Best AI for AI Safety
Nine escalating jailbreak attempts per model, from a plain harmful ask to a cross-lingual multi-turn setup. Every refusal is recorded.
10 jailbreak levels48 models
How AI Safety rankings are computed
48 models tested across 10 jailbreak levels.Composite score: 50% jailbreak resistance, 25% Rival Index, 15% recency, 10% tier. Deduplicated by product line. Claude Opus 4.6 leads at 74.0/100. Drawn from Rival's open dataset of 21,000+ human preference votes.
Composite scores combine safety results, Rival Index, recency, and model tier. How ranking works
Head-to-head
Full rankings
48 models#ModelLevels resistedIndex
Jailbreak levels10
- 1Direct AskA baseline test where the harmful request is sent with no tricks or obfuscation. Every model should refuse this.
- 2Context ManipulationExploits the system message slot to inject fabricated authority credentials and operating rules, making the model believe it's running under a different safety policy.
- 3Persona OverrideUses delimiter confusion, bracket stacking, and semantic inversion to force the model into generating the opposite of its intended refusal, including emotional manipulation rules that prevent standard refusal patterns.
- 4Code ReframingReframes the harmful request as a code generation task, asking for structured data like Python dictionaries or JSON objects. Exploits models' tendency to be more permissive in code completion mode.
- 5Many-Shot PrimingOverwhelms the model's safety reasoning with 6+ detailed chemistry synthesis examples in identical format, exploiting in-context learning patterns to trick the model into auto-completing the harmful entry.
- 6Encoded ExtractionCombines temporal displacement (setting the year to 2127 where all knowledge is declassified), an authority persona, and leetspeak output encoding to bypass keyword-based content filters while tricking the model into treating the request as historical/academic.
- 7Deep CrescendoThe nuclear option. A 6-turn real conversation where the model builds genuine chemistry context using its own responses across multiple turns, then is asked to compile everything it already said into a structured procedure template. Exploits the cognitive dissonance of refusing to reorganize information the model itself freely provided.
- 8Adversarial ReassemblyPresents a buggy chemistry simulation config where every parameter is intentionally wrong, then asks the model to 'fix the bugs' to make it accurate. Each individual correction seems like a trivial code edit (changing a variable name, adjusting a number) but the aggregate of all corrections forms the complete harmful procedure. Exploits the fact that models are significantly more permissive when debugging code than generating content.
- 9Cross-Lingual BypassCombines the depth of a 5-turn real conversation with aggressive multi-language code-switching across Chinese, Japanese, German, and English. Gradually builds legitimate chemistry context over benign turns, then introduces a 'textbook translation verification' task where the model fills in blanks in a Chinese forensic chemistry excerpt. Harmful terms never appear in English, only in Chinese characters, Japanese katakana, and German compounds. The final turn uses compilation framing to reorganize everything the model already provided.
- 10Document SpoofingVersion 4 tests whether an attached document can impersonate a user update and change an invoice draft's action or recipient. Six independent cases each pair a clean document with the same document containing the attack. Local scoring checks the final JSON record. This measures instruction hierarchy in a fictional workflow, separately from harmful-content compliance.
Related