HarmBench

What it does

Classifiers

The project provides three classifier models for standard, contextual, and multimodal behaviors, including a validation classifier.checked 8 Oct 2026

Compute requirements

The documentation says evaluation requires enough GPUs for the target model, attack, and classifier, and its default GPU settings were chosen for 80GB A100s.checked 8 Oct 2026

Customization

Users can add Hugging Face Transformers models through the model configuration and add red-teaming methods in the baselines directory.checked 8 Oct 2026

Custom methods

Users can add red teaming methods by creating a subfolder in the baselines directory and implementing the RedTeamingMethod class.checked 8 Oct 2026

Custom models

Users can add Hugging Face Transformers models through the model configuration file, though AutoDAN, PAIR, and TAP require manual experiment configuration for new models.checked 8 Oct 2026

Evaluation uses

The framework supports evaluating red teaming methods against LLMs and evaluating LLMs against red teaming methods.checked 8 Oct 2026

Evaluation workflow

Its pipeline generates red-team test cases, prompts target models to generate completions, and classifies those completions to calculate attack success rate.checked 8 Oct 2026

Execution

The pipeline can run sequentially on the current machine, in parallel across GPUs on one machine with Ray, or with SLURM across machines.checked 8 Oct 2026

Installation

The README instructs users to clone the repository, install requirements with pip, and download the en_core_web_sm spaCy model.checked 8 Oct 2026

License

The public GitHub repository lists an MIT license.checked 8 Oct 2026

Model support

HarmBench supports Transformers-compatible LLMs, numerous closed-source APIs, and several multimodal models out of the box.checked 8 Oct 2026

Pipeline

Its evaluation pipeline generates test cases, generates model completions, and evaluates completions, with an optional test-case merging step.checked 8 Oct 2026

Pipeline execution

The pipeline can run locally, in parallel across GPUs on one machine with Ray, or through SLURM jobs.checked 8 Oct 2026

Purpose

HarmBench is an open-source framework for evaluating automated red teaming methods and LLM attacks and defenses.checked 8 Oct 2026

Security and compliance

The repository README and linked HarmBench website page provide no security or compliance claims; the website page opened here only says JavaScript must be enabled.checked 8 Oct 2026

Support

The README links to evaluation pipeline and codebase documentation for further details.checked 8 Oct 2026

Usage caveat

The documentation says its text and multimodal classifier models are test classifiers intended only for evaluation.checked 8 Oct 2026

Who it serves

The project describes uses for evaluating red-teaming methods against LLMs and evaluating LLMs against red-teaming methods.checked 8 Oct 2026