Olmo 3 Safety Evaluation - DoAnythingNow: leaderboard
The model gets 300 harmful requests wrapped in DAN-style jailbreak templates; the score is the share it refuses, judged by WildGuard. Unlike the original DAN study of 2023 chat models, it is a re-run on 2025 open models.
Metric: Refusal accuracy, 1 - attack success rate (%, 300 DAN jailbreak prompts, higher is better). Source: arxiv.org. 36 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | Olmo-3.1-32B-Instruct-SFT | 93.6 | #3407 |
| 2 | OLMo-2-1124-7B-Instruct | 92 | #7343 |
| 3 | Qwen 3 VL 32B (Thinking) | 88.7 | #559 |
| 4 | Qwen 3 VL 32B Instruct | 88.3 | #585 |
| 5 | Qwen 3 32B (Non-reasoning) | 87.7 | #960 (Qwen 3 32B) |
| 6 | OLMo 3.1 32B Instruct | 85.2 | #2384 |
| 7 | Olmo-3.1-32B-Instruct-DPO | 84.9 | #3174 |
| 8 | Qwen 3 VL 8B (Thinking) | 83 | #887 |
| 9 | Qwen 3 8B (Non-reasoning) | 81.2 | #1830 (Qwen 3 8B) |
| 10 | Qwen 2.5 32B Instruct | 75.4 | #1215 |
| 11 | OLMo 3 7B Instruct | 75.2 | #6860 |
| 12 | OLMo-2-0325-32B-Instruct | 73.3 | #2570 |
| 13 | Qwen 2.5 7B Instruct | 59 | #2564 |
| 14 | Qwen 3 32B (Thinking) | 59 | #960 (Qwen 3 32B) |
| 15 | NVIDIA Nemotron Nano 9B V2 | 56.7 | #2270 |
Interactive version: theaggregate.ai/benchmark?slug=olmo-3-safety-evaluation-doanythingnow · How It Works · Data refreshed daily, snapshot 2026-11-13.