BrowseSafe++ Guard Defense - Attack Success at8: leaderboard
BrowseSafe++ v1 uses paired attack/control webpages. Detection receives one page view without the task, outcome, or injection annotations. Markdown inputs are limited to 40k characters. Temperature is 0 when supported; other parameters use provider defaults. Prompted models remain separate from the trained 0.8B BrowseSafeGuard. The study of three text views and the screenshot-vision study are independent. Adaptive attack success uses a fixed native attacker budget and target-model configuration; lower attack success rate (ASR) is better. Task harnesses are not aliased to native base checkpoints. This compares guarded and unguarded Gemini 3.5 Flash Lite. Clean completion remains separate from attack resistance. Metric: Attack Success at 8 (%).
Metric: Attack Success at8 (%). Source: arxiv.org. Saturation forecast: Rough model projection: around 2026. 2 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | BrowseSafe++ Flash-Lite withBrowseSafeGuard | 60.35 | |
| 2 | BrowseSafe++ Flash-Lite unguarded | 78.91 |
Interactive version: theaggregate.ai/benchmark?slug=browsesafe-plus-plus-guard-defense-attack-success-at8 · How It Works · Data refreshed daily, snapshot 2026-10-28.