PHANTOM - IDEATOR ASR: leaderboard
Metric: Reported aggregate attack success rate (%) for IDEATOR attacks on PHANTOM; lower is better for victim-model safety robustness. Paper §3.4 and Appendix C describe one fixed subset per attack reused across all models (nominal 1,100 attacks, 20 per subcategory), judged with Abel-24-HarmClassifier; empty API responses count as failed jailbreaks. Preserve reported aggregate rather than reconstructing a count from the nominal denominator.. Source: arxiv.org. 15 models tracked.
Top models
| # | Model | Score |
|---|---|---|
| 1 | Claude Opus 4.6 | 8.82 |
| 2 | Qwen 3.6 27B | 18.82 |
| 3 | Qwen 3.5 27B | 23.45 |
| 4 | Claude Opus 4.8 | 26.09 |
| 5 | Gemma 4 26B A4B (IT) | 27.36 |
| 6 | GPT-5.4 | 30.45 |
| 7 | Qwen 3 VL 30B A3B Instruct | 31.09 |
| 8 | Claude Opus 4.7 | 32.55 |
| 9 | GPT-5.5 | 37.82 |
| 10 | Gemini 3.1 Pro (Preview) | 52.64 |
| 11 | Ministral-3-14B-Instruct-2512 | 72.73 |
Interactive version: theaggregate.ai/benchmark?slug=phantom-ideator-asr · How It Works · Data refreshed daily, snapshot 2026-10-09.