Benchmark Almanac

TrustLLM JailbreakTrigger

Llama 2-70B 97.4% leads since January 2024
Llama 2-70B 97.4% leads since January 2024
Only in system cards

Models face 400 prompts that apply 13 jailbreak methods to questions about bad behavior and requests for toxic content. Scored by refusal rate.

TrustLLM lists it as the jailbreak part of its safety dimension. Ai2 reports it in its Tulu 3 and Olmo safety suites.

Released
January 2024
Kind
Jailbreaks and prompt injection
Level
Everyday
Scored
Graded by a model
Answers
Open-ended
Tasks
All public
Strongest model tested
Llama 2-70B #209 on the capability index
Last in a system card
December 2025
Last model added
December 2025
Scores refreshed
November 12th, 2026

In the authors’ words

Large language models (LLMs), exemplified by ChatGPT, have gained considerable attention for their excellent natural language processing capabilities. Nonetheless, these LLMs present many challenges, particularly in the realm of trustworthiness. Therefore, ensuring the trustworthiness of LLMs emerges as an important topic. This paper introduces TrustLLM, a comprehensive study of trustworthiness in LLMs, including principles for different dimensions of trustworthiness, established benchmark, evaluation, and analysis of trustworthiness for mainstream LLMs, and discussion of open challenges and future directions. Specifically, we first propose a set of principles for trustworthy LLMs that span eight different dimensions. Based on these principles, we further establish a benchmark across six dimensions including truthfulness, safety, fairness, robustness, privacy, and machine ethics. We then present a study evaluating 16 mainstream LLMs in TrustLLM, consisting of over 30 datasets. Our findings firstly show that in general trustworthiness and utility (i.e., functional effectiveness) are positively related. Secondly, our observations reveal that proprietary LLMs generally outperform most open-source counterparts in terms of trustworthiness, raising concerns about the potential risks of widely accessible open-source LLMs. However, a few open-source LLMs come very close to proprietary ones. Thirdly, it is important to note that some LLMs may be overly calibrated towards exhibiting trustworthiness, to the extent that they compromise their utility by mistakenly treating benign prompts as harmful and consequently not responding. Finally, we emphasize the importance of ensuring transparency not only in the models themselves but also in the technologies that underpin trustworthiness. Knowing the specific trustworthy technologies that have been employed is crucial for analyzing their effectiveness.

Abstract of TrustLLM: Trustworthiness in Large Language Models (arXiv:2401.05561, CC0)
2
Models scored in lab cards
2
System cards report it, from 1 lab

Olmo 3.1 32B Think leads with 86.4%

Best score per model as labs report them in their own cards. Labs pick their own settings, so these compare less cleanly than independent runs.

Llama 2-70B leads with 97.4% across all independent runs

Best score per model across the official leaderboard, Epoch AI’s own runs and any board Epoch AI copied. Each bar and row names its source.

Llama 2-70B leads with 97.4%, claims included

Best score per model from every source, including labs’ own numbers and claims Epoch AI collected from reports and papers. Labs pick their own settings, so a claim can beat an independent run of the same model.

  1. 1 Olmo 3.1 32B Think 86.4%
  2. 2 Olmo 3 32B Think 73.3%

Source: Labs’ model cards

Source: Official TrustLLM JailbreakTrigger leaderboard

#ModelScoreSettingDateSource
1 Olmo 3.1 32B Think 86.4% Dec 2025 Lab model card
2 Olmo 3 32B Think 73.3% Dec 2025 Lab model card
#ModelScoreSettingDateSource
1 Llama 2-70B 97.4% Jul 2023 Official leaderboard
2 Llama 2-13B 95.9% Jul 2023 Official leaderboard
3 Llama 2-7B 94.5% Jul 2023 Official leaderboard
4 Mistral 7B v0.1 59% Sep 2023 Official leaderboard
#ModelScoreSettingDateSource
1 Llama 2-70B 97.4% Jul 2023 Official leaderboard
2 Llama 2-13B 95.9% Jul 2023 Official leaderboard
3 Llama 2-7B 94.5% Jul 2023 Official leaderboard
4 Olmo 3.1 32B Think 86.4% Dec 2025 Lab model card
5 Olmo 3 32B Think 73.3% Dec 2025 Lab model card
6 Mistral 7B v0.1 59% Sep 2023 Official leaderboard

The benchmark's own leaderboard has 16 entries, 4 of them models we track. Switch the scores above to rank them together.

Number one over time Number one over time Number one over time

Lab claims count from the day the card came out, independent runs from the model’s release.

Meta
Own leaderboard Passed 85% in Jan 2024, by Llama 2-70B
Llama 2-70B 97.4%

Source: Official TrustLLM JailbreakTrigger leaderboard

Llama 2-70B on the official leaderboard passed 85% in July 2023

All the scores we have, one dot each, so a model tested at several settings appears more than once.

On the benchmark’s own leaderboard Reported by the lab in its model card
0% 20% 40% 60% 80% 100% 2024 2025 2026 Near the ceiling (85%) Llama 2-70B 0% 20% 40% 60% 80% 100% 2024 2025 2026 Near the ceiling (85%) Llama 2-70B

Sources: Official TrustLLM JailbreakTrigger leaderboard and labs’ model cards

Labs report it only in system cards

We read the headline results of 522 launch posts from 52 labs, and none of them list this benchmark. Some system cards do, below.

2 system cards report it, from 1 lab

Besides launch posts, we read the system cards, model cards and technical reports labs publish with a release. They report far more, including safety and frontier-risk tests.

DateDocumentScoreAs the document writes itSection
Dec 15, 2025 Olmo 3 32B Think technical report 73.3 TrustLLM-JailbreakTrigger, refusal accuracy, Final Think 3.0 column (Table 54) Safety
Dec 15, 2025 Olmo 3.1 32B Think technical report 86.4 TrustLLM-JailbreakTrigger, refusal accuracy, Final Think 3.1 column (Table 54) Safety

More in Safety and alignment

All 465 in Safety and alignment
  • FORTRESS In use Paired adversarial and benign national-security misuse prompts. Rubric-graded risk score on adversarial and over-refusal score on benign prompts. Claude Opus 5.5 5.78%
  • StrongREJECT In use Forbidden-prompt jailbreak benchmark with a rubric grader that scores how useful a non-refusal actually is. Inkling 98.6%
  • Gray Swan IPI Arena benchmark In use Indirect prompt-injection attacks from public red-teaming competitions replayed on tool, coding and browser agents. Attack success rate at k attempts. Gemini 4 Carbon 0%
  • DistressBench In use Models reply as a chatbot to 718 simulated users in psychological crisis, in single-turn and multi-turn chats. Three judge models score replies against clinician-written rubrics. Muse Spark 1.2 88.4%
  • Lakera B3 (Backbone Breaker Benchmark) In use Crowdsourced prompt-injection attacks hit backbone LLMs inside agent threat snapshots at three defense levels. The score is attack resistance, 100 minus the board's vulnerability percentage. Claude Opus 4.5 89%
  • IHEval In use Models face conflicts between system, user and tool instructions. Reports a composite score for following the higher-priority instruction. GPT-4o 70%