SALAD-Bench
Models answer harmful questions organized in a three-level taxonomy, some with attack or defense changes and some multiple-choice. The MD-Judge evaluator labels responses as safe or unsafe.
ACL 2024 Findings paper.
- Released
- February 2024
- Kind
- Refusing harmful requests
- Level
- Everyday
- Scored
- Graded by a model
- Answers
- Open-ended
- Tasks
- All public
- Strongest model tested
- GPT-3.5 Turbo Jan 2024 #199 on the capability index
- Last in a launch post
- April 2026, dropped after it saturated
- Last model added
- April 2026
- Scores refreshed
- November 12th, 2026
In the authors’ words
In the rapidly evolving landscape of Large Language Models (LLMs), ensuring robust safety measures is paramount. To meet this crucial need, we propose SALAD-Bench, a safety benchmark specifically designed for evaluating LLMs, attack, and defense methods. Distinguished by its breadth, SALAD-Bench transcends conventional benchmarks through its large scale, rich diversity, intricate taxonomy spanning three levels, and versatile functionalities.SALAD-Bench is crafted with a meticulous array of questions, from standard queries to complex ones enriched with attack, defense modifications and multiple-choice. To effectively manage the inherent complexity, we introduce an innovative evaluators: the LLM-based MD-Judge for QA pairs with a particular focus on attack-enhanced queries, ensuring a seamless, and reliable evaluation. Above components extend SALAD-Bench from standard LLM safety evaluation to both LLM attack and defense methods evaluation, ensuring the joint-purpose utility. Our extensive experiments shed light on the resilience of LLMs against emerging threats and the efficacy of contemporary defense tactics. Data and evaluator are released under https://github.com/OpenSafetyLab/SALAD-BENCH.
claude2 (snapshot unspecified) tops the leaderboard with 99.8%
Best score per entry from the benchmark's own leaderboard, read on November 12th, 2026. Where a model ran with several settings or harnesses, we keep its best. Names in gray aren't in our model list: fine-tunes, agent systems, products and older models. They don't count toward leaders. The best model we track is internlm-chat-20b, at 96.8%.
Granite 4.0 H Small leads with 97.3%, claims included
Best score per model from every source, including labs’ own numbers and claims Epoch AI collected from reports and papers. Labs pick their own settings, so a claim can beat an independent run of the same model.
The newest model with a score here came out in February 2024, and nobody has tested a newer one. Among the 20 highest-ranked models on the capability index, these have no score yet:
- Claude Fable 5.2
-
Gemini 4 Carbon
- GPT-6 Astra
- Claude Opus 5.5
- and 16 more
- 99.8 claude2 (snapshot unspecified)
- 98.2 internlm2-chat-20b
- 97.7 internlm2-chat-7b
- 96.8 Llama-2-13b-chat-hf
- 96.8 internlm-chat-20b
- 96.5 Llama-2-7b-chat-hf
- 96.2 Llama-2-70b-chat-hf
- 95.9 gemma-2b-it
- 95.5 internlm-chat-7b
- 95.5
Qwen1.5-4B-Chat
- 95.4
Qwen1.5-14B-Chat
- 95.3
Qwen-14B
- 94.4 Qwen-72B-Chat
- 94.1 gemma-7b-it
- 93.5
Qwen1.5-72B
- 93.5 gpt4 (snapshot unspecified)
- 93.0
Qwen1.5-7B-Chat
- 91.7 Qwen-7B-Chat
- 91.6
Tulu 2 DPO 70B
- 90.5 ChatGLM3-6B
- 88.6 GPT-3.5 Turbo
- 88.3
Gemini 1.0 Pro
- 87.1 Yi-34B-Chat
- 86.5 tulu-2-dpo-13b
- 84.8 tulu-2-dpo-7b
- 83.0
Yi-6B-Chat
- 80.4 qwen1.5_0.5b
- 80.1
Mistral-7B-Instruct-v0.2
- 76.2 Mixtral-8x7B-Instruct-v0.1
- 63.0 Qwen1.5-1.8B-Chat
- 54.1
Mistral-7B-Instruct-v0.1
- 54.1 vicuna-33b-v1.3
- 45.9 vicuna-13b-v1.5-16k
- 44.5 vicuna-7b-v1.5-16k
- 1 claude2 (snapshot unspecified) 99.8%
- 2 internlm2-chat-20b 98.2%
- 3 internlm2-chat-7b 97.7%
- 4 Llama-2-13b-chat-hf 96.8%
- 5 internlm-chat-20b 96.8%
- 6 Llama-2-7b-chat-hf 96.5%
- 7 Llama-2-70b-chat-hf 96.2%
- 8 gemma-2b-it 95.9%
- 9 internlm-chat-7b 95.5%
- 10
Qwen1.5-4B-Chat 95.5%
- 11
Qwen1.5-14B-Chat 95.4%
- 12
Qwen-14B 95.3%
- 13 Qwen-72B-Chat 94.4%
- 14 gemma-7b-it 94.1%
- 15
Qwen1.5-72B 93.5%
- 16 gpt4 (snapshot unspecified) 93.5%
- 17
Qwen1.5-7B-Chat 93%
- 18 Qwen-7B-Chat 91.7%
- 19
Tulu 2 DPO 70B 91.6%
- 20 ChatGLM3-6B 90.5%
- 21 GPT-3.5 Turbo Jan 2024 88.6%
- 22
Gemini 1.0 Pro 88.3%
- 23 Yi-34B-Chat 87.1%
- 24 tulu-2-dpo-13b 86.5%
- 25 tulu-2-dpo-7b 84.8%
- 26
Yi-6B-Chat 83%
- 27 qwen1.5_0.5b 80.4%
- 28
Mistral-7B-Instruct-v0.2 80.1%
- 29 Mixtral-8x7B-Instruct-v0.1 76.2%
- 30 Qwen1.5-1.8B-Chat 63%
- 31
Mistral-7B-Instruct-v0.1 54.1%
- 32 vicuna-33b-v1.3 54.1%
- 33 vicuna-13b-v1.5-16k 45.9%
- 34 vicuna-7b-v1.5-16k 44.5%
Source: Official SALAD-Bench leaderboard
- 97.3 Granite 4.0 H Small
- 96.8 internlm-chat-20b
- 96.4 Granite 4.1 30B
- 95.5
Qwen1.5-4B-Chat
- 95.4
Qwen1.5-14B-Chat
- 95.3
Qwen-14B
- 93.5
Qwen1.5-72B
- 93.4 granite-4.0-1b
- 93.0
Qwen1.5-7B-Chat
- 91.6
Tulu 2 DPO 70B
- 90.5 ChatGLM3-6B
- 88.6 GPT-3.5 Turbo
- 88.3
Gemini 1.0 Pro
- 83.0
Yi-6B-Chat
- 80.1
Mistral-7B-Instruct-v0.2
- 54.1
Mistral-7B-Instruct-v0.1
- 1 Granite 4.0 H Small 97.3%
- 2 internlm-chat-20b 96.8%
- 3 Granite 4.1 30B 96.4%
- 4
Qwen1.5-4B-Chat 95.5%
- 5
Qwen1.5-14B-Chat 95.4%
- 6
Qwen-14B 95.3%
- 7
Qwen1.5-72B 93.5%
- 8 granite-4.0-1b 93.4%
- 9
Qwen1.5-7B-Chat 93%
- 10
Tulu 2 DPO 70B 91.6%
- 11 ChatGLM3-6B 90.5%
- 12 GPT-3.5 Turbo Jan 2024 88.6%
- 13
Gemini 1.0 Pro 88.3%
- 14
Yi-6B-Chat 83%
- 15
Mistral-7B-Instruct-v0.2 80.1%
- 16
Mistral-7B-Instruct-v0.1 54.1%
Sources: Labs’ model cards and official SALAD-Bench leaderboard
| # | Entry | Score | Setting | Date | Source |
|---|---|---|---|---|---|
| 1 | claude2 (snapshot unspecified) | 99.8% | Official leaderboard | ||
| 2 | internlm2-chat-20b | 98.2% | Official leaderboard | ||
| 3 | internlm2-chat-7b | 97.7% | Official leaderboard | ||
| 4 | Llama-2-13b-chat-hf | 96.8% | Official leaderboard | ||
| 5 | internlm-chat-20b | 96.8% | Sep 2023 | Official leaderboard | |
| 6 | Llama-2-7b-chat-hf | 96.5% | Official leaderboard | ||
| 7 | Llama-2-70b-chat-hf | 96.2% | Official leaderboard | ||
| 8 | gemma-2b-it | 95.9% | Official leaderboard | ||
| 9 | internlm-chat-7b | 95.5% | Official leaderboard | ||
| 10 | | 95.5% | Feb 2024 | Official leaderboard | |
| 11 | | 95.4% | Feb 2024 | Official leaderboard | |
| 12 | | 95.3% | Sep 2023 | Official leaderboard | |
| 13 | Qwen-72B-Chat | 94.4% | Official leaderboard | ||
| 14 | gemma-7b-it | 94.1% | Official leaderboard | ||
| 15 | | 93.5% | Feb 2024 | Official leaderboard | |
| 16 | gpt4 (snapshot unspecified) | 93.5% | Official leaderboard | ||
| 17 | | 93% | Feb 2024 | Official leaderboard | |
| 18 | Qwen-7B-Chat | 91.7% | Official leaderboard | ||
| 19 | | 91.6% | Nov 2023 | Official leaderboard | |
| 20 | ChatGLM3-6B | 90.5% | Oct 2023 | Official leaderboard | |
| 21 | GPT-3.5 Turbo Jan 2024 | 88.6% | Jan 2024 | Official leaderboard | |
| 22 | | 88.3% | Dec 2023 | Official leaderboard | |
| 23 | Yi-34B-Chat | 87.1% | Official leaderboard | ||
| 24 | tulu-2-dpo-13b | 86.5% | Official leaderboard | ||
| 25 | tulu-2-dpo-7b | 84.8% | Official leaderboard | ||
| 26 | | 83% | Nov 2023 | Official leaderboard | |
| 27 | qwen1.5_0.5b | 80.4% | Official leaderboard | ||
| 28 | | 80.1% | Dec 2023 | Official leaderboard | |
| 29 | Mixtral-8x7B-Instruct-v0.1 | 76.2% | Official leaderboard | ||
| 30 | Qwen1.5-1.8B-Chat | 63% | Official leaderboard | ||
| 31 | | 54.1% | Sep 2023 | Official leaderboard | |
| 32 | vicuna-33b-v1.3 | 54.1% | Official leaderboard | ||
| 33 | vicuna-13b-v1.5-16k | 45.9% | Official leaderboard | ||
| 34 | vicuna-7b-v1.5-16k | 44.5% | Official leaderboard |
| # | Model | Score | Setting | Date | Source |
|---|---|---|---|---|---|
| 1 | Granite 4.0 H Small | 97.3% | Oct 2025 | Lab model card | |
| 2 | internlm-chat-20b | 96.8% | Sep 2023 | Official leaderboard | |
| 3 | Granite 4.1 30B | 96.4% | Apr 2026 | Lab model card | |
| 4 | | 95.5% | Feb 2024 | Official leaderboard | |
| 5 | | 95.4% | Feb 2024 | Official leaderboard | |
| 6 | | 95.3% | Sep 2023 | Official leaderboard | |
| 7 | | 93.5% | Feb 2024 | Official leaderboard | |
| 8 | granite-4.0-1b | 93.4% | Oct 2025 | Lab model card | |
| 9 | | 93% | Feb 2024 | Official leaderboard | |
| 10 | | 91.6% | Nov 2023 | Official leaderboard | |
| 11 | ChatGLM3-6B | 90.5% | Oct 2023 | Official leaderboard | |
| 12 | GPT-3.5 Turbo Jan 2024 | 88.6% | Jan 2024 | Official leaderboard | |
| 13 | | 88.3% | Dec 2023 | Official leaderboard | |
| 14 | | 83% | Nov 2023 | Official leaderboard | |
| 15 | | 80.1% | Dec 2023 | Official leaderboard | |
| 16 | | 54.1% | Sep 2023 | Official leaderboard |
Labs report scores for 3 models in their cards. Switch the scores above to rank them together.
Number one over time 2 models have held number one with claims included since its release in February 2024
Lab claims count from the day the card came out, independent runs from the model’s release. We draw one row each for the benchmark’s own leaderboard and what labs claim in their cards.
Sources: Official SALAD-Bench leaderboard and labs’ model cards
Internlm-chat-20b on the official leaderboard passed 85% in September 2023
All the scores we have, one dot each, so a model tested at several settings appears more than once.
Sources: Official SALAD-Bench leaderboard and labs’ model cards
Labs headline it less often now, last in April 2026
Launch posts from every lab that has listed it, one tick per post. Tall colored ticks include it, and short gray ones leave it out.
| Date | Launch post | Score | As the post writes it |
|---|---|---|---|
| Apr 29, 2026 | Granite 4.1 30B | 96.4 | SALAD-Bench |
| Oct 28, 2025 | granite-4.0-1b | 93.4 | SALAD-Bench |
| Oct 2, 2025 | Granite 4.0 H Small | 97.3 | SALAD-Bench |
One system card reports it
Besides launch posts, we read the system cards, model cards and technical reports labs publish with a release. They report far more, including safety and frontier-risk tests.
| Date | Document | Score | As the document writes it | Section |
|---|---|---|---|---|
| Jan 5, 2026 | | SALAD Bench safe rate, CoT+Answer, three sets with no overall: attack enhanced 97.86, defense enhanced 99.5, base 98.6 (Table 10) | Safety |
More in Safety and alignment
- FORTRESS In use Paired adversarial and benign national-security misuse prompts. Rubric-graded risk score on adversarial and over-refusal score on benign prompts. Claude Opus 5.5 5.78%
- StrongREJECT In use Forbidden-prompt jailbreak benchmark with a rubric grader that scores how useful a non-refusal actually is.
Inkling 98.6%
- Gray Swan IPI Arena benchmark In use Indirect prompt-injection attacks from public red-teaming competitions replayed on tool, coding and browser agents. Attack success rate at k attempts.
Gemini 4 Carbon 0%
- DistressBench In use Models reply as a chatbot to 718 simulated users in psychological crisis, in single-turn and multi-turn chats. Three judge models score replies against clinician-written rubrics.
Muse Spark 1.2 88.4%
- Lakera B3 (Backbone Breaker Benchmark) In use Crowdsourced prompt-injection attacks hit backbone LLMs inside agent threat snapshots at three defense levels. The score is attack resistance, 100 minus the board's vulnerability percentage. Claude Opus 4.5 89%
- IHEval In use Models face conflicts between system, user and tool instructions. Reports a composite score for following the higher-priority instruction. GPT-4o 70%