A standardized red-teaming framework of 510 curated harmful behaviors testing whether attacks make a model comply; the metric is Attack Success Rate, so a lower score is the safety-desirable outcome.
unassessed
| Category | safety |
|---|---|
| Subcategory | standardized automated red-teaming framework: attack success rate across 510 harmful behaviors |
| Page status | active |
| Metric | Attack Success Rate (ASR): share of behaviors an attack successfully elicits, per classifier judgment |
| Direction | lower_is_better |
| Unit | % |
| Dataset size | 510 |
| Dataset licence | MIT, confirmed from the repository's own LICENSE file |
| Publisher | Center for AI Safety (CAIS), with University of Illinois Urbana-Champaign, UC Berkeley, Carnegie Mellon University and Microsoft (confirmed from the paper's own author affiliation footnotes) |
HarmBench is a standardized evaluation framework for automated red teaming: it lets red-teaming attack methods and target-model defenses be compared on equal footing, rather than each paper reporting numbers under its own ad hoc protocol. Its core artifact is 510 curated harmful behaviors -- 400 textual, 110 multimodal, confirmed by counting the released CSV files directly -- split across four functional categories (standard, contextual, copyright, multimodal) and semantic categories describing the kind of harm (cybercrime/intrusion, general illegal activity, misinformation and disinformation, chemical/biological, harassment/bullying, plus copyright and a residual "harmful" bucket). The original paper used HarmBench to run a large-scale comparison of 18 red-teaming attack methods (including several variants of Greedy Coordinate Gradient, GCG) against 33 target LLMs and defenses, and separately introduced an adversarial-training defense (RMU-adjacent but distinct; called R2D2) built and validated using the same framework.
A red-teaming method generates a test case for each behavior (an adversarial suffix, a jailbreak prompt, or, for the simplest baseline, the behavior stated directly); the target model generates a response, standardized to up to 512 generated tokens since the paper found generation length can swing substring-matching ASR by up to 30 percentage points; a classifier then judges whether the response actually exhibits the behavior. For non-copyright behaviors this is a fine-tuned Llama 2 13B classifier (`cais/HarmBench-Llama-2-13b-cls`), trained and validated on separate splits so the classifier's own accuracy is not inflated by testing on its training data; copyright behaviors are instead checked by a text-overlap detector rather than the classifier. HarmBench publishes an official validation/test split of 100/410 behaviors across the combined textual-plus-multimodal set; the text-only files are separately split 80 validation / 320 test.
No model card in ModelSpec reports this benchmark yet.