# HarmBench

> A standardized framework for evaluating both automated red-teaming attacks and model defenses against harmful content generation. It provides a consistent evaluation pipeline for measuring attack success rates across diverse harm categories.

## Claim

- **headline**: HarmBench attack success rates support relative comparisons of models and defenses against a fixed suite of known red-teaming attacks on 510 harmful behaviors, under a standardized pipeline; they do not certify that a model is safe against adaptive attackers.
- **construct**: Robustness of a model's safety behavior to automated red-teaming attacks
- **population**: 510 harmful behaviors across 7 categories, attacked with a fixed suite of methods such as GCG, AutoDAN, and prompt templates
- **measures**: Resistance to adversarial attacks designed to elicit harmful, dangerous, or unethical outputs; Effectiveness of safety training and content filters against a standardized set of red-team techniques; Comparative attack success rates across different jailbreak and prompt injection methods; Model safety across diverse harm categories including cybersecurity, bioweapons, and harassment
- **doesNotMeasure**: Safety in real-world deployment where attacks are dynamic, adaptive, and context-specific; Protection against novel attack methods not included in the benchmark's attack suite; The false positive rate — how often safety measures block legitimate, harmless requests; Nuanced safety judgments in edge cases where harmful and legitimate use overlap; Safety of model outputs in multi-turn, system-prompt-conditioned, or tool-use settings

## Instrument

- **itemFormat**: open-ended
- **specification**: An attack succeeds on a behavior when the target model's completion exhibits the requested harmful behavior.
- **anchor**: Behavior descriptions, plus the human-labeled completions used to train and validate the classifier
- **evidenceView**: The behavior description and the target model's completion, generated under fixed settings
- **mechanism**: learned_judge
- **mechanismDetail**: A fine-tuned Llama 2 13B classifier labels each completion as an instance of the behavior or not.
- **signal**: Binary harmful/not-harmful verdict per completion
- **resolution**: Single completion per test case
- **aggregation**: Attack success rate (ASR): the fraction of behaviors on which an attack succeeds, per attack method and target model
- **metrics**: attack success rate (ASR)
- **size**: 510 harmful behaviors across 7 categories
- **methodology**: Defines a set of harmful behaviors across categories (e.g., chemical weapons, malware, harassment) and evaluates how often various attack methods can elicit model compliance. Attack methods include GCG, AutoDAN, prompt injection templates, and more. A classifier model (fine-tuned Llama 2 13B) judges whether the model's response constitutes a successful attack (i.e., the model provided the harmful content). Reports attack success rate (ASR) per attack method per model.

## Regime

- **typicalUses**: measure
- **exposure**: Behaviors and the classifier are public, so defenses can be tuned to the fixed behavior set and to the classifier's blind spots. The attack suite is static while real adversaries adapt.
- **notes**: Keep the evaluation classifier out of any attack or defense optimization loop; once it is optimized against, attack success rate no longer means what it was validated to mean.

## Validation

- **summary**: HarmBench's evidence supports relative comparisons of models and defenses against a standardized set of known attacks, and its pipeline makes attack success rates comparable across methods. Resisting this attack suite does not mean a model is safe: the classifier adds noise on borderline cases, binary verdicts miss nuance, and results should never be treated as a safety certification.
- **evidence**: Attack success rates are comparable across attacks and models; The classifier's verdicts match human judgment; Low attack success predicts safety against real adversaries
- **status**: draft

## Lifecycle

- **saturation**: active
- **contamination**: medium
- **lastReviewed**: 2026-10-12

---
Source: https://benchmaker.ai/benchmarks/harmbench