BrowseSafe++ Adapt - Seed Attack Success: leaderboard
BrowseSafe++ v1 uses paired attack/control webpages. Detection receives one page view without the task, outcome, or injection annotations. Markdown inputs are limited to 40k characters. Temperature is 0 when supported; other parameters use provider defaults. Prompted models remain separate from the trained 0.8B BrowseSafeGuard. The study of three text views and the screenshot-vision study are independent. Adaptive attack success uses a fixed native attacker budget and target-model configuration; lower attack success rate (ASR) is better. Task harnesses are not aliased to native base checkpoints. Attack-goal denominators remain distinct from detection F1. The source budget and seed population are preserved in the primary protocol. Metric: Attack success (%).
Metric: Attack success (%). Source: arxiv.org. Saturation forecast: Rough model projection: around 2026. 7 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | BrowseSafe++ target GPT-5.5 | 0.49 | |
| 2 | BrowseSafe++ target Haiku 4.5 | 0.59 | |
| 3 | BrowseSafe++ target Kimi K2 | 0.59 | |
| 4 | BrowseSafe++ target Sonnet 5 | 2.05 | |
| 5 | BrowseSafe++ target Gem. 3.1 Pro | 2.93 | |
| 6 | BrowseSafe++ target DeepSeek V3.1 | 2.93 | |
| 7 | BrowseSafe++ target Gem. 3.5 FL | 4 |
Interactive version: theaggregate.ai/benchmark?slug=browsesafe-plus-plus-adapt-seed-attack-success · How It Works · Data refreshed daily, snapshot 2026-10-28.