MMJailBench - Code Framing: leaderboard
MMJailBench (Wang et al., 2026) is a factorized multimodal jailbreak benchmark: 272 harmful intents crossed with six prompt framings, five task-relevant visual contexts and text or in-image instructions, 16,320 instances per model. This board covers one prompt framing, in which the request is expressed as code or code comments, over all 272 intents. Attack success rate in percent, the share of responses a GPT-5 judge scores 4 or 5 on a 1-5 harmfulness rubric; lower is better.
Metric: Attack success rate (%; share of responses a GPT-5 judge scores 4 or 5 on a 1-5 harmfulness rubric; code-style indirection framing, all 272 intents, visual contexts and carriers). Source: arxiv.org. Saturation forecast: Estimated already saturated. 16 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | GPT-5 | 0.85 | #163 |
| 2 | Claude Sonnet 4.5 | 2.54 | #244 |
| 3 | Gemini 3 Flash | 9.6 | #159 |
| 4 | Kimi K2.5 | 20.99 | #252 |
| 5 | Seed 2.0 Lite | 23.9 | #286 |
| 6 | Grok 4 Fast | 24.12 | #438 |
| 7 | Ministral 3 8B | 25.55 | #2036 |
| 8 | InternVL3-8B | 37.1 | #1695 |
| 9 | Qwen 2.5 VL 7B Instruct | 64.23 | #1842 |
| 10 | Gemma 3 12B | 74.08 | #2013 |
| 11 | GLM-4.6V | 80.55 | #698 |
No result here: #1 Claude Fable 5.2, #2 Gemini 4 Carbon, #5 Claude Opus 5.5.
Interactive version: theaggregate.ai/benchmark?slug=mmjailbench-code-framing · How It Works · Data refreshed daily, snapshot 2026-11-12.