Transferable Adversarial Attack on HarmBench Classifier (test)
88.6TASR@1SEMA
Evaluation Results
| Method | Links | |
|---|---|---|
| SEMAVictim (Source)=Qwen2.5-3B, Victim (Target)=GPT-4.1-mini, Turns=Multi-turn2026.02 | 88.6 | |
| SEMAVictim (Source)=Llama-3.1-8B, Victim (Target)=GPT-4.1-mini, Turns=Multi-turn2026.02 | 87.6 | |
| CrescendoVictim (Source)=Llama-3.1-8B, Victim (Target)=GPT-4.1-mini, Turns=Multi-turn2026.02 | 81.5 | |
| SEMAVictim (Source)=Qwen2.5-3B, Victim (Target)=Llama-3.1-8B, Turns=Multi-turn2026.02 | 78 | |
| CrescendoVictim (Source)=Qwen2.5-3B, Victim (Target)=GPT-4.1-mini, Turns=Multi-turn2026.02 | 76.9 | |
| ActorAttackVictim (Source)=Qwen2.5-3B, Victim (Target)=GPT-4.1-mini, Turns=Multi-turn2026.02 | 75 | |
| ADV-LLMVictim (Source)=Qwen2.5-3B, Victim (Target)=Llama-3.1-8B, Turns=Single-turn2026.02 | 71.7 | |
| X-TeamingVictim (Source)=Llama-3.1-8B, Victim (Target)=GPT-4.1-mini, Turns=Multi-turn2026.02 | 68.6 | |
| CoAVictim (Source)=Llama-3.1-8B, Victim (Target)=GPT-4.1-mini, Turns=Multi-turn2026.02 | 68.4 | |
| CoAVictim (Source)=Qwen2.5-3B, Victim (Target)=GPT-4.1-mini, Turns=Multi-turn2026.02 | 67.9 | |
| GOATVictim (Source)=Qwen2.5-3B, Victim (Target)=GPT-4.1-mini, Turns=Multi-turn2026.02 | 66.7 | |
| ActorAttackVictim (Source)=Llama-3.1-8B, Victim (Target)=GPT-4.1-mini, Turns=Multi-turn2026.02 | 66.7 | |
| Jigsaw PuzzleVictim (Source)=Llama-3.1-8B, Victim (Target)=GPT-4.1-mini, Turns=Multi-turn2026.02 | 65.4 | |
| Jigsaw PuzzleVictim (Source)=Qwen2.5-3B, Victim (Target)=GPT-4.1-mini, Turns=Multi-turn2026.02 | 64.3 | |
| FITDVictim (Source)=Llama-3.1-8B, Victim (Target)=GPT-4.1-mini, Turns=Multi-turn2026.02 | 63.2 | |
| DPOVictim (Source)=Llama-3.1-8B, Victim (Target)=GPT-4.1-mini, Turns=Multi-turn2026.02 | 62.8 | |
| X-TeamingVictim (Source)=Qwen2.5-3B, Victim (Target)=GPT-4.1-mini, Turns=Multi-turn2026.02 | 62.5 | |
| SFTVictim (Source)=Llama-3.1-8B, Victim (Target)=GPT-4.1-mini, Turns=Multi-turn2026.02 | 60.6 | |
| CrescendoVictim (Source)=Qwen2.5-3B, Victim (Target)=Llama-3.1-8B, Turns=Multi-turn2026.02 | 60 | |
| FITDVictim (Source)=Qwen2.5-3B, Victim (Target)=Llama-3.1-8B, Turns=Multi-turn2026.02 | 60 | |
| FITDVictim (Source)=Qwen2.5-3B, Victim (Target)=GPT-4.1-mini, Turns=Multi-turn2026.02 | 60 | |
| SFTVictim (Source)=Qwen2.5-3B, Victim (Target)=GPT-4.1-mini, Turns=Multi-turn2026.02 | 52.3 | |
| ActorAttackVictim (Source)=Qwen2.5-3B, Victim (Target)=Llama-3.1-8B, Turns=Multi-turn2026.02 | 50 | |
| DPOVictim (Source)=Qwen2.5-3B, Victim (Target)=GPT-4.1-mini, Turns=Multi-turn2026.02 | 50 | |
| GOATVictim (Source)=Llama-3.1-8B, Victim (Target)=GPT-4.1-mini, Turns=Multi-turn2026.02 | 42.9 | |
| Jailbreak-R1Victim (Source)=Llama-3.1-8B, Victim (Target)=GPT-4.1-mini, Turns=Single-turn2026.02 | 41.2 | |
| Jailbreak-R1Victim (Source)=Qwen2.5-3B, Victim (Target)=Llama-3.1-8B, Turns=Single-turn2026.02 | 40.8 | |
| CoAVictim (Source)=Qwen2.5-3B, Victim (Target)=Llama-3.1-8B, Turns=Multi-turn2026.02 | 39.3 | |
| SFTVictim (Source)=Qwen2.5-3B, Victim (Target)=Llama-3.1-8B, Turns=Multi-turn2026.02 | 38.6 | |
| ADV-LLMVictim (Source)=Llama-3.1-8B, Victim (Target)=GPT-4.1-mini, Turns=Single-turn2026.02 | 38.2 | |
| DPOVictim (Source)=Qwen2.5-3B, Victim (Target)=Llama-3.1-8B, Turns=Multi-turn2026.02 | 36.3 | |
| ADV-LLMVictim (Source)=Qwen2.5-3B, Victim (Target)=GPT-4.1-mini, Turns=Single-turn2026.02 | 34 | |
| FlipAttackVictim (Source)=Llama-3.1-8B, Victim (Target)=GPT-4.1-mini, Turns=Single-turn2026.02 | 33.3 | |
| Jigsaw PuzzleVictim (Source)=Qwen2.5-3B, Victim (Target)=Llama-3.1-8B, Turns=Multi-turn2026.02 | 32.1 | |
| Jailbreak-R1Victim (Source)=Qwen2.5-3B, Victim (Target)=GPT-4.1-mini, Turns=Single-turn2026.02 | 26.5 | |
| X-TeamingVictim (Source)=Qwen2.5-3B, Victim (Target)=Llama-3.1-8B, Turns=Multi-turn2026.02 | 26.4 | |
| GOATVictim (Source)=Qwen2.5-3B, Victim (Target)=Llama-3.1-8B, Turns=Multi-turn2026.02 | 8.3 |