PandaBench

PandaBench is a comprehensive benchmark for evaluating Large Language Model (LLM) safety, focusing on jailbreak attacks, defense mechanisms, and evaluation methodologies.

The PandaGuard framework architecture illustrating the end-to-end pipeline for LLM safety evaluation. The system connects three key components: Attackers, Defenders, and Judges.

Dataset Description

This repository contains the benchmark results from extensive evaluations of various LLMs against different jailbreak attacks and defense mechanisms. The dataset enables researchers to:

1. Compare the effectiveness of different defense mechanisms against various attack methods
2. Analyze the safety-capability tradeoffs of defensive systems
3. Evaluate the robustness of different LLMs to jailbreak attempts
4. Develop and test new defense algorithms with consistent evaluation metrics

PandaBench builds comprehensive benchmarks for LLM/attack/defense/evaluation (a) Attack Success Rate vs. release date for various LLMs. (b) ASR across different harm categories with and without defense mechanisms. (c) Overall ASR for all evaluated LLMs with and without defense mechanisms.

Dataset Structure

The benchmark dataset is organized as follows:

benchmarks/
├── panda-bench.csv                           # Summary of all benchmark results
├── jbb/                                      # Raw jailbreak evaluation results
│   └── [model_name]/
│       └── [attack_name]/
│           └── [defense_name]/
│               ├── results.json              # Detailed results
│               └── config.yaml               # Configuration used
├── jbb_judged/                               # Judged jailbreak results
│   └── [model_name]/
│       └── [attack_name]/
│           └── [defense_name]/
│               └── [judge_results]
├── alpaca_eval/                              # Raw capability evaluation results
│   └── [model_name]/
│       └── [defense_name]/
│           ├── results.json                  # Results
│           └── config.yaml                   # Configuration
└── alpaca_eval_judged/                       # Judged capability results
    └── [model_name]/
        └── [defense_name]/
            └── [judge_name]/
                ├── annotations.json          # Detailed annotations
                └── leaderboard.csv           # Summary metrics

Evaluated Components

Models

The benchmark includes evaluation results for a wide range of LLMs:

• Commercial models: GPT-4o, GPT-4o-mini, Claude-3.7-sonnet, Claude-3.5-sonnet, Gemini-2.0-pro, Gemini-2.0-flash
• Open-source models: Llama-3-70B, Llama-3-8B, Phi-3-mini, Phi-3-medium, and more

Attack Methods

The benchmark includes the following attack methods:

• Transfer-based (template) attacks
• Gradient-based attacks (GCG)
• Generation-based attacks (PAIR, AutoDAN, TAP)
• Specialized attacks (DeepInception, GPT4-Cipher, SCAV, ArtPrompt)
• And more (Cold Attack, GPTFuzzer, ReNeLLM)

Defense Methods

The benchmark includes the following defense methods:

• Input-based (SelfReminder, ICL, RPO, GoalPriority)
• Process-based (SmoothLLM, SemanticSmoothLLM, RePE, GradSafe)
• Output-based (Paraphrase, BackTranslation, PerplexityFilter, SelfDefense)

Evaluation Metrics

The dataset provides:

• Attack Success Rate (ASR) - the primary safety metric
• AlpacaEval scores - capability metrics
• Win rates between different models and configurations
• Detailed feedback from different judge models

For reproducing experiments or running your own evaluations, please see the PandaGuard repository.

Contact

For questions, suggestions, or collaboration opportunities:

• Email: guobin.shen@beijing-aisi.ac.cn, dongcheng.zhao@beijing-aisi.ac.cn, yi.zeng@beijing-aisi.ac.cn
• GitHub: https://github.com/Beijing-AISI/panda-guard
• Homepage: https://panda-guard.github.io