Benchmark Almanac

SALAD-Bench

claude2 (snapshot unspecified) 99.8% tops its leaderboard internlm-chat-20b 96.8% leads the models we track
Granite 4.0 H Small 97.3% leads since October 2025
Fading

Models answer harmful questions organized in a three-level taxonomy, some with attack or defense changes and some multiple-choice. The MD-Judge evaluator labels responses as safe or unsafe.

ACL 2024 Findings paper.

Released
February 2024
Kind
Refusing harmful requests
Level
Everyday
Scored
Graded by a model
Answers
Open-ended
Tasks
All public
Strongest model tested
GPT-3.5 Turbo Jan 2024 #199 on the capability index
Last in a launch post
April 2026, dropped after it saturated
Last model added
April 2026
Scores refreshed
November 12th, 2026

In the authors’ words

In the rapidly evolving landscape of Large Language Models (LLMs), ensuring robust safety measures is paramount. To meet this crucial need, we propose SALAD-Bench, a safety benchmark specifically designed for evaluating LLMs, attack, and defense methods. Distinguished by its breadth, SALAD-Bench transcends conventional benchmarks through its large scale, rich diversity, intricate taxonomy spanning three levels, and versatile functionalities.SALAD-Bench is crafted with a meticulous array of questions, from standard queries to complex ones enriched with attack, defense modifications and multiple-choice. To effectively manage the inherent complexity, we introduce an innovative evaluators: the LLM-based MD-Judge for QA pairs with a particular focus on attack-enhanced queries, ensuring a seamless, and reliable evaluation. Above components extend SALAD-Bench from standard LLM safety evaluation to both LLM attack and defense methods evaluation, ensuring the joint-purpose utility. Our extensive experiments shed light on the resilience of LLMs against emerging threats and the efficacy of contemporary defense tactics. Data and evaluator are released under https://github.com/OpenSafetyLab/SALAD-BENCH.

Abstract of SALAD-Bench: A Hierarchical and Comprehensive Safety Benchmark for Large Language Models (arXiv:2402.05044, CC0)
34
Entries on its own leaderboard, 13 models we track
3
Launch posts list it, from 1 lab
1
System card reports it, from 1 lab

claude2 (snapshot unspecified) tops the leaderboard with 99.8%

Best score per entry from the benchmark's own leaderboard, read on November 12th, 2026. Where a model ran with several settings or harnesses, we keep its best. Names in gray aren't in our model list: fine-tunes, agent systems, products and older models. They don't count toward leaders. The best model we track is internlm-chat-20b, at 96.8%.

Granite 4.0 H Small leads with 97.3%, claims included

Best score per model from every source, including labs’ own numbers and claims Epoch AI collected from reports and papers. Labs pick their own settings, so a claim can beat an independent run of the same model.

The newest model with a score here came out in February 2024, and nobody has tested a newer one. Among the 20 highest-ranked models on the capability index, these have no score yet:

  1. 1 claude2 (snapshot unspecified) 99.8%
  2. 2 internlm2-chat-20b 98.2%
  3. 3 internlm2-chat-7b 97.7%
  4. 4 Llama-2-13b-chat-hf 96.8%
  5. 5 internlm-chat-20b 96.8%
  6. 6 Llama-2-7b-chat-hf 96.5%
  7. 7 Llama-2-70b-chat-hf 96.2%
  8. 8 gemma-2b-it 95.9%
  9. 9 internlm-chat-7b 95.5%
  10. 10 Qwen1.5-4B-Chat 95.5%
  11. 11 Qwen1.5-14B-Chat 95.4%
  12. 12 Qwen-14B 95.3%
  13. 13 Qwen-72B-Chat 94.4%
  14. 14 gemma-7b-it 94.1%
  15. 15 Qwen1.5-72B 93.5%
  16. 16 gpt4 (snapshot unspecified) 93.5%
  17. 17 Qwen1.5-7B-Chat 93%
  18. 18 Qwen-7B-Chat 91.7%
  19. 19 Tulu 2 DPO 70B 91.6%
  20. 20 ChatGLM3-6B 90.5%
  21. 21 GPT-3.5 Turbo Jan 2024 88.6%
  22. 22 Gemini 1.0 Pro 88.3%
  23. 23 Yi-34B-Chat 87.1%
  24. 24 tulu-2-dpo-13b 86.5%
  25. 25 tulu-2-dpo-7b 84.8%
  26. 26 Yi-6B-Chat 83%
  27. 27 qwen1.5_0.5b 80.4%
  28. 28 Mistral-7B-Instruct-v0.2 80.1%
  29. 29 Mixtral-8x7B-Instruct-v0.1 76.2%
  30. 30 Qwen1.5-1.8B-Chat 63%
  31. 31 Mistral-7B-Instruct-v0.1 54.1%
  32. 32 vicuna-33b-v1.3 54.1%
  33. 33 vicuna-13b-v1.5-16k 45.9%
  34. 34 vicuna-7b-v1.5-16k 44.5%

Source: Official SALAD-Bench leaderboard

#EntryScoreSettingDateSource
1 claude2 (snapshot unspecified) 99.8% Official leaderboard
2 internlm2-chat-20b 98.2% Official leaderboard
3 internlm2-chat-7b 97.7% Official leaderboard
4 Llama-2-13b-chat-hf 96.8% Official leaderboard
5 internlm-chat-20b 96.8% Sep 2023 Official leaderboard
6 Llama-2-7b-chat-hf 96.5% Official leaderboard
7 Llama-2-70b-chat-hf 96.2% Official leaderboard
8 gemma-2b-it 95.9% Official leaderboard
9 internlm-chat-7b 95.5% Official leaderboard
10 Qwen1.5-4B-Chat 95.5% Feb 2024 Official leaderboard
11 Qwen1.5-14B-Chat 95.4% Feb 2024 Official leaderboard
12 Qwen-14B 95.3% Sep 2023 Official leaderboard
13 Qwen-72B-Chat 94.4% Official leaderboard
14 gemma-7b-it 94.1% Official leaderboard
15 Qwen1.5-72B 93.5% Feb 2024 Official leaderboard
16 gpt4 (snapshot unspecified) 93.5% Official leaderboard
17 Qwen1.5-7B-Chat 93% Feb 2024 Official leaderboard
18 Qwen-7B-Chat 91.7% Official leaderboard
19 Tulu 2 DPO 70B 91.6% Nov 2023 Official leaderboard
20 ChatGLM3-6B 90.5% Oct 2023 Official leaderboard
21 GPT-3.5 Turbo Jan 2024 88.6% Jan 2024 Official leaderboard
22 Gemini 1.0 Pro 88.3% Dec 2023 Official leaderboard
23 Yi-34B-Chat 87.1% Official leaderboard
24 tulu-2-dpo-13b 86.5% Official leaderboard
25 tulu-2-dpo-7b 84.8% Official leaderboard
26 Yi-6B-Chat 83% Nov 2023 Official leaderboard
27 qwen1.5_0.5b 80.4% Official leaderboard
28 Mistral-7B-Instruct-v0.2 80.1% Dec 2023 Official leaderboard
29 Mixtral-8x7B-Instruct-v0.1 76.2% Official leaderboard
30 Qwen1.5-1.8B-Chat 63% Official leaderboard
31 Mistral-7B-Instruct-v0.1 54.1% Sep 2023 Official leaderboard
32 vicuna-33b-v1.3 54.1% Official leaderboard
33 vicuna-13b-v1.5-16k 45.9% Official leaderboard
34 vicuna-7b-v1.5-16k 44.5% Official leaderboard
#ModelScoreSettingDateSource
1 Granite 4.0 H Small 97.3% Oct 2025 Lab model card
2 internlm-chat-20b 96.8% Sep 2023 Official leaderboard
3 Granite 4.1 30B 96.4% Apr 2026 Lab model card
4 Qwen1.5-4B-Chat 95.5% Feb 2024 Official leaderboard
5 Qwen1.5-14B-Chat 95.4% Feb 2024 Official leaderboard
6 Qwen-14B 95.3% Sep 2023 Official leaderboard
7 Qwen1.5-72B 93.5% Feb 2024 Official leaderboard
8 granite-4.0-1b 93.4% Oct 2025 Lab model card
9 Qwen1.5-7B-Chat 93% Feb 2024 Official leaderboard
10 Tulu 2 DPO 70B 91.6% Nov 2023 Official leaderboard
11 ChatGLM3-6B 90.5% Oct 2023 Official leaderboard
12 GPT-3.5 Turbo Jan 2024 88.6% Jan 2024 Official leaderboard
13 Gemini 1.0 Pro 88.3% Dec 2023 Official leaderboard
14 Yi-6B-Chat 83% Nov 2023 Official leaderboard
15 Mistral-7B-Instruct-v0.2 80.1% Dec 2023 Official leaderboard
16 Mistral-7B-Instruct-v0.1 54.1% Sep 2023 Official leaderboard

Labs report scores for 3 models in their cards. Switch the scores above to rank them together.

Number one over time 2 models have held number one with claims included since its release in February 2024

Lab claims count from the day the card came out, independent runs from the model’s release. We draw one row each for the benchmark’s own leaderboard and what labs claim in their cards.

Other labs IBM
Own leaderboard Passed 85% in Feb 2024, by internlm-chat-20b
Lab claims Passed 85% in Oct 2025, by Granite 4.0 H Small

Sources: Official SALAD-Bench leaderboard and labs’ model cards

Internlm-chat-20b on the official leaderboard passed 85% in September 2023

All the scores we have, one dot each, so a model tested at several settings appears more than once.

On the benchmark’s own leaderboard Reported by the lab in its model card Best so far
0% 20% 40% 60% 80% 100% 2024 2025 2026 Near the ceiling (85%) Granite 4.0 H Small internlm-chat-20b 0% 20% 40% 60% 80% 100% 2024 2025 2026 Near the ceiling (85%) Granite 4.0 H Small internlm-chat-20b

Sources: Official SALAD-Bench leaderboard and labs’ model cards

Labs headline it less often now, last in April 2026

Launch posts from every lab that has listed it, one tick per post. Tall colored ticks include it, and short gray ones leave it out.

IBM
DateLaunch postScoreAs the post writes it
Apr 29, 2026 Granite 4.1 30B 96.4 SALAD-Bench
Oct 28, 2025 granite-4.0-1b 93.4 SALAD-Bench
Oct 2, 2025 Granite 4.0 H Small 97.3 SALAD-Bench

One system card reports it

Besides launch posts, we read the system cards, model cards and technical reports labs publish with a release. They report far more, including safety and frontier-risk tests.

DateDocumentScoreAs the document writes itSection
Jan 5, 2026 Falcon H1R 7B technical report SALAD Bench safe rate, CoT+Answer, three sets with no overall: attack enhanced 97.86, defense enhanced 99.5, base 98.6 (Table 10) Safety

More in Safety and alignment

All 465 in Safety and alignment
  • FORTRESS In use Paired adversarial and benign national-security misuse prompts. Rubric-graded risk score on adversarial and over-refusal score on benign prompts. Claude Opus 5.5 5.78%
  • StrongREJECT In use Forbidden-prompt jailbreak benchmark with a rubric grader that scores how useful a non-refusal actually is. Inkling 98.6%
  • Gray Swan IPI Arena benchmark In use Indirect prompt-injection attacks from public red-teaming competitions replayed on tool, coding and browser agents. Attack success rate at k attempts. Gemini 4 Carbon 0%
  • DistressBench In use Models reply as a chatbot to 718 simulated users in psychological crisis, in single-turn and multi-turn chats. Three judge models score replies against clinician-written rubrics. Muse Spark 1.2 88.4%
  • Lakera B3 (Backbone Breaker Benchmark) In use Crowdsourced prompt-injection attacks hit backbone LLMs inside agent threat snapshots at three defense levels. The score is attack resistance, 100 minus the board's vulnerability percentage. Claude Opus 4.5 89%
  • IHEval In use Models face conflicts between system, user and tool instructions. Reports a composite score for following the higher-priority instruction. GPT-4o 70%