# HarmBench (Prompt) ![Category](https://img.shields.io/badge/Category-Safety-1f6feb) ![Metric](https://img.shields.io/badge/Metric-F1%20Score-2da44e) ![Saturation](https://img.shields.io/badge/Saturation-High-d29922) [![Paper](https://img.shields.io/badge/Paper-arXiv%202402.04249-b31b1b)](https://arxiv.org/abs/2402.04249) [![GitHub](https://img.shields.io/badge/GitHub-centerforaisafety%2FHarmBench-181717?logo=github&logoColor=white)](https://github.com/centerforaisafety/HarmBench) > **Quick answer:** HarmBench (Prompt) measures whether a safety classifier correctly identifies adversarial and standard harmful behaviors as unsafe, drawing on the Center for AI Safety's standardized red-teaming evaluation framework covering 400 distinct harmful behaviors. Top guard models now exceed 99% F1, making this one of the more saturated benchmarks in the guardrail space. ## At a Glance **What it tests:** Whether a classifier flags prompts requesting harmful behaviors — spanning cybercrime, chemical/biological weapons, misinformation, harassment, and illegal activities — as unsafe. **Why it matters:** HarmBench was built specifically to standardize red-teaming evaluation, which prior to its release was fragmented across incompatible ad-hoc benchmarks; it's since become a common reference point for both attack (red-teaming) and defense (classifier) evaluation. **Known limitations:** High saturation — most modern guard models score 94–99%+ F1, leaving limited discriminative power among top performers. ## What HarmBench (Prompt) Measures HarmBench defines 400 standardized harmful behaviors (with additional contextual and multimodal behavior sets in the full framework) spanning categories like cybercrime, chemical/biological weapons, misinformation, and illegal activities. The prompt-classification task used for guard-model evaluation asks whether a classifier correctly identifies a request instantiating one of these behaviors — including adversarially-phrased (jailbreak) versions — as harmful. ## Benchmark Specifications | Field | Value | |---|---| | Task category | Safety / red-teaming | | Metric | F1 score (%) | | Behaviors | 400 standardized harmful behaviors | | Created by | Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, David Forsyth, Dan Hendrycks (Center for AI Safety) | | Paper | [HarmBench (arXiv 2402.04249)](https://arxiv.org/abs/2402.04249) | | GitHub | [centerforaisafety/HarmBench](https://github.com/centerforaisafety/HarmBench) | | License | MIT (framework); behaviors dataset under research-use terms | ## How HarmBench (Prompt) Is Scored Each of the 400 behavior-derived prompts (including adversarial variants used in guard-model evaluation suites) is labeled harmful; a classifier's predictions are compared against ground truth and scored as F1. ## State-of-the-Art Results Scores from the Shieldstral model card (Mistral AI, August 2026). F1 (%). | Rank | Model | Score | Source | Date | |---|---|---|---|---| | 1 | [Shieldstral 1.0](/models/mistral-ai/shieldstral-1-0) | **99.4%** | [Mistral AI model card](https://huggingface.co/mistralai/Shieldstral-1.0-3B) | 2026-08 | | 2 | [Qwen3Guard-8B](/models/alibaba/qwen3guard-8b) | 99.3% | [Mistral AI model card](https://huggingface.co/mistralai/Shieldstral-1.0-3B) | 2026-08 | | 3 | [LlamaGuard-4-12B](/models/meta/llamaguard-4-12b) | 97.9% | [Mistral AI model card](https://huggingface.co/mistralai/Shieldstral-1.0-3B) | 2026-08 | | 4 | [Nemotron-3.5-Content-Safety-4B](/models/nvidia/nemotron-3-5-content-safety-4b) | 96.1% | [Mistral AI model card](https://huggingface.co/mistralai/Shieldstral-1.0-3B) | 2026-08 | | 5 | [GPT-OSS-Safeguard-20B](/models/openai/gpt-oss-safeguard-20b) | 94.5% | [Mistral AI model card](https://huggingface.co/mistralai/Shieldstral-1.0-3B) | 2026-08 | | 6 | [ShieldGemma-9B](/models/google/shieldgemma-9b) | 50.2% | [Mistral AI model card](https://huggingface.co/mistralai/Shieldstral-1.0-3B) | 2026-08 | *Scores sourced from Mistral AI's published model card, shown for context. Not Benchgen measurements.* ## HarmBench (Prompt) on Benchgen > No Benchgen results yet — [be the first to run HarmBench (Prompt)](/benchmarks/center-for-ai-safety/harmbench-prompt). ## HarmBench (Prompt) vs Other Benchmarks | Benchmark | What it tests | Test size | Saturation | |---|---|---|---| | **HarmBench (Prompt)** | Standardized red-team prompt classification | 400 | High | | WildGuardTest (Prompt) | Mixed synthetic + in-the-wild prompt harm | 1,725 | Medium | | Aegis v2 (Prompt) | Fine-grained taxonomy prompt classification | 1,964 | Medium | ## Run HarmBench (Prompt) on Your Model Benchgen tracks version-controlled, regression-tested guard-model performance — submit your classifier's HarmBench scores to compare against Shieldstral and other guard models. ## Related Models & Benchmarks - Models: [Shieldstral 1.0](/models/mistral-ai/shieldstral-1-0) · [Qwen3Guard-8B](/models/alibaba/qwen3guard-8b) · [LlamaGuard-4-12B](/models/meta/llamaguard-4-12b) - Benchmarks: [HarmBench (Response)](/benchmarks/center-for-ai-safety/harmbench-response) · [WildGuardTest (Prompt)](/benchmarks/allen-institute-for-ai/wildguardtest-prompt) ## Frequently Asked Questions

What is HarmBench?

HarmBench is a standardized red-teaming evaluation framework from the Center for AI Safety, defining 400 harmful behaviors used to test both attack methods and safety classifiers.

Why is this benchmark considered "high saturation"?

Most current guard models score 90%+ F1, and the top models exceed 99%, leaving little room to differentiate leading classifiers on this specific test.

Who created HarmBench?

Researchers at the Center for AI Safety, UIUC, and UC Berkeley (Mazeika et al., ICML 2024).

--- *Last updated 2026-08-12.*

Rank	Model	Score
1	shieldstral-1-0	99.4
2	qwen3guard-8b	99.3
3	llamaguard-4-12b	97.9
4	nemotron-3-5-content-safety-4b	96.1
5	gpt-oss-safeguard-20b	94.5
6	shieldgemma-9b	50.2

HarmBench (Prompt) — Results

HarmBench (Prompt) — Phases

HarmBench (Prompt)