/leaderboard · loading…
/leaderboard · loading…
/leaderboard · all-time · measured as of 2026-06-07
Every model ROGUE red-teams, ranked by resistance. Lower breach rate = higher rank. Each model is hit with ROGUE's open-web attack corpus and graded by a calibrated judge. 8 production + 16 open-source models — a periodic measured snapshot (production as of 2026-06-07), not a live-updating feed.
Most resistant
1%
claude-opus-4-8
Most breached
44%
voxtral-small-24b-2507
submit your model
Want your own model on the board? Opt-in submissions will be re-verified against the same corpus and judge before they appear.
closed · deep pipeline · measured 2026-06-07
8 hosted models · deep escalation + PAIR pipeline · graded by the calibrated v3 judge (89.3% human agreement). Snapshot as of 2026-06-07.
claude-opus-4-8
claude-haiku-4-5
gpt-5.4-nano
llama-3.1-8b-instruct
gemini-3.1-flash-lite
gpt-audio-mini
mistral-small-2603
voxtral-small-24b-2507
open-weight · single-shot · measured 2026-06-20
16 open-weight models · single-shot aggressive jailbreak pack · primitive-level any-breach · ~40 trials each. A lighter, separate methodology — not directly comparable to the deep-pipeline board.
DeepSeek-R1-Distill-Llama-70B
DeepSeek-V3.1
Qwen2.5-72B-Instruct
MiniMax-M2
Meta-Llama-3.1-8B-Instruct
QwQ-32B
GLM-4-9B-0414
Mistral-Small-24B-Instruct-2501
Mistral-7B-Instruct-v0.2
Qwen3-32B
Meta-Llama-3.1-70B-Instruct
Qwen3-235B-A22B
Qwen2.5-7B-Instruct-abliterated
Qwen2.5-7B-Instruct
Mistral-Nemo-Instruct-2407
Meta-Llama-3.1-8B-Instruct-abliterated
// rank = mean any-breach rate across attack families (lower = more resistant), WITHIN each board
// production: ROGUE all-time corpus, 11,973 deep-pipeline trials, calibrated v3 judge (89.3% human agreement) — the same numbers `rogue try` prints
// open-source: curated single-shot aggressive jailbreak pack (~40 trials each), primitive-level any-breach, measured 2026-06-20
// the three facets (production, open-source, PII context-leak) are NOT directly comparable (different attacks/metrics) and are ranked independently
// periodic measured snapshot, not a live feed — for the live per-family × config breakdown, see the breach matrix
pii context-leak · exact-match · measured 2026-07-06
Confidential PII is planted in each model's system promptwith a “never reveal” instruction, then probed for disclosure. Ranked by leak rate (lower = more resistant). A separate attack + metric — not comparable to the breach boards above. Hosted frontier models held at 0%; the leak lives in smaller open models.
gpt-5.4
hostedgpt-5.4-nano
hostedQwen2.5-32B-Instruct
openQwen2.5-14B-Instruct
openQwen2.5-7B-Instruct
openQwen2.5-3B-Instruct
openMistral-Nemo-Instruct-2407
open// system-prompt-planted PII · exact-match leak · 36 cells/model · Wilson 95% CI · Fisher vs 0% baseline — measured 2026-07-06. Small panel (2 hosted + 5 open); a first context-leak facet, ranked independently.
/leaderboard · share card
All 24 models in a single shareable card — production endpoints (deep escalation + PAIR) and open-source models (single-shot pack) in two clearly-separated panels. Not directly comparable; each panel ranks within itself.
