MT-JailBench: leaderboard
Multi-turn jailbreaks exploit the ability of large language models to accumulate and act on conversational context. Instead of stating a harmful request directly, an attacker can gradually steer the conversation toward an unsafe answer. Recent methods demonstrate this risk, but they are usually evaluated as black-box pipelines with different budgets, judges, retry rules, and strategy generation pr
Metric: CrescendoX ASR (self-reported). Source: benchmarklist.com. 21 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | Claude Haiku 4.5 | 18.24 | #280 |
| 2 | Claude Sonnet 4.5 | 24.53 | #142 |
| 3 | GPT-5 | 38.71 | #98 |
| 4 | Qwen 3.5 Plus | 52.2 | #125 |
| 5 | Nemotron 3 Super | 55.97 | #335 |
| 6 | Gemini 3 Pro | 63.52 | #80 |
| 7 | Qwen 3.5 Flash | 65.41 | #232 |
| 8 | Gemma 4 26B A4B (IT) | 73.42 | #297 |
| 9 | Llama 4 Maverick | 77.36 | #464 |
| 10 | gemma-4-E4B-it | 78.62 | #566 |
| 11 | Grok 4.1 Fast | 81.13 | #217 |
| 12 | DeepSeek V3.2 | 82.39 | #205 |
| 13 | GPT-4o | 84.28 | #343 |
| 14 | Gemini 3 Flash | 86.16 | #99 |
| 15 | Llama 4 Scout | 89.94 | #656 |
Interactive version: theaggregate.ai/benchmark?slug=mt-jailbench · How It Works · Data refreshed daily, snapshot 2026-10-20.