PRISM Eval LLM Robustness: leaderboard
An automated, adaptive multi-turn attacker tries to get each model to produce harmful content in five hazard categories; the number is the mean count of attempts it needs before a response is judged harmful, averaged over categories. Unlike HarmBench or StrongREJECT, which report a success rate for fixed attacks, every model here is eventually broken and the score is how much effort that takes.
Metric: Mean attack attempts to elicit harmful output (higher is better). Source: arxiv.org. 38 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | Claude 3.5 Sonnet (20241022) | 440.1 | #637 |
| 2 | O1 (2024-12-17) | 174.4 | #311 |
| 3 | Claude 3 Haiku | 107.4 | #2609 |
| 4 | Claude 3.5 Haiku (20241022) | 81.4 | #1578 |
| 5 | Falcon3-10B-Instruct | 67 | #5744 |
| 6 | GPT-4o (2024-11-20) | 63.2 | #866 |
| 7 | Llama 3.2 11B Instruct | 45.9 | #4991 |
| 8 | Claude 3 Opus | 45.6 | #1455 |
| 9 | Phi-4 | 39.4 | #1913 |
| 10 | Llama 3.2 1B Instruct | 32.6 | #9047 |
| 11 | GPT-4o (2024-08-06) | 26.6 | #740 |
| 12 | Nova Pro (v1) | 22.6 | #1502 |
| 13 | Qwen Max | 21.7 | #1051 |
| 14 | Claude 3 Sonnet | 21.1 | #2309 |
| 15 | Llama 3.1 405B Instruct | 19.9 | #1115 |
Interactive version: theaggregate.ai/benchmark?slug=prism-eval-llm-robustness · How It Works · Data refreshed daily, snapshot 2026-11-13.