BrowseSafe++ Accessibility Tree - False Positive Rate: leaderboard
BrowseSafe++ v1 uses paired attack/control webpages. Detection receives one page view without the task, outcome, or injection annotations. Markdown inputs are limited to 40k characters. Temperature is 0 when supported; other parameters use provider defaults. Prompted models remain separate from the trained 0.8B BrowseSafeGuard. The study of three text views and the screenshot-vision study are independent. Adaptive attack success uses a fixed native attacker budget and target-model configuration; lower attack success rate (ASR) is better. Task harnesses are not aliased to native base checkpoints. Fable’s answered-only subset is excluded from the full population; the all-request policy row is retained. Metric: False Positive Rate (%).
Metric: False Positive Rate (%). Source: arxiv.org. Saturation forecast: Rough model projection: around 2026. 17 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | BrowseSafe++ detector Llama 3.1 8B | 4.73 | |
| 2 | BrowseSafe++ detector Claude Opus 5.5 | 4.84 | |
| 3 | BrowseSafe++ detector BrowseSafe-Guard | 5.77 | |
| 4 | BrowseSafe++ detector Jev 1.13 | 12.06 | |
| 5 | BrowseSafe++ detector DeepSeek V3.1 | 12.18 | |
| 6 | BrowseSafe++ detector GPT-6 Astra | 13.82 | |
| 7 | BrowseSafe++ detector Qwen 3.7 Max | 16.31 | |
| 8 | BrowseSafe++ detector Gemini 3.1 Pro | 17.5 | |
| 9 | BrowseSafe++ detector GPT-5.5 | 19.13 | |
| 10 | BrowseSafe++ detector Claude Fable 5.1 (all) † | 23.88 |
Interactive version: theaggregate.ai/benchmark?slug=browsesafe-plus-plus-accessibility-tree-false-positive-rate · How It Works · Data refreshed daily, snapshot 2026-10-28.