RedBench - HarmBench ASR (RainbowPlus): leaderboard
Safety baseline from RedBench (Dang et al., 2026): RainbowPlus, an adaptive quality-diversity search for adversarial prompts, attacks the model on the 320 HarmBench test behaviors, and Llama-Guard-3-8B judges whether the responses are unsafe. The score is the attack success rate in percent; lower is better.
Metric: Attack Success Rate (%; HarmBench test behaviors, Llama-Guard-3-8B judge; RainbowPlus quality-diversity search). Source: arxiv.org. Saturation forecast: Estimated already saturated. 6 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | GPT-4.1 Nano | 6.88 | #1992 |
| 2 | GPT-4o Mini | 28.75 | #1627 |
| 3 | Gemma 2 9B (IT) | 42.5 | #2275 |
| 4 | Qwen 2.5 7B Instruct | 84.06 | #2583 |
| 5 | Llama 3.1 8B Instruct | 96.25 | #4277 |
| 6 | Ministral-8B-Instruct-2410 | 97.81 | #4720 |
No result here: #1 Claude Fable 5.2, #2 Gemini 4 Carbon, #5 Claude Opus 5.5.
Interactive version: theaggregate.ai/benchmark?slug=redbench-harmbench-asr-rainbowplus · How It Works · Data refreshed daily, snapshot 2026-11-12.