PHANTOM - MML ASR: leaderboard
Metric: Reported aggregate attack success rate (%) for MML attacks on PHANTOM; lower is better for victim-model safety robustness. Paper §3.4 and Appendix C describe one fixed subset per attack reused across all models (nominal 1,100 attacks, 20 per subcategory), judged with Abel-24-HarmClassifier; empty API responses count as failed jailbreaks. Preserve reported aggregate rather than reconstructing a count from the nominal denominator.. Source: arxiv.org. 15 models tracked.
Top models
| # | Model | Score |
|---|---|---|
| 1 | Claude Opus 4.7 | 2.82 |
| 2 | Claude Opus 4.8 | 14.64 |
| 3 | Gemini 3.1 Pro (Preview) | 43.38 |
| 4 | Claude Opus 4.6 | 56.19 |
| 5 | Qwen 3.5 27B | 74.34 |
| 6 | GPT-5.4 | 76.03 |
| 7 | GPT-5.5 | 84.64 |
| 8 | Qwen 3.6 27B | 86.1 |
| 9 | Qwen 3 VL 30B A3B Instruct | 88.35 |
| 10 | Gemma 4 26B A4B (IT) | 96.09 |
| 11 | Ministral-3-14B-Instruct-2512 | 98.73 |
Interactive version: theaggregate.ai/benchmark?slug=phantom-mml-asr · How It Works · Data refreshed daily, snapshot 2026-10-09.