PHANTOM - BAP ASR: leaderboard
Metric: Reported aggregate attack success rate (%) for BAP attacks on PHANTOM; lower is better for victim-model safety robustness. Paper §3.4 and Appendix C describe one fixed subset per attack reused across all models (nominal 1,100 attacks, 20 per subcategory), judged with Abel-24-HarmClassifier; empty API responses count as failed jailbreaks. Preserve reported aggregate rather than reconstructing a count from the nominal denominator.. Source: arxiv.org. 15 models tracked.
Top models
| # | Model | Score |
|---|---|---|
| 1 | Claude Opus 4.6 | 7.91 |
| 2 | GPT-5.4 | 15.91 |
| 3 | Gemma 4 26B A4B (IT) | 22 |
| 4 | Gemini 3.1 Pro (Preview) | 38.36 |
| 5 | Claude Opus 4.8 | 38.73 |
| 6 | Qwen 3.6 27B | 39.82 |
| 7 | Qwen 3.5 27B | 40.91 |
| 8 | Qwen 3 VL 30B A3B Instruct | 42.73 |
| 9 | Claude Opus 4.7 | 43.64 |
| 10 | GPT-5.5 | 49.09 |
| 11 | Ministral-3-14B-Instruct-2512 | 67.73 |
Interactive version: theaggregate.ai/benchmark?slug=phantom-bap-asr · How It Works · Data refreshed daily, snapshot 2026-10-09.