MMJailBench - Code Framing: leaderboard
Metric: Attack success rate (%; share of responses a GPT-5 judge scores 4 or 5 on a 1-5 harmfulness rubric; code-style indirection framing, all 272 intents, visual contexts and carriers). Source: arxiv.org. Saturation forecast: Estimated already saturated. 16 models tracked.
Top models
| # | Model | Score |
|---|---|---|
| 1 | GPT-5 | 0.85 |
| 2 | Claude Sonnet 4.5 | 2.54 |
| 3 | Gemini 3 Flash | 9.6 |
| 4 | Qwen 3 VL 8B | 15.4 |
| 5 | Kimi K2.5 | 20.99 |
| 6 | Seed 2.0 Lite | 23.9 |
| 7 | Grok 4 Fast | 24.12 |
| 8 | Ministral 3 8B | 25.55 |
| 9 | InternVL3-8B | 37.1 |
| 10 | Step3 VL 10B | 46.36 |
| 11 | Qwen 2.5 VL 7B Instruct | 64.23 |
| 12 | Gemma 3 12B | 74.08 |
| 13 | GLM-4.6V | 80.55 |
Interactive version: theaggregate.ai/benchmark?slug=mmjailbench-code-framing · How It Works · Data refreshed daily, snapshot 2026-09-26.