MIR-SafetyBench - Spatial Juxtaposition: leaderboard
MIR-SafetyBench attack success rate (percent of responses the HarmBench-Llama-2-13b-cls classifier labels harmful, lower is safer) on its spatial-juxtaposition instances, where two scenes seen from different perspectives invite the model to infer the harmful actions linking them. Tsinghua CoAI group and Beihang University, 2026.
Metric: Attack Success Rate (%; lower is safer). Source: arxiv.org. Saturation forecast: Around February 2027. 19 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | GPT-5.1 | 17.47 | #225 |
| 2 | Gemini 3 Pro (Preview) | 41.78 | #111 |
| 3 | Gemini 2.5 Pro | 52.05 | #262 |
| 4 | GPT-4o Mini | 56.16 | #1627 |
| 5 | QVQ-72B-Preview | 72.26 | #1173 |
| 6 | Gemini 2.5 Flash | 74.32 | #452 |
| 7 | InternVL3-8B | 75.68 | #1695 |
| 8 | InternVL3-38B | 76.71 | #905 |
| 9 | GPT-4o | 77.05 | #741 |
| 10 | InternVL3-78B | 78.08 | #733 |
| 11 | GLM-4.1V-9B (Thinking) | 88.01 | #1061 (GLM-4.1V-9B) |
| 12 | Qwen 2.5 VL 32B Instruct | 89.73 | #1055 |
No result here: #1 Claude Fable 5.2, #2 Gemini 4 Carbon, #5 Claude Opus 5.5.
Interactive version: theaggregate.ai/benchmark?slug=mir-safetybench-spatial-juxtaposition · How It Works · Data refreshed daily, snapshot 2026-11-12.