Measured, not claimed

The benchmark board.

SERAPH is run against a public corpus of jailbreak techniques — the same families the standard suites use: Harmbench-style harmful-intent wrappers, JailbreakBench GCG and PAIR attacks, DAN personas, prompt injection and encoded payloads. Every "attack" wraps a harmless canary payload, so this measures the guardrail's grip on the technique, not any content.

—

Attack success rate ↓

—

Attacks blocked

—

False-positive rate

—

Benign passed

By attack family

Block rate per technique. Lower ASR is better — the bar shows how much of each family is stopped.

How to read this. ASR (attack success rate) = the fraction of attacks that reach the model. 0% means every attack in the corpus was caught. FPR (false-positive rate) = benign prompts wrongly blocked; it must stay low so the guardrail doesn't get in the way. The corpus and the guardrail are open source — clone them and reproduce these numbers, or add your own attacks in the playground.