Component=Reasoning2025.08 | 56 | 10 | 34 | |
| ThinkingIModel=R1-Qwen-14B, Evaluation Component=Final Answer2025.08 | 56 | 20 | 24 | |
| No SteeringModel=Qwen3-1.7B-it2026.06 | 59.5 | — | — | |
| SafeKeyModel=R1-Qwen-14B, Evaluation Component=Final Answer2025.08 | 60 | 8 | 32 | |
| ThinkingIModel=R1-Llama-8B, Output Component=Final Answer2025.08 | 64 | 12 | 24 | |
| No SteeringModel=Qwen3-4B-it2026.06 | 68.5 | — | — | |
| ThinkingIModel=R1-Llama-8B, Output Component=Reasoning2025.08 | 74 | 4 | 22 | |
| ThinkingIModel=R1-Qwen-7B, Output Component=Final Answer2025.08 | 76 | 10 | 14 | |
| Target featureModel=Qwen3-1.7B-it2026.06 | 76 | — | — | |
| ThinkingIModel=R1-Qwen-7B, Output Component=Reasoning2025.08 | 78 | 2 | 20 | |
| RealSafe-R1Model=R1-Llama-8B, Output Component=Final Answer2025.08 | 82 | 0 | 18 | |
| RealSafe-R1Model=R1-Qwen-32B, Evaluation Component=Final Answer2025.08 | 82 | 0 | 18 | |
| RealSafe-R1Model=R1-Qwen-14B, Evaluation Component=Final Answer2025.08 | 86 | 4 | 10 | |
| RealSafe-R1Model=R1-Qwen-7B, Output Component=Final Answer2025.08 | 90 | 0 | 10 | |
| Target featureModel=Qwen3-4B-it2026.06 | 95 | — | — |