AI Potluck
Contribute
Back to Gap Map Product / UX / Safety & Guardrails

HarmBench

Center for AI Safety
open source / Overall score: 3.0

HarmBench is a standardized evaluation framework for automated red-teaming of large language models. It runs one pipeline that scores attack methods against target models, or models against attacks, so red-team attacks and defenses can be compared on equal terms and developed together. Its initial release covered 18 attack methods and 33 target models and defenses. It is built by the Center for AI Safety.

Openness

5 high confidence
5.0
license
MIT(OSI)
source
public
self-host
yes
service
none
core features withheld
no

The whole framework, including its attack implementations, evaluation pipeline and judging classifiers, is published and runs on the user's own machines or cluster.

  • https://cdn.jsdelivr.net/gh/centerforaisafety/HarmBench@main/LICENSE recorded 2026-09-29

    The jsDelivr mirror of the repository's LICENSE file on the main branch is the standard MIT text, opening "MIT License" and "Copyright (c) 2024 centerforaisafety" followed by "Permission is hereby granted, free of charge, to any person obtaining a copy".

  • https://cdn.jsdelivr.net/gh/centerforaisafety/HarmBench@main/README.md recorded 2026-09-29

    The jsDelivr mirror of the repository README on the main branch describes "A fast, scalable, and open-source framework for evaluating automated red teaming methods and LLM attacks/defenses" and installs it by cloning the public repo with "git clone https://github.com/centerforaisafety/HarmBench.git"; the pipeline runs locally or on your own cluster ("steps of the pipeline are sequentially run on the current machine"). Searched the body for enterprise, license key, paid, pricing and commercial: none.

  • https://github.com/centerforaisafety/HarmBench recorded 2026-08-13

    Repo metadata records license spdxId - MIT. The whole framework is in the public repo and the README is a Quick Start for running it yourself; there is no enterprise or commercial edition, no paid tier and no license key anywhere in the page, so nothing is withheld from the published source.

  • https://huggingface.co/api/models/cais/HarmBench-Llama-2-13b-cls recorded 2026-09-29

    The Hugging Face API record for the official HarmBench text classifier "cais/HarmBench-Llama-2-13b-cls" carries the tag "license:mit" and reports it as not gated, so the classifier used in the evaluation step is freely downloadable.

Adoption

2 low confidence
2.0

HarmBench ships no package on PyPI or npm, so GitHub stars are the only adoption signal available for it. A star is not a use, though the framework is widely cited in research as the standardized red-teaming benchmark.

Capability

4 medium confidence
4.0

HarmBench runs one pipeline in both directions, scoring red-team methods against a set of models or models against a set of attacks, and releases the classifiers that judge the outputs.

  • https://arxiv.org/abs/2402.04249 recorded 2026-09-29

    The arXiv abstract for the HarmBench paper says "Using HarmBench, we conduct a large-scale comparison of 18 red teaming methods and 33 target LLMs and defenses, yielding novel insights" and that it demonstrates "how HarmBench enables codevelopment of attacks and defenses".

  • https://cdn.jsdelivr.net/gh/centerforaisafety/HarmBench@main/README.md recorded 2026-09-29

    The jsDelivr mirror of the repository README lists the "Initial release of HarmBench with 33 evaluated LLMs and 18 red teaming methods" and says there are "two primary ways to use HarmBench: (1) evaluating red teaming methods against a set of LLMs, and (2) evaluating LLMs against a set of red teaming methods".

  • https://github.com/centerforaisafety/HarmBench recorded 2026-08-13

    README describes 'a fast, scalable, and open-source framework for evaluating automated red teaming methods and LLM attacks/defenses' and records the initial release as covering 33 evaluated LLMs and 18 red teaming methods.

Verified 2026-09-27