What it measures
Open-source robustness benchmark tracking 100 distinct misuse behaviors alongside benign counterparts.
Reading the measurement
Separate satisfying instructions from factual accuracy, human preference and safe behavior. Inspect strict all-constraint success as well as average criterion credit. Judge choice and adversarial prompt selection can materially change the result.
Published evaluation
JBB original-source attack success; JailbreakBench · source-subset comparison. The source’s task split, model configuration and scoring units are retained.
Where this fits in an evaluation suite
Format compliance, preference, truthfulness, and safety require separate measurements. Keep desirable writing style from masking factual errors.
Start with a capability hypothesis, then choose a second test with a different failure mode. Keep the checkpoint, reasoning effort, agent tools, sampling policy, and scoring procedure fixed when measuring a training intervention. Record failures and missing outputs in the denominator.
A reproducible comparison
JBB original-source attack success; JailbreakBench · source-subset comparison. The source’s task split, model configuration and scoring units are retained.
Publish the exact run configuration, item coverage, score units, and available uncertainty. If a source supplies only an aggregate or a single run, preserve that limit. A new model name or a rounded score alone does not establish a capability improvement.
PRIMARY EVIDENCE & FURTHER READING
- JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models — published result table ↗
All 12 authors
Patrick Chao, Edoardo Debenedetti, Alexander Robey, Maksym Andriushchenko, Francesco Croce, Vikash Sehwag, Edgar Dobriban, Nicolas Flammarion, George J. Pappas, Florian Tramer, Hamed Hassani, Eric Wong
Reviewed 2026-10-26. Explanation and interpretation by RLTasks. Benchmark ownership remains with its original authors.