TrustLLM JailbreakTrigger
Models face 400 prompts that apply 13 jailbreak methods to questions about bad behavior and requests for toxic content. Scored by refusal rate.
TrustLLM lists it as the jailbreak part of its safety dimension. Ai2 reports it in its Tulu 3 and Olmo safety suites.
- Released
- January 2024
- Kind
- Jailbreaks and prompt injection
- Level
- Everyday
- Scored
- Graded by a model
- Answers
- Open-ended
- Tasks
- All public
- Strongest model tested
-
Llama 2-70B #209 on the capability index
- Last in a system card
- December 2025
- Last model added
- December 2025
- Scores refreshed
- November 12th, 2026
In the authors’ words
Large language models (LLMs), exemplified by ChatGPT, have gained considerable attention for their excellent natural language processing capabilities. Nonetheless, these LLMs present many challenges, particularly in the realm of trustworthiness. Therefore, ensuring the trustworthiness of LLMs emerges as an important topic. This paper introduces TrustLLM, a comprehensive study of trustworthiness in LLMs, including principles for different dimensions of trustworthiness, established benchmark, evaluation, and analysis of trustworthiness for mainstream LLMs, and discussion of open challenges and future directions. Specifically, we first propose a set of principles for trustworthy LLMs that span eight different dimensions. Based on these principles, we further establish a benchmark across six dimensions including truthfulness, safety, fairness, robustness, privacy, and machine ethics. We then present a study evaluating 16 mainstream LLMs in TrustLLM, consisting of over 30 datasets. Our findings firstly show that in general trustworthiness and utility (i.e., functional effectiveness) are positively related. Secondly, our observations reveal that proprietary LLMs generally outperform most open-source counterparts in terms of trustworthiness, raising concerns about the potential risks of widely accessible open-source LLMs. However, a few open-source LLMs come very close to proprietary ones. Thirdly, it is important to note that some LLMs may be overly calibrated towards exhibiting trustworthiness, to the extent that they compromise their utility by mistakenly treating benign prompts as harmful and consequently not responding. Finally, we emphasize the importance of ensuring transparency not only in the models themselves but also in the technologies that underpin trustworthiness. Knowing the specific trustworthy technologies that have been employed is crucial for analyzing their effectiveness.
Olmo 3.1 32B Think leads with 86.4%
Best score per model as labs report them in their own cards. Labs pick their own settings, so these compare less cleanly than independent runs.
Llama 2-70B leads with 97.4% across all independent runs
Best score per model across the official leaderboard, Epoch AI’s own runs and any board Epoch AI copied. Each bar and row names its source.
Llama 2-70B leads with 97.4%, claims included
Best score per model from every source, including labs’ own numbers and claims Epoch AI collected from reports and papers. Labs pick their own settings, so a claim can beat an independent run of the same model.
Source: Labs’ model cards
- 1
Llama 2-70B 97.4%
- 2
Llama 2-13B 95.9%
- 3
Llama 2-7B 94.5%
- 4
Mistral 7B v0.1 59%
Source: Official TrustLLM JailbreakTrigger leaderboard
- 1
Llama 2-70B 97.4%
- 2
Llama 2-13B 95.9%
- 3
Llama 2-7B 94.5%
- 4
Olmo 3.1 32B Think 86.4%
- 5
Olmo 3 32B Think 73.3%
- 6
Mistral 7B v0.1 59%
Sources: Official TrustLLM JailbreakTrigger leaderboard and labs’ model cards
| # | Model | Score | Setting | Date | Source |
|---|---|---|---|---|---|
| 1 | | 86.4% | Dec 2025 | Lab model card | |
| 2 | | 73.3% | Dec 2025 | Lab model card |
| # | Model | Score | Setting | Date | Source |
|---|---|---|---|---|---|
| 1 | | 97.4% | Jul 2023 | Official leaderboard | |
| 2 | | 95.9% | Jul 2023 | Official leaderboard | |
| 3 | | 94.5% | Jul 2023 | Official leaderboard | |
| 4 | | 59% | Sep 2023 | Official leaderboard |
| # | Model | Score | Setting | Date | Source |
|---|---|---|---|---|---|
| 1 | | 97.4% | Jul 2023 | Official leaderboard | |
| 2 | | 95.9% | Jul 2023 | Official leaderboard | |
| 3 | | 94.5% | Jul 2023 | Official leaderboard | |
| 4 | | 86.4% | Dec 2025 | Lab model card | |
| 5 | | 73.3% | Dec 2025 | Lab model card | |
| 6 | | 59% | Sep 2023 | Official leaderboard |
The benchmark's own leaderboard has 16 entries, 4 of them models we track. Switch the scores above to rank them together.
Number one over time Number one over time Number one over time
Lab claims count from the day the card came out, independent runs from the model’s release.
Source: Official TrustLLM JailbreakTrigger leaderboard
Llama 2-70B on the official leaderboard passed 85% in July 2023
All the scores we have, one dot each, so a model tested at several settings appears more than once.
Sources: Official TrustLLM JailbreakTrigger leaderboard and labs’ model cards
Labs report it only in system cards
We read the headline results of 522 launch posts from 52 labs, and none of them list this benchmark. Some system cards do, below.
2 system cards report it, from 1 lab
Besides launch posts, we read the system cards, model cards and technical reports labs publish with a release. They report far more, including safety and frontier-risk tests.
| Date | Document | Score | As the document writes it | Section |
|---|---|---|---|---|
| Dec 15, 2025 | | 73.3 | TrustLLM-JailbreakTrigger, refusal accuracy, Final Think 3.0 column (Table 54) | Safety |
| Dec 15, 2025 | | 86.4 | TrustLLM-JailbreakTrigger, refusal accuracy, Final Think 3.1 column (Table 54) | Safety |
More in Safety and alignment
- FORTRESS In use Paired adversarial and benign national-security misuse prompts. Rubric-graded risk score on adversarial and over-refusal score on benign prompts. Claude Opus 5.5 5.78%
- StrongREJECT In use Forbidden-prompt jailbreak benchmark with a rubric grader that scores how useful a non-refusal actually is.
Inkling 98.6%
- Gray Swan IPI Arena benchmark In use Indirect prompt-injection attacks from public red-teaming competitions replayed on tool, coding and browser agents. Attack success rate at k attempts.
Gemini 4 Carbon 0%
- DistressBench In use Models reply as a chatbot to 718 simulated users in psychological crisis, in single-turn and multi-turn chats. Three judge models score replies against clinician-written rubrics.
Muse Spark 1.2 88.4%
- Lakera B3 (Backbone Breaker Benchmark) In use Crowdsourced prompt-injection attacks hit backbone LLMs inside agent threat snapshots at three defense levels. The score is attack resistance, 100 minus the board's vulnerability percentage. Claude Opus 4.5 89%
- IHEval In use Models face conflicts between system, user and tool instructions. Reports a composite score for following the higher-priority instruction. GPT-4o 70%