OpenRT - PAIR: leaderboard
An attacker model rewrites a single prompt over several rounds until the target complies (PAIR); the number is the share of HarmBench requests that end in full compliance. Single-turn and iterative, unlike the multi-turn Crescendo board.
Metric: PAIR attack success rate (%, lower is better). Source: arxiv.org. 20 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | Claude Haiku 4.5 | 13 | #568 |
| 2 | GPT-5.2 | 38.5 | #176 |
| 3 | Qwen 3 Max | 50 | #403 |
| 4 | Qwen 3 Next 80B A3B Instruct | 64.5 | #766 |
| 5 | Llama 4 Maverick Instruct | 66 | #1133 |
| 6 | GPT-5.1 | 72.5 | #229 |
| 7 | Gemini 3 Pro (Preview) | 74.5 | #113 |
| 8 | Seed-1.6 | 75.5 | #448 |
| 9 | Mistral Large 3 | 78 | #817 |
| 10 | Grok 4.1 Fast | 80 | #430 |
| 11 | DeepSeek R1 | 82.5 | #473 |
| 12 | Kimi K2 0905 | 83 | #558 |
| 13 | Gemini 2.5 Flash (Thinking) | 84.5 | #453 (Gemini 2.5 Flash) |
| 14 | Llama 4 Scout Instruct | 89.5 | #1543 |
| 15 | ERNIE 4.5 300B A47B | 89.5 | #1087 |
Interactive version: theaggregate.ai/benchmark?slug=openrt-pair · How It Works · Data refreshed daily, snapshot 2026-11-13.