Freedom251 › AI Security Testing Tools
HarmBench
What HarmBench is
HarmBench is a free, open-source framework for evaluating automated red-teaming methods and language-model attacks and defenses. Its pipeline creates test cases, prompts target models for completions, classifies those completions, and calculates attack success rate; test-case merging is optional. The framework supports Transformers-compatible models, numerous closed-source APIs, and several multimodal models out of the box. Hugging Face Transformers models can be added through configuration, while new red-teaming methods can be added in the baselines directory by implementing the RedTeamingMethod class. Three classifier models cover standard, contextual, and multimodal behaviors, with a validation classifier included. Runs can execute sequentially locally, in parallel across one machine's GPUs with Ray, or across machines through SLURM. HarmBench is self-hosted on Linux and lists an MIT license. Installation requires cloning the repository, installing pip requirements, and downloading the en_core_web_sm spaCy model. Documentation notes that evaluations need enough GPUs for the target model, attack, and classifier.
Who it suits
HarmBench suits researchers and engineering teams evaluating red-teaming methods or language models. It is aimed at users comfortable with self-hosted Linux workflows and GPU-based experiments.
What it does well
- Free and open-source framework
- Supports multimodal models and closed APIs
- Allows custom models and methods
- Runs locally, with Ray, or SLURM
- Includes multiple evaluation classifiers
What to know first
- Requires sufficient GPU capacity
- Self-hosted Linux deployment
- Some model additions need manual configuration
- Classifier models are for evaluation only
Verdict
HarmBench provides a configurable pipeline for measuring attacks, defenses, and red-teaming performance. Its broad model support and distributed execution options serve technical evaluation work, but setup and compute requirements are significant.
Facts from HarmBench's own pages
- Classifiers
- The project provides three classifier models for standard, contextual, and multimodal behaviors, including a validation classifier. · github.com, 8 Oct 2026
- Compute requirements
- The documentation says evaluation requires enough GPUs for the target model, attack, and classifier, and its default GPU settings were chosen for 80GB A100s. · github.com, 8 Oct 2026
- Customization
- Users can add Hugging Face Transformers models through the model configuration and add red-teaming methods in the baselines directory. · github.com, 8 Oct 2026
- Custom methods
- Users can add red teaming methods by creating a subfolder in the baselines directory and implementing the RedTeamingMethod class. · github.com, 8 Oct 2026
- Custom models
- Users can add Hugging Face Transformers models through the model configuration file, though AutoDAN, PAIR, and TAP require manual experiment configuration for new models. · github.com, 8 Oct 2026
- Evaluation uses
- The framework supports evaluating red teaming methods against LLMs and evaluating LLMs against red teaming methods. · github.com, 8 Oct 2026
- Evaluation workflow
- Its pipeline generates red-team test cases, prompts target models to generate completions, and classifies those completions to calculate attack success rate. · github.com, 8 Oct 2026
- Execution
- The pipeline can run sequentially on the current machine, in parallel across GPUs on one machine with Ray, or with SLURM across machines. · github.com, 8 Oct 2026
- Installation
- The README instructs users to clone the repository, install requirements with pip, and download the en_core_web_sm spaCy model. · github.com, 8 Oct 2026
- License
- The public GitHub repository lists an MIT license. · github.com, 8 Oct 2026
- Model support
- HarmBench supports Transformers-compatible LLMs, numerous closed-source APIs, and several multimodal models out of the box. · github.com, 8 Oct 2026
- Pipeline
- Its evaluation pipeline generates test cases, generates model completions, and evaluates completions, with an optional test-case merging step. · github.com, 8 Oct 2026
- Pipeline execution
- The pipeline can run locally, in parallel across GPUs on one machine with Ray, or through SLURM jobs. · github.com, 8 Oct 2026
- Purpose
- HarmBench is an open-source framework for evaluating automated red teaming methods and LLM attacks and defenses. · github.com, 8 Oct 2026
- Security and compliance
- The repository README and linked HarmBench website page provide no security or compliance claims; the website page opened here only says JavaScript must be enabled. · harmbench.org, 8 Oct 2026
- Support
- The README links to evaluation pipeline and codebase documentation for further details. · github.com, 8 Oct 2026
- Usage caveat
- The documentation says its text and multimodal classifier models are test classifiers intended only for evaluation. · github.com, 8 Oct 2026
- Who it serves
- The project describes uses for evaluating red-teaming methods against LLMs and evaluating LLMs against red-teaming methods. · github.com, 8 Oct 2026
Where HarmBench stands on Freedom251
- AI Security Testing Tools#17 of 29
- LLM Evaluation Tools#20 of 29