OpenRT - Crescendo: leaderboard
A multi-turn attack that starts with harmless questions and escalates toward the harmful goal over several turns; the number is the share of HarmBench requests that end in full compliance. It tests drift over a conversation, where the PAIR board tests single prompts refined by an attacker.
Metric: Crescendo attack success rate (%, lower is better). Source: arxiv.org. 20 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | Claude Haiku 4.5 | 9 | #568 |
| 2 | Qwen 3 Max | 12 | #403 |
| 3 | Llama 4 Maverick Instruct | 17 | #1133 |
| 4 | Qwen 3 Next 80B A3B Instruct | 21.5 | #766 |
| 5 | Llama 4 Scout Instruct | 30.5 | #1543 |
| 6 | GPT-5.2 | 32.5 | #176 |
| 7 | Grok 4.1 Fast | 41 | #430 |
| 8 | ERNIE 4.5 300B A47B | 46.5 | #1087 |
| 9 | Gemini 3 Pro (Preview) | 47 | #113 |
| 10 | Hunyuan A13B-Instruct | 47.5 | #2015 |
| 11 | Gemini 2.5 Flash (Thinking) | 48 | #453 (Gemini 2.5 Flash) |
| 12 | Qwen 3 235B A22B 2507 (Thinking) | 49 | #463 |
| 13 | MiniMax-M2 | 50.5 | #674 |
| 14 | GPT-5.1 | 51 | #229 |
| 15 | DeepSeek R1 | 56 | #473 |
Interactive version: theaggregate.ai/benchmark?slug=openrt-crescendo · How It Works · Data refreshed daily, snapshot 2026-11-13.