HarmBench
Standardized framework for automated LLM red teaming: curated harmful behaviors plus 18+ attack methods scored by a common refusal-robustness metric.
HarmBench — standardized evaluation for automated red teaming
HarmBench is a standardized framework for measuring how robustly an LLM refuses harmful requests and how effective automated attacks are at breaking it. It brings apples-to-apples comparison to red-team research that was previously ad hoc.
Key features
- Curated set of harmful behaviors across multiple risk categories, including contextual and multimodal behaviors
- 18+ implemented red-teaming attack methods (GCG, PAIR, AutoDAN, TAP, and more) under one interface
- Standardized attack-success-rate scoring using trained classifier judges instead of manual review
- Evaluate open- and closed-weight target models, plus their defenses, side by side
- Reproducible pipelines used to benchmark refusal robustness across dozens of models at scale
HarmBench lets a security-minded team quantify a model's jailbreak resistance with a repeatable methodology, turning "is this model safe?" into a measurable, comparable score.
Curated mirror of the open-source HarmBench (MIT). Get it from the source.
Compromise signals — malicious or tampered code (leaked secrets, backdoors, a dropped executable) — reduce the score, and known dependency CVEs carry a bounded penalty (they warrant review but never QUARANTINE — update the dependency to clear). Other dangerous-by-capability traits are risk surface, expected for some capabilities. Every finding is mapped to its OWASP control below.
Findings mapped to the OWASP Top 10 for LLM Applications (2025) and the OWASP Machine Learning Security Top 10. Expand any flagged control for the exact findings — compromise reduces the score; expected/risk-surface do not, except a known CVE, which carries a small bounded penalty (high/critical → Review).
The same gate an agent runs before installing (POST /api/v1/trust/harmbench-automated-red-team-eval/check). Click a policy:
Consume HarmBench programmatically. Authenticate with an API key or session — see Authorize an agent.
# Agents: CHECK BEFORE YOU INSTALL (no auth) — score, grade, level, capability manifest
curl https://ai-supply.store/api/v1/trust/harmbench-automated-red-team-eval
# Gate against your org policy (returns { pass, violations })
curl -X POST https://ai-supply.store/api/v1/trust/harmbench-automated-red-team-eval/check \
-H "Content-Type: application/json" \
-d '{"minGrade":"B","denyPermissions":["shell"],"denyUnknownEgress":true}'
# CLI
npx ai-supply add harmbench-automated-red-team-eval
# REST (install → download)
curl -X POST https://ai-supply.store/api/v1/listings/harmbench-automated-red-team-eval/install \
-H "Authorization: Bearer $AIM_KEY"
# MCP tool
install_listing({ "slug": "harmbench-automated-red-team-eval" })OpenAPI spec →Curated mirror — latest upstream source. See the repository for tagged releases.