MLCommons Jailbreak Benchmark v1.0
MLCommons Jailbreak Benchmark v1.0 is an end-to-end evaluation pipeline for measuring how much single-turn text jailbreaks degrade LLM safety, using paired benign/adversarial tests over eight open-weight models, 264 prompts, eleven hazard categories, human labels, calibrated automated judges, and a “Resilience Gap” metric. Its main contribution is less a flashy new attack than a reproducible, risk-calibrated benchmarking methodology that exposes meaningful variation by model, hazard, and attack type, though it is limited to single-turn text attacks, a modest open-weight model set, and the usual fragility of safety judging and evaluator calibration.
Abstract
Modern AI systems are designed to refuse hazardous requests. A jailbreak is a prompt crafted to bypass those safeguards and elicit outputs that the system would normally refuse to provide. The MLCommons Jailbreak Benchmark v1.0 provides an end-to-end methodology for evaluating the robustness of large language models to single-turn, text-based jailbreak attacks. It combines criteria-driven system and attack selection, paired baseline and adversarial evaluation, human annotation, automated evaluator calibration, scoring, grading, and risk-calibrated disclosure within a single benchmarking pipeline. The benchmark evaluates eight open-weight systems using 264 seed prompts spanning eleven hazard categories and representative attacks drawn from the MLCommons Jailbreak Taxonomy. Responses are assessed using the AILuminate Assessment Standard v1.4, and robustness is measured through the Resilience Gap: the change in safety performance between baseline and adversarial conditions. Across all evaluated systems and attacks, the unsafe-response rate increased from 11.08% under baseline conditions to 18.65% under jailbreak conditions, producing an average Resilience Gap of 7.57%. Accessible systems showed a larger mean gap, while attack effectiveness varied substantially across attack categories and hazards. The benchmark also examines evaluator reliability and sources of measurement error. Beyond reporting results, Jailbreak Benchmark v1.0 establishes a reproducible methodological foundation for comparative jailbreak evaluation and for future expansion across systems, attacks, hazards, and evaluation methods.