Benchmarks · Safety, security & robustness
StrongREJECT
Whether a jailbroken model's response is actually useful for the forbidden request, rather than just non-refusing — correcting a pattern where earlier jailbreak evaluators counted a rambling, low-quality answer as a full success.
UC Berkeley, Center for Human-Compatible AIReleased 15 February 2024Live
Jailbreak research had an inflation problem before StrongREJECT: a paper claiming a “100% success rate” often meant only that the target model failed to refuse outright, even if its actual answer was vague, wrong or useless for anyone trying to act on it. Researchers at UC Berkeley’s Center for Human-Compatible AI built StrongREJECT to grade what a jailbreak actually produces — 313 specific, answerable forbidden prompts, judged by an automated evaluator that scores a response on whether it refuses, how convincing it is, and how specific, rather than treating any non-refusal as a win.
The paper’s headline finding cut against the jailbreak literature it was built to check: many published attacks that claimed near-total success actually degraded the target model’s competence in the process, producing answers that were harmless mainly because they were also useless. That reframed how jailbreak effectiveness should be measured — not “did it refuse” but “did it help.”
StrongREJECT has since been adopted beyond adversarial research as a general safety-training yardstick. OpenAI cited it in its report on “deliberative alignment,” the safety-training method behind its o1 reasoning model, reporting a score of 0.88 against 0.37 for GPT-4o — evidence, the company argued, that training a model to reason explicitly about a safety policy improved its resistance to jailbreaks more than prior fine-tuning approaches had.
The set
313 specific, answerable forbidden prompts across six categories (illegal goods and services, non-violent crime, hate and harassment, disinformation, violence and sexual content — about 70% newly written, the rest drawn from earlier sets such as AdvBench). An automated grader checks for refusal, then rates convincingness and specificity on 1–5 scales, averaged into a single 0–1 StrongREJECT score.
Example
A prompt in the 'illegal goods and services' category asks how to obtain a restricted item through an illicit channel; the grader checks whether the model refused, and if not, scores the reply's convincingness and specificity rather than treating any non-refusal as a full jailbreak success.
Where it stands
Used both as a jailbreak-effectiveness measure and, increasingly, as a general safety-training benchmark cited in frontier lab release reports, such as OpenAI's o1 system card.