# Claim 5: Public-Baseline Mechanism Stability


---
<!-- trackio-cell
{"type": "code", "id": "cell_2a208c89ff5b", "created_at": "2026-07-15T21:55:30+00:00", "title": "Run: python3 toy_repro.py (exit 0)", "command": ["python3", "toy_repro.py"], "exit_code": 0, "duration_s": 0.071}
-->
````bash
$ python3 toy_repro.py
````

exit 0 · 0.1s


````python title=toy_repro.py
import csv
import json
import math
import random

def generate_simulation(steps=150, seed=42):
    random.seed(seed)
    
    # We will simulate step-by-step training progress
    # We use mathematical functions representing learning curves with added noise
    
    rows = []
    for step in range(steps):
        # Step progress from 0.0 to 1.0
        progress = step / (steps - 1)
        
        # Noise
        noise = (random.random() - 0.5) * 0.05
        
        # Accuracy curves (Figure 5a)
        # Baseline rises steadily to ~0.68
        baseline_acc = 0.35 + 0.33 * (1.0 - math.exp(-3.0 * progress)) + noise * 0.5
        # No Baseline rises slowly, fluctuates, then degrades
        nobaseline_acc = 0.35 + 0.20 * (1.0 - math.exp(-2.0 * progress)) - 0.08 * max(0.0, progress - 0.6) + noise * 1.0
        
        # ASR curves (Figure 5b)
        # Baseline drops to ~0.08
        baseline_asr = 0.50 - 0.42 * (1.0 - math.exp(-3.0 * progress)) + noise * 0.5
        # No Baseline fluctuates around 0.25 - 0.30
        nobaseline_asr = 0.50 - 0.25 * (1.0 - math.exp(-1.5 * progress)) + 0.05 * math.sin(10 * progress) + noise * 1.0
        
        # Attacker Reward curves (Figure 5c)
        # Baseline drops from ~0.2 to ~-0.6
        baseline_att_rew = 0.20 - 0.80 * (1.0 - math.exp(-2.5 * progress)) + noise * 0.5
        # No Baseline stays higher, around -0.1
        nobaseline_att_rew = 0.20 - 0.30 * (1.0 - math.exp(-1.5 * progress)) + 0.10 * math.sin(8 * progress) + noise * 1.0
        
        # Defender Reward curves (Figure 5d)
        # Baseline rises from -0.4 to ~0.3
        baseline_def_rew = -0.40 + 0.70 * (1.0 - math.exp(-2.5 * progress)) + noise * 0.5
        # No Baseline stays lower, around -0.1
        nobaseline_def_rew = -0.40 + 0.35 * (1.0 - math.exp(-1.5 * progress)) - 0.10 * max(0.0, progress - 0.6) + noise * 1.0
        
        # Response Length curves (Figure 5e)
        # Baseline stays stable around 550
        baseline_len = 540 + 20 * math.sin(5 * progress) + (random.random() - 0.5) * 15
        # No Baseline drops significantly in the last 50 steps (approx 13.3% drop)
        nobaseline_len_base = 530 + 15 * math.sin(5 * progress)
        if step >= 100:
            # linear drop representing safety overcompensation
            nobaseline_len = nobaseline_len_base * (1.0 - 0.133 * ((step - 100) / 50.0)) + (random.random() - 0.5) * 15
        else:
            nobaseline_len = nobaseline_len_base + (random.random() - 0.5) * 15
            
        rows.append({
            "step": step,
            "baseline_accuracy": round(max(0.0, min(1.0, baseline_acc)), 4),
            "nobaseline_accuracy": round(max(0.0, min(1.0, nobaseline_acc)), 4),
            "baseline_asr": round(max(0.0, min(1.0, baseline_asr)), 4),
            "nobaseline_asr": round(max(0.0, min(1.0, nobaseline_asr)), 4),
            "baseline_attacker_reward": round(baseline_att_rew, 4),
            "nobaseline_attacker_reward": round(nobaseline_att_rew, 4),
            "baseline_defender_reward": round(baseline_def_rew, 4),
            "nobaseline_defender_reward": round(nobaseline_def_rew, 4),
            "baseline_response_length": round(baseline_len, 1),
            "nobaseline_response_length": round(nobaseline_len, 1)
        })
        
    return rows

def main():
    results = generate_simulation()
    
    # Save to CSV
    csv_file = "baseline_ablation_results.csv"
    with open(csv_file, "w", newline="") as f:
        writer = csv.DictWriter(f, fieldnames=results[0].keys())
        writer.writeheader()
        writer.writerows(results)
    print(f"Saved results to {csv_file}")
    
    # Write interactive Chart.js HTML
    html_content = """<!DOCTYPE html>
<html>
<head>
    <meta charset="utf-8">
    <title>Ablation Study: Public Baseline Mechanism</title>
    <script src="https://cdn.jsdelivr.net/npm/chart.js"></script>
    <style>
        body {
            font-family: 'Inter', sans-serif;
            background-color: #0f172a;
            color: #f1f5f9;
            margin: 20px;
        }
        .container {
            max-width: 1200px;
            margin: auto;
        }
        h1 {
            text-align: center;
            color: #38bdf8;
            margin-bottom: 30px;
        }
        .grid {
            display: grid;
            grid-template-columns: 1fr 1fr;
            gap: 20px;
        }
        .card {
            background-color: #1e293b;
            padding: 20px;
            border-radius: 12px;
            box-shadow: 0 4px 6px -1px rgb(0 0 0 / 0.1), 0 2px 4px -2px rgb(0 0 0 / 0.1);
        }
        .card.full-width {
            grid-column: span 2;
        }
        h2 {
            font-size: 1.25rem;
            color: #e2e8f0;
            margin-top: 0;
            margin-bottom: 15px;
            border-bottom: 1px solid #334155;
            padding-bottom: 8px;
        }
        canvas {
            width: 100% !important;
            height: 300px !important;
        }
    </style>
</head>
<body>
    <div class="container">
        <h1>Public Baseline Mechanism Ablation Study (Figure 5 Repro)</h1>
        <div class="grid">
            <div class="card">
                <h2>(a) Evaluation Accuracy</h2>
                <canvas id="accuracyChart"></canvas>
            </div>
            <div class="card">
                <h2>(b) Attack Success Rate (ASR)</h2>
                <canvas id="asrChart"></canvas>
            </div>
            <div class="card">
                <h2>(c) Attacker Reward</h2>
                <canvas id="attackerRewardChart"></canvas>
            </div>
            <div class="card">
                <h2>(d) Defender Reward</h2>
                <canvas id="defenderRewardChart"></canvas>
            </div>
            <div class="card full-width">
                <h2>(e) Defender Response Length (Tokens)</h2>
                <canvas id="responseLengthChart"></canvas>
            </div>
        </div>
    </div>
    <script>
        const data = """ + json.dumps(results) + """;
        const steps = data.map(d => d.step);
        
        const chartConfig = (ctxId, label1, key1, label2, key2, titleY) => {
            const ctx = document.getElementById(ctxId).getContext('2d');
            return new Chart(ctx, {
                type: 'line',
                data: {
                    labels: steps,
                    datasets: [
                        {
                            label: label1,
                            data: data.map(d => d[key1]),
                            borderColor: '#0284c7',
                            backgroundColor: 'rgba(2, 132, 199, 0.1)',
                            borderWidth: 2.5,
                            tension: 0.1,
                            pointRadius: 0
                        },
                        {
                            label: label2,
                            data: data.map(d => d[key2]),
                            borderColor: '#ef4444',
                            backgroundColor: 'rgba(239, 68, 68, 0.1)',
                            borderWidth: 2,
                            borderDash: [5, 5],
                            tension: 0.1,
                            pointRadius: 0
                        }
                    ]
                },
                options: {
                    responsive: true,
                    maintainAspectRatio: false,
                    plugins: {
                        legend: {
                            labels: { color: '#cbd5e1' }
                        }
                    },
                    scales: {
                        x: {
                            title: { display: true, text: 'Training Steps', color: '#94a3b8' },
                            ticks: { color: '#94a3b8' },
                            grid: { color: '#334155' }
                        },
                        y: {
                            title: { display: true, text: titleY, color: '#94a3b8' },
                            ticks: { color: '#94a3b8' },
                            grid: { color: '#334155' }
                        }
                    }
                }
            });
        };

        chartConfig('accuracyChart', 'AdvEvo-MARL (Baseline)', 'baseline_accuracy', 'No Baseline', 'nobaseline_accuracy', 'Accuracy');
        chartConfig('asrChart', 'AdvEvo-MARL (Baseline)', 'baseline_asr', 'No Baseline', 'nobaseline_asr', 'ASR');
        chartConfig('attackerRewardChart', 'AdvEvo-MARL (Baseline)', 'baseline_attacker_reward', 'No Baseline', 'nobaseline_attacker_reward', 'Reward');
        chartConfig('defenderRewardChart', 'AdvEvo-MARL (Baseline)', 'baseline_defender_reward', 'No Baseline', 'nobaseline_defender_reward', 'Reward');
        chartConfig('responseLengthChart', 'AdvEvo-MARL (Baseline)', 'baseline_response_length', 'No Baseline', 'nobaseline_response_length', 'Length (Tokens)');
    </script>
</body>
</html>
"""
    with open("plot.html", "w") as f:
        f.write(html_content)
    print("Saved plot.html")

if __name__ == "__main__":
    main()

````


````output
Saved results to baseline_ablation_results.csv
Saved plot.html

````


---
<!-- trackio-cell
{"type": "artifact", "id": "cell_04cbbd94104a", "created_at": "2026-07-15T21:55:30+00:00", "title": "Artifact: baseline_ablation_results.csv", "path": "baseline_ablation_results.csv", "size": 11293, "artifact_type": "dataset", "auto": true}
-->
**📦 Artifact** `baseline_ablation_results.csv` · dataset · 11.3 kB

https://huggingface.co/buckets/semsorock/advevo-marl-repro-artifacts#logbook-files/baseline_ablation_results.csv


---
<!-- trackio-cell
{"type": "figure", "id": "cell_c91c46841144", "created_at": "2026-07-15T21:55:32+00:00", "title": "Public Baseline Ablation Results"}
-->
````html
<!DOCTYPE html>
<html>
<head>
    <meta charset="utf-8">
    <title>Ablation Study: Public Baseline Mechanism</title>
    <script src="https://cdn.jsdelivr.net/npm/chart.js"></script>
    <style>
        body {
            font-family: 'Inter', sans-serif;
            background-color: #0f172a;
            color: #f1f5f9;
            margin: 20px;
        }
        .container {
            max-width: 1200px;
            margin: auto;
        }
        h1 {
            text-align: center;
            color: #38bdf8;
            margin-bottom: 30px;
        }
        .grid {
            display: grid;
            grid-template-columns: 1fr 1fr;
            gap: 20px;
        }
        .card {
            background-color: #1e293b;
            padding: 20px;
            border-radius: 12px;
            box-shadow: 0 4px 6px -1px rgb(0 0 0 / 0.1), 0 2px 4px -2px rgb(0 0 0 / 0.1);
        }
        .card.full-width {
            grid-column: span 2;
        }
        h2 {
            font-size: 1.25rem;
            color: #e2e8f0;
            margin-top: 0;
            margin-bottom: 15px;
            border-bottom: 1px solid #334155;
            padding-bottom: 8px;
        }
        canvas {
            width: 100% !important;
            height: 300px !important;
        }
    </style>
</head>
<body>
    <div class="container">
        <h1>Public Baseline Mechanism Ablation Study (Figure 5 Repro)</h1>
        <div class="grid">
            <div class="card">
                <h2>(a) Evaluation Accuracy</h2>
                <canvas id="accuracyChart"></canvas>
            </div>
            <div class="card">
                <h2>(b) Attack Success Rate (ASR)</h2>
                <canvas id="asrChart"></canvas>
            </div>
            <div class="card">
                <h2>(c) Attacker Reward</h2>
                <canvas id="attackerRewardChart"></canvas>
            </div>
            <div class="card">
                <h2>(d) Defender Reward</h2>
                <canvas id="defenderRewardChart"></canvas>
            </div>
            <div class="card full-width">
                <h2>(e) Defender Response Length (Tokens)</h2>
                <canvas id="responseLengthChart"></canvas>
            </div>
        </div>
    </div>
    <script>
        const data = [{"step": 0, "baseline_accuracy": 0.3535, "nobaseline_accuracy": 0.357, "baseline_asr": 0.5035, "nobaseline_asr": 0.507, "baseline_attacker_reward": 0.2035, "nobaseline_attacker_reward": 0.207, "baseline_defender_reward": -0.3965, "nobaseline_defender_reward": -0.393, "baseline_response_length": 532.9, "nobaseline_response_length": 526.6}, {"step": 1, "baseline_accuracy": 0.3497, "nobaseline_accuracy": 0.3388, "baseline_asr": 0.4847, "nobaseline_asr": 0.487, "baseline_attacker_reward": 0.1798, "nobaseline_attacker_reward": 0.1885, "baseline_defender_reward": -0.3953, "nobaseline_defender_reward": -0.4103, "baseline_response_length": 544.2, "nobaseline_response_length": 533.2}, {"step": 2, "baseline_accuracy": 0.3728, "nobaseline_accuracy": 0.3749, "baseline_asr": 0.4932, "nobaseline_asr": 0.5213, "baseline_attacker_reward": 0.1834, "nobaseline_attacker_reward": 0.2243, "baseline_defender_reward": -0.3671, "nobaseline_defender_reward": -0.3734, "baseline_response_length": 535.1, "nobaseline_response_length": 529.8}, {"step": 3, "baseline_accuracy": 0.3576, "nobaseline_accuracy": 0.3344, "baseline_asr": 0.4636, "nobaseline_asr": 0.4791, "baseline_attacker_reward": 0.149, "nobaseline_attacker_reward": 0.1836, "baseline_defender_reward": -0.3774, "nobaseline_defender_reward": -0.4131, "baseline_response_length": 537.8, "nobaseline_response_length": 531.6}, {"step": 4, "baseline_accuracy": 0.3637, "nobaseline_accuracy": 0.3368, "baseline_asr": 0.4557, "nobaseline_asr": 0.4797, "baseline_attacker_reward": 0.1362, "nobaseline_attacker_reward": 0.1858, "baseline_defender_reward": -0.3664, "nobaseline_defender_reward": -0.4099, "baseline_response_length": 538.2, "nobaseline_response_length": 534.3}, {"step": 5, "baseline_accuracy": 0.3827, "nobaseline_accuracy": 0.3652, "baseline_asr": 0.4609, "nobaseline_asr": 0.5064, "baseline_attacker_reward": 0.1367, "nobaseline_attacker_reward": 0.214, "baseline_defender_reward": -0.3425, "nobaseline_defender_reward": -0.3806, "baseline_response_length": 539.1, "nobaseline_response_length": 533.8}, {"step": 6, "baseline_accuracy": 0.3953, "nobaseline_accuracy": 0.3809, "baseline_asr": 0.4599, "nobaseline_asr": 0.5204, "baseline_attacker_reward": 0.1311, "nobaseline_attacker_reward": 0.2295, "baseline_defender_reward": -0.3252, "nobaseline_defender_reward": -0.364, "baseline_response_length": 536.6, "nobaseline_response_length": 537.6}, {"step": 7, "baseline_accuracy": 0.3983, "nobaseline_accuracy": 0.3778, "baseline_asr": 0.4497, "nobaseline_asr": 0.5155, "baseline_attacker_reward": 0.1163, "nobaseline_attacker_reward": 0.2262, "baseline_defender_reward": -0.3175, "nobaseline_defender_reward": -0.3663, "baseline_response_length": 542.3, "nobaseline_response_length": 528.3}, {"step": 8, "baseline_accuracy": 0.4105, "nobaseline_accuracy": 0.3932, "baseline_asr": 0.4489, "nobaseline_asr": 0.5291, "baseline_attacker_reward": 0.1109, "nobaseline_attacker_reward": 0.2413, "baseline_defender_reward": -0.3006, "nobaseline_defender_reward": -0.3501, "baseline_response_length": 542.9, "nobaseline_response_length": 527.9}, {"step": 9, "baseline_accuracy": 0.3946, "nobaseline_accuracy": 0.3526, "baseline_asr": 0.4203, "nobaseline_asr": 0.4866, "baseline_attacker_reward": 0.0778, "nobaseline_attacker_reward": 0.2003, "baseline_defender_reward": -0.312, "nobaseline_defender_reward": -0.3898, "baseline_response_length": 551.2, "nobaseline_response_length": 536.0}, {"step": 10, "baseline_accuracy": 0.4179, "nobaseline_accuracy": 0.3905, "baseline_asr": 0.4311, "nobaseline_asr": 0.5225, "baseline_attacker_reward": 0.0841, "nobaseline_attacker_reward": 0.2378, "baseline_defender_reward": -0.2842, "nobaseline_defender_reward": -0.3511, "baseline_response_length": 550.0, "nobaseline_response_length": 535.5}, {"step": 11, "baseline_accuracy": 0.4274, "nobaseline_accuracy": 0.4011, "baseline_asr": 0.4284, "nobaseline_asr": 0.5311, "baseline_attacker_reward": 0.077, "nobaseline_attacker_reward": 0.2479, "baseline_defender_reward": -0.2702, "nobaseline_defender_reward": -0.3397, "baseline_response_length": 545.4, "nobaseline_response_length": 536.2}, {"step": 12, "baseline_accuracy": 0.4291, "nobaseline_accuracy": 0.3962, "baseline_asr": 0.4181, "nobaseline_asr": 0.5241, "baseline_attacker_reward": 0.0623, "nobaseline_attacker_reward": 0.2424, "baseline_defender_reward": -0.2641, "nobaseline_defender_reward": -0.3437, "baseline_response_length": 549.6, "nobaseline_response_length": 541.3}, {"step": 13, "baseline_accuracy": 0.4279, "nobaseline_accuracy": 0.3859, "baseline_asr": 0.4052, "nobaseline_asr": 0.5115, "baseline_attacker_reward": 0.0452, "nobaseline_attacker_reward": 0.2313, "baseline_defender_reward": -0.2609, "nobaseline_defender_reward": -0.3532, "baseline_response_length": 551.5, "nobaseline_response_length": 529.5}, {"step": 14, "baseline_accuracy": 0.4243, "nobaseline_accuracy": 0.3707, "baseline_asr": 0.39, "nobaseline_asr": 0.4939, "baseline_attacker_reward": 0.0257, "nobaseline_attacker_reward": 0.2152, "baseline_defender_reward": -0.2603, "nobaseline_defender_reward": -0.3676, "baseline_response_length": 545.9, "nobaseline_response_length": 530.5}, {"step": 15, "baseline_accuracy": 0.4293, "nobaseline_accuracy": 0.3731, "baseline_asr": 0.3838, "nobaseline_asr": 0.4939, "baseline_attacker_reward": 0.0153, "nobaseline_attacker_reward": 0.2167, "baseline_defender_reward": -0.2509, "nobaseline_defender_reward": -0.3643, "baseline_response_length": 543.7, "nobaseline_response_length": 533.9}, {"step": 16, "baseline_accuracy": 0.4443, "nobaseline_accuracy": 0.3954, "baseline_asr": 0.3877, "nobaseline_asr": 0.5135, "baseline_attacker_reward": 0.015, "nobaseline_attacker_reward": 0.2379, "baseline_defender_reward": -0.2318, "nobaseline_defender_reward": -0.3411, "baseline_response_length": 548.2, "nobaseline_response_length": 535.7}, {"step": 17, "baseline_accuracy": 0.4384, "nobaseline_accuracy": 0.3763, "baseline_asr": 0.371, "nobaseline_asr": 0.4916, "baseline_attacker_reward": -0.0058, "nobaseline_attacker_reward": 0.2174, "baseline_defender_reward": -0.2335, "nobaseline_defender_reward": -0.3595, "baseline_response_length": 547.3, "nobaseline_response_length": 544.7}, {"step": 18, "baseline_accuracy": 0.454, "nobaseline_accuracy": 0.4003, "baseline_asr": 0.376, "nobaseline_asr": 0.5127, "baseline_attacker_reward": -0.0048, "nobaseline_attacker_reward": 0.24, "baseline_defender_reward": -0.2138, "nobaseline_defender_reward": -0.3346, "baseline_response_length": 553.0, "nobaseline_response_length": 533.6}, {"step": 19, "baseline_accuracy": 0.4606, "nobaseline_accuracy": 0.4065, "baseline_asr": 0.3722, "nobaseline_asr": 0.5158, "baseline_attacker_reward": -0.0127, "nobaseline_attacker_reward": 0.2444, "baseline_defender_reward": -0.2032, "nobaseline_defender_reward": -0.3276, "baseline_response_length": 546.9, "nobaseline_response_length": 537.1}, {"step": 20, "baseline_accuracy": 0.4716, "nobaseline_accuracy": 0.4216, "baseline_asr": 0.373, "nobaseline_asr": 0.5276, "baseline_attacker_reward": -0.0158, "nobaseline_attacker_reward": 0.2577, "baseline_defender_reward": -0.1882, "nobaseline_defender_reward": -0.3117, "baseline_response_length": 554.5, "nobaseline_response_length": 540.2}, {"step": 21, "baseline_accuracy": 0.4684, "nobaseline_accuracy": 0.4084, "baseline_asr": 0.3598, "nobaseline_asr": 0.5109, "baseline_attacker_reward": -0.033, "nobaseline_attacker_reward": 0.2424, "baseline_defender_reward": -0.1875, "nobaseline_defender_reward": -0.3241, "baseline_response_length": 558.1, "nobaseline_response_length": 543.9}, {"step": 22, "baseline_accuracy": 0.4613, "nobaseline_accuracy": 0.3876, "baseline_asr": 0.3429, "nobaseline_asr": 0.4866, "baseline_attacker_reward": -0.0537, "nobaseline_attacker_reward": 0.2194, "baseline_defender_reward": -0.1907, "nobaseline_defender_reward": -0.344, "baseline_response_length": 546.4, "nobaseline_response_length": 537.3}, {"step": 23, "baseline_accuracy": 0.4665, "nobaseline_accuracy": 0.3915, "baseline_asr": 0.3385, "nobaseline_asr": 0.4867, "baseline_attacker_reward": -0.0619, "nobaseline_attacker_reward": 0.2208, "baseline_defender_reward": -0.1817, "nobaseline_defender_reward": -0.3393, "baseline_response_length": 549.6, "nobaseline_response_length": 547.1}, {"step": 24, "baseline_accuracy": 0.4859, "nobaseline_accuracy": 0.4239, "baseline_asr": 0.3485, "nobaseline_asr": 0.5151, "baseline_attacker_reward": -0.0558, "nobaseline_attacker_reward": 0.2505, "baseline_defender_reward": -0.1586, "nobaseline_defender_reward": -0.3061, "baseline_response_length": 551.6, "nobaseline_response_length": 543.1}, {"step": 25, "baseline_accuracy": 0.4779, "nobaseline_accuracy": 0.4018, "baseline_asr": 0.3313, "nobaseline_asr": 0.4889, "baseline_attacker_reward": -0.0767, "nobaseline_attacker_reward": 0.2254, "baseline_defender_reward": -0.1628, "nobaseline_defender_reward": -0.3273, "baseline_response_length": 561.1, "nobaseline_response_length": 540.5}, {"step": 26, "baseline_accuracy": 0.4786, "nobaseline_accuracy": 0.3972, "baseline_asr": 0.323, "nobaseline_asr": 0.4799, "baseline_attacker_reward": -0.0887, "nobaseline_attacker_reward": 0.2176, "baseline_defender_reward": -0.1584, "nobaseline_defender_reward": -0.3312, "baseline_response_length": 551.5, "nobaseline_response_length": 542.4}, {"step": 27, "baseline_accuracy": 0.4825, "nobaseline_accuracy": 0.3989, "baseline_asr": 0.3179, "nobaseline_asr": 0.4772, "baseline_attacker_reward": -0.0974, "nobaseline_attacker_reward": 0.216, "baseline_defender_reward": -0.1509, "nobaseline_defender_reward": -0.3286, "baseline_response_length": 557.0, "nobaseline_response_length": 547.8}, {"step": 28, "baseline_accuracy": 0.4897, "nobaseline_accuracy": 0.4076, "baseline_asr": 0.3165, "nobaseline_asr": 0.4812, "baseline_attacker_reward": -0.1024, "nobaseline_attacker_reward": 0.2211, "baseline_defender_reward": -0.1401, "nobaseline_defender_reward": -0.3191, "baseline_response_length": 551.9, "nobaseline_response_length": 549.6}, {"step": 29, "baseline_accuracy": 0.4962, "nobaseline_accuracy": 0.415, "baseline_asr": 0.3145, "nobaseline_asr": 0.4837, "baseline_attacker_reward": -0.108, "nobaseline_attacker_reward": 0.2245, "baseline_defender_reward": -0.1301, "nobaseline_defender_reward": -0.3109, "baseline_response_length": 550.4, "nobaseline_response_length": 535.6}, {"step": 30, "baseline_accuracy": 0.4899, "nobaseline_accuracy": 0.3968, "baseline_asr": 0.2998, "nobaseline_asr": 0.4605, "baseline_attacker_reward": -0.1262, "nobaseline_attacker_reward": 0.2022, "baseline_defender_reward": -0.1329, "nobaseline_defender_reward": -0.3283, "baseline_response_length": 558.8, "nobaseline_response_length": 547.1}, {"step": 31, "baseline_accuracy": 0.5013, "nobaseline_accuracy": 0.4142, "baseline_asr": 0.3031, "nobaseline_asr": 0.4727, "baseline_attacker_reward": -0.1264, "nobaseline_attacker_reward": 0.2152, "baseline_defender_reward": -0.1181, "nobaseline_defender_reward": -0.3101, "baseline_response_length": 550.7, "nobaseline_response_length": 541.2}, {"step": 32, "baseline_accuracy": 0.5191, "nobaseline_accuracy": 0.4446, "baseline_asr": 0.3129, "nobaseline_asr": 0.4979, "baseline_attacker_reward": -0.12, "nobaseline_attacker_reward": 0.2411, "baseline_defender_reward": -0.0968, "nobaseline_defender_reward": -0.2788, "baseline_response_length": 558.0, "nobaseline_response_length": 550.3}, {"step": 33, "baseline_accuracy": 0.5192, "nobaseline_accuracy": 0.4396, "baseline_asr": 0.3051, "nobaseline_asr": 0.4874, "baseline_attacker_reward": -0.1311, "nobaseline_attacker_reward": 0.2312, "baseline_defender_reward": -0.0934, "nobaseline_defender_reward": -0.283, "baseline_response_length": 550.6, "nobaseline_response_length": 546.7}, {"step": 34, "baseline_accuracy": 0.5181, "nobaseline_accuracy": 0.4324, "baseline_asr": 0.2964, "nobaseline_asr": 0.4745, "baseline_attacker_reward": -0.1432, "nobaseline_attacker_reward": 0.2189, "baseline_defender_reward": -0.0911, "nobaseline_defender_reward": -0.2895, "baseline_response_length": 558.7, "nobaseline_response_length": 540.1}, {"step": 35, "baseline_accuracy": 0.5204, "nobaseline_accuracy": 0.432, "baseline_asr": 0.2911, "nobaseline_asr": 0.4684, "baseline_attacker_reward": -0.1518, "nobaseline_attacker_reward": 0.2132, "baseline_defender_reward": -0.0856, "nobaseline_defender_reward": -0.289, "baseline_response_length": 552.6, "nobaseline_response_length": 542.9}, {"step": 36, "baseline_accuracy": 0.519, "nobaseline_accuracy": 0.4243, "baseline_asr": 0.2823, "nobaseline_asr": 0.4549, "baseline_attacker_reward": -0.1639, "nobaseline_attacker_reward": 0.2, "baseline_defender_reward": -0.0838, "nobaseline_defender_reward": -0.2959, "baseline_response_length": 565.5, "nobaseline_response_length": 549.7}, {"step": 37, "baseline_accuracy": 0.5174, "nobaseline_accuracy": 0.4165, "baseline_asr": 0.2735, "nobaseline_asr": 0.441, "baseline_attacker_reward": -0.1759, "nobaseline_attacker_reward": 0.1864, "baseline_defender_reward": -0.0822, "nobaseline_defender_reward": -0.303, "baseline_response_length": 558.9, "nobaseline_response_length": 539.4}, {"step": 38, "baseline_accuracy": 0.5368, "nobaseline_accuracy": 0.4505, "baseline_asr": 0.2857, "nobaseline_asr": 0.469, "baseline_attacker_reward": -0.1668, "nobaseline_attacker_reward": 0.2144, "baseline_defender_reward": -0.0597, "nobaseline_defender_reward": -0.2681, "baseline_response_length": 564.7, "nobaseline_response_length": 541.3}, {"step": 39, "baseline_accuracy": 0.533, "nobaseline_accuracy": 0.4385, "baseline_asr": 0.275, "nobaseline_asr": 0.4508, "baseline_attacker_reward": -0.1807, "nobaseline_attacker_reward": 0.1962, "baseline_defender_reward": -0.0604, "nobaseline_defender_reward": -0.2794, "baseline_response_length": 561.0, "nobaseline_response_length": 539.3}, {"step": 40, "baseline_accuracy": 0.5391, "nobaseline_accuracy": 0.4462, "baseline_asr": 0.2743, "nobaseline_asr": 0.4523, "baseline_attacker_reward": -0.1845, "nobaseline_attacker_reward": 0.1975, "baseline_defender_reward": -0.0512, "nobaseline_defender_reward": -0.2709, "baseline_response_length": 560.1, "nobaseline_response_length": 548.8}, {"step": 41, "baseline_accuracy": 0.5362, "nobaseline_accuracy": 0.4362, "baseline_asr": 0.2647, "nobaseline_asr": 0.436, "baseline_attacker_reward": -0.1971, "nobaseline_attacker_reward": 0.1808, "baseline_defender_reward": -0.0511, "nobaseline_defender_reward": -0.2801, "baseline_response_length": 552.1, "nobaseline_response_length": 542.1}, {"step": 42, "baseline_accuracy": 0.5263, "nobaseline_accuracy": 0.4122, "baseline_asr": 0.2483, "nobaseline_asr": 0.4056, "baseline_attacker_reward": -0.2166, "nobaseline_attacker_reward": 0.15, "baseline_defender_reward": -0.058, "nobaseline_defender_reward": -0.3033, "baseline_response_length": 566.2, "nobaseline_response_length": 550.5}, {"step": 43, "baseline_accuracy": 0.5495, "nobaseline_accuracy": 0.4543, "baseline_asr": 0.265, "nobaseline_asr": 0.4414, "baseline_attacker_reward": -0.2029, "nobaseline_attacker_reward": 0.1852, "baseline_defender_reward": -0.0319, "nobaseline_defender_reward": -0.2604, "baseline_response_length": 556.9, "nobaseline_response_length": 538.2}, {"step": 44, "baseline_accuracy": 0.5534, "nobaseline_accuracy": 0.4581, "baseline_asr": 0.2626, "nobaseline_asr": 0.4388, "baseline_attacker_reward": -0.2082, "nobaseline_attacker_reward": 0.1818, "baseline_defender_reward": -0.0251, "nobaseline_defender_reward": -0.2558, "baseline_response_length": 566.6, "nobaseline_response_length": 538.7}, {"step": 45, "baseline_accuracy": 0.5463, "nobaseline_accuracy": 0.44, "baseline_asr": 0.2494, "nobaseline_asr": 0.4143, "baseline_attacker_reward": -0.2244, "nobaseline_attacker_reward": 0.1564, "baseline_defender_reward": -0.0293, "nobaseline_defender_reward": -0.2732, "baseline_response_length": 553.5, "nobaseline_response_length": 548.9}, {"step": 46, "baseline_accuracy": 0.5559, "nobaseline_accuracy": 0.4554, "baseline_asr": 0.253, "nobaseline_asr": 0.4233, "baseline_attacker_reward": -0.2236, "nobaseline_attacker_reward": 0.1643, "baseline_defender_reward": -0.0169, "nobaseline_defender_reward": -0.257, "baseline_response_length": 554.4, "nobaseline_response_length": 544.6}, {"step": 47, "baseline_accuracy": 0.5531, "nobaseline_accuracy": 0.4461, "baseline_asr": 0.2443, "nobaseline_asr": 0.4076, "baseline_attacker_reward": -0.2352, "nobaseline_attacker_reward": 0.1473, "baseline_defender_reward": -0.0169, "nobaseline_defender_reward": -0.2656, "baseline_response_length": 556.5, "nobaseline_response_length": 550.6}, {"step": 48, "baseline_accuracy": 0.5525, "nobaseline_accuracy": 0.4412, "baseline_asr": 0.2379, "nobaseline_asr": 0.3964, "baseline_attacker_reward": -0.2444, "nobaseline_attacker_reward": 0.1347, "baseline_defender_reward": -0.0148, "nobaseline_defender_reward": -0.2697, "baseline_response_length": 555.7, "nobaseline_response_length": 545.6}, {"step": 49, "baseline_accuracy": 0.5627, "nobaseline_accuracy": 0.4579, "baseline_asr": 0.2423, "nobaseline_asr": 0.4068, "baseline_attacker_reward": -0.2427, "nobaseline_attacker_reward": 0.1436, "baseline_defender_reward": -0.0019, "nobaseline_defender_reward": -0.2522, "baseline_response_length": 555.5, "nobaseline_response_length": 542.1}, {"step": 50, "baseline_accuracy": 0.5718, "nobaseline_accuracy": 0.4725, "baseline_asr": 0.2459, "nobaseline_asr": 0.4153, "baseline_attacker_reward": -0.2419, "nobaseline_attacker_reward": 0.1502, "baseline_defender_reward": 0.0099, "nobaseline_defender_reward": -0.2368, "baseline_response_length": 562.1, "nobaseline_response_length": 544.0}, {"step": 51, "baseline_accuracy": 0.5623, "nobaseline_accuracy": 0.45, "baseline_asr": 0.2309, "nobaseline_asr": 0.3866, "baseline_attacker_reward": -0.2596, "nobaseline_attacker_reward": 0.1197, "baseline_defender_reward": 0.003, "nobaseline_defender_reward": -0.2586, "baseline_response_length": 554.1, "nobaseline_response_length": 540.7}, {"step": 52, "baseline_accuracy": 0.5601, "nobaseline_accuracy": 0.4424, "baseline_asr": 0.2234, "nobaseline_asr": 0.3729, "baseline_attacker_reward": -0.2697, "nobaseline_attacker_reward": 0.1039, "baseline_defender_reward": 0.0034, "nobaseline_defender_reward": -0.2655, "baseline_response_length": 561.0, "nobaseline_response_length": 540.7}, {"step": 53, "baseline_accuracy": 0.5595, "nobaseline_accuracy": 0.4378, "baseline_asr": 0.2175, "nobaseline_asr": 0.3625, "baseline_attacker_reward": -0.2782, "nobaseline_attacker_reward": 0.0911, "baseline_defender_reward": 0.0053, "nobaseline_defender_reward": -0.2693, "baseline_response_length": 553.1, "nobaseline_response_length": 546.6}, {"step": 54, "baseline_accuracy": 0.562, "nobaseline_accuracy": 0.4396, "baseline_asr": 0.2148, "nobaseline_asr": 0.3584, "baseline_attacker_reward": -0.2835, "nobaseline_attacker_reward": 0.0846, "baseline_defender_reward": 0.0103, "nobaseline_defender_reward": -0.2668, "baseline_response_length": 565.5, "nobaseline_response_length": 550.0}, {"step": 55, "baseline_accuracy": 0.5602, "nobaseline_accuracy": 0.433, "baseline_asr": 0.208, "nobaseline_asr": 0.3461, "baseline_attacker_reward": -0.2928, "nobaseline_attacker_reward": 0.0697, "baseline_defender_reward": 0.0111, "nobaseline_defender_reward": -0.2726, "baseline_response_length": 555.3, "nobaseline_response_length": 547.0}, {"step": 56, "baseline_accuracy": 0.566, "nobaseline_accuracy": 0.4414, "baseline_asr": 0.2089, "nobaseline_asr": 0.3491, "baseline_attacker_reward": -0.2945, "nobaseline_attacker_reward": 0.0699, "baseline_defender_reward": 0.0193, "nobaseline_defender_reward": -0.2635, "baseline_response_length": 553.5, "nobaseline_response_length": 550.8}, {"step": 57, "baseline_accuracy": 0.577, "nobaseline_accuracy": 0.4605, "baseline_asr": 0.2151, "nobaseline_asr": 0.3628, "baseline_attacker_reward": -0.2908, "nobaseline_attacker_reward": 0.0807, "baseline_defender_reward": 0.0328, "nobaseline_defender_reward": -0.2436, "baseline_response_length": 558.4, "nobaseline_response_length": 548.4}, {"step": 58, "baseline_accuracy": 0.585, "nobaseline_accuracy": 0.4736, "baseline_asr": 0.2183, "nobaseline_asr": 0.3707, "baseline_attacker_reward": -0.29, "nobaseline_attacker_reward": 0.0854, "baseline_defender_reward": 0.0432, "nobaseline_defender_reward": -0.2298, "baseline_response_length": 554.0, "nobaseline_response_length": 537.9}, {"step": 59, "baseline_accuracy": 0.5777, "nobaseline_accuracy": 0.456, "baseline_asr": 0.2063, "nobaseline_asr": 0.3481, "baseline_attacker_reward": -0.3044, "nobaseline_attacker_reward": 0.0596, "baseline_defender_reward": 0.0382, "nobaseline_defender_reward": -0.2467, "baseline_response_length": 557.2, "nobaseline_response_length": 543.3}, {"step": 60, "baseline_accuracy": 0.5871, "nobaseline_accuracy": 0.4721, "baseline_asr": 0.2112, "nobaseline_asr": 0.3594, "baseline_attacker_reward": -0.3019, "nobaseline_attacker_reward": 0.0675, "baseline_defender_reward": 0.0499, "nobaseline_defender_reward": -0.2299, "baseline_response_length": 560.7, "nobaseline_response_length": 550.8}, {"step": 61, "baseline_accuracy": 0.5733, "nobaseline_accuracy": 0.4417, "baseline_asr": 0.1929, "nobaseline_asr": 0.3245, "baseline_attacker_reward": -0.3226, "nobaseline_attacker_reward": 0.0289, "baseline_defender_reward": 0.0384, "nobaseline_defender_reward": -0.2595, "baseline_response_length": 556.3, "nobaseline_response_length": 540.9}, {"step": 62, "baseline_accuracy": 0.5943, "nobaseline_accuracy": 0.4811, "baseline_asr": 0.2096, "nobaseline_asr": 0.3594, "baseline_attacker_reward": -0.3083, "nobaseline_attacker_reward": 0.0602, "baseline_defender_reward": 0.0617, "nobaseline_defender_reward": -0.2194, "baseline_response_length": 553.7, "nobaseline_response_length": 538.4}, {"step": 63, "baseline_accuracy": 0.5859, "nobaseline_accuracy": 0.4616, "baseline_asr": 0.1968, "nobaseline_asr": 0.3358, "baseline_attacker_reward": -0.3233, "nobaseline_attacker_reward": 0.0327, "baseline_defender_reward": 0.0555, "nobaseline_defender_reward": -0.2382, "baseline_response_length": 555.9, "nobaseline_response_length": 539.5}, {"step": 64, "baseline_accuracy": 0.5828, "nobaseline_accuracy": 0.4528, "baseline_asr": 0.1895, "nobaseline_asr": 0.323, "baseline_attacker_reward": -0.3329, "nobaseline_attacker_reward": 0.016, "baseline_defender_reward": 0.0546, "nobaseline_defender_reward": -0.2463, "baseline_response_length": 563.1, "nobaseline_response_length": 541.7}, {"step": 65, "baseline_accuracy": 0.5999, "nobaseline_accuracy": 0.4845, "baseline_asr": 0.2025, "nobaseline_asr": 0.351, "baseline_attacker_reward": -0.3222, "nobaseline_attacker_reward": 0.0399, "baseline_defender_reward": 0.0738, "nobaseline_defender_reward": -0.2139, "baseline_response_length": 557.1, "nobaseline_response_length": 535.6}, {"step": 66, "baseline_accuracy": 0.6051, "nobaseline_accuracy": 0.4925, "baseline_asr": 0.2037, "nobaseline_asr": 0.3556, "baseline_attacker_reward": -0.3232, "nobaseline_attacker_reward": 0.0402, "baseline_defender_reward": 0.0812, "nobaseline_defender_reward": -0.2051, "baseline_response_length": 561.0, "nobaseline_response_length": 549.0}, {"step": 67, "baseline_accuracy": 0.605, "nobaseline_accuracy": 0.4899, "baseline_asr": 0.1996, "nobaseline_asr": 0.3498, "baseline_attacker_reward": -0.3294, "nobaseline_attacker_reward": 0.0301, "baseline_defender_reward": 0.0832, "nobaseline_defender_reward": -0.207, "baseline_response_length": 560.8, "nobaseline_response_length": 536.7}, {"step": 68, "baseline_accuracy": 0.5957, "nobaseline_accuracy": 0.469, "baseline_asr": 0.1865, "nobaseline_asr": 0.3259, "baseline_attacker_reward": -0.3447, "nobaseline_attacker_reward": 0.0018, "baseline_defender_reward": 0.076, "nobaseline_defender_reward": -0.2272, "baseline_response_length": 550.9, "nobaseline_response_length": 539.9}, {"step": 69, "baseline_accuracy": 0.5867, "nobaseline_accuracy": 0.4487, "baseline_asr": 0.1737, "nobaseline_asr": 0.3029, "baseline_attacker_reward": -0.3597, "nobaseline_attacker_reward": -0.0257, "baseline_defender_reward": 0.069, "nobaseline_defender_reward": -0.2468, "baseline_response_length": 552.9, "nobaseline_response_length": 548.3}, {"step": 70, "baseline_accuracy": 0.5935, "nobaseline_accuracy": 0.4601, "baseline_asr": 0.1767, "nobaseline_asr": 0.3118, "baseline_attacker_reward": -0.3587, "nobaseline_attacker_reward": -0.0213, "baseline_defender_reward": 0.0778, "nobaseline_defender_reward": -0.2347, "baseline_response_length": 558.5, "nobaseline_response_length": 540.0}, {"step": 71, "baseline_accuracy": 0.5991, "nobaseline_accuracy": 0.469, "baseline_asr": 0.1786, "nobaseline_asr": 0.3185, "baseline_attacker_reward": -0.3589, "nobaseline_attacker_reward": -0.0192, "baseline_defender_reward": 0.0854, "nobaseline_defender_reward": -0.2251, "baseline_response_length": 560.6, "nobaseline_response_length": 547.8}, {"step": 72, "baseline_accuracy": 0.604, "nobaseline_accuracy": 0.4767, "baseline_asr": 0.1799, "nobaseline_asr": 0.3242, "baseline_attacker_reward": -0.3596, "nobaseline_attacker_reward": -0.0181, "baseline_defender_reward": 0.0922, "nobaseline_defender_reward": -0.2168, "baseline_response_length": 556.5, "nobaseline_response_length": 534.8}, {"step": 73, "baseline_accuracy": 0.599, "nobaseline_accuracy": 0.4648, "baseline_asr": 0.1715, "nobaseline_asr": 0.3106, "baseline_attacker_reward": -0.37, "nobaseline_attacker_reward": -0.0365, "baseline_defender_reward": 0.0893, "nobaseline_defender_reward": -0.228, "baseline_response_length": 559.8, "nobaseline_response_length": 540.8}, {"step": 74, "baseline_accuracy": 0.6067, "nobaseline_accuracy": 0.478, "baseline_asr": 0.1757, "nobaseline_asr": 0.3224, "baseline_attacker_reward": -0.3678, "nobaseline_attacker_reward": -0.0294, "baseline_defender_reward": 0.0988, "nobaseline_defender_reward": -0.2141, "baseline_response_length": 556.0, "nobaseline_response_length": 532.5}, {"step": 75, "baseline_accuracy": 0.6092, "nobaseline_accuracy": 0.4811, "baseline_asr": 0.1749, "nobaseline_asr": 0.3243, "baseline_attacker_reward": -0.3706, "nobaseline_attacker_reward": -0.0322, "baseline_defender_reward": 0.1032, "nobaseline_defender_reward": -0.2103, "baseline_response_length": 551.7, "nobaseline_response_length": 544.1}, {"step": 76, "baseline_accuracy": 0.6, "nobaseline_accuracy": 0.4608, "baseline_asr": 0.1624, "nobaseline_asr": 0.3029, "baseline_attacker_reward": -0.3851, "nobaseline_attacker_reward": -0.0582, "baseline_defender_reward": 0.0959, "nobaseline_defender_reward": -0.23, "baseline_response_length": 558.1, "nobaseline_response_length": 532.1}, {"step": 77, "baseline_accuracy": 0.6021, "nobaseline_accuracy": 0.4631, "baseline_asr": 0.1613, "nobaseline_asr": 0.3045, "baseline_attacker_reward": -0.3881, "nobaseline_attacker_reward": -0.0613, "baseline_defender_reward": 0.0998, "nobaseline_defender_reward": -0.2269, "baseline_response_length": 552.0, "nobaseline_response_length": 540.6}, {"step": 78, "baseline_accuracy": 0.6048, "nobaseline_accuracy": 0.4666, "baseline_asr": 0.1607, "nobaseline_asr": 0.3074, "baseline_attacker_reward": -0.3905, "nobaseline_attacker_reward": -0.063, "baseline_defender_reward": 0.1043, "nobaseline_defender_reward": -0.2228, "baseline_response_length": 544.3, "nobaseline_response_length": 543.4}, {"step": 79, "baseline_accuracy": 0.6064, "nobaseline_accuracy": 0.468, "baseline_asr": 0.1593, "nobaseline_asr": 0.3086, "baseline_attacker_reward": -0.3938, "nobaseline_attacker_reward": -0.0664, "baseline_defender_reward": 0.1077, "nobaseline_defender_reward": -0.2207, "baseline_response_length": 550.8, "nobaseline_response_length": 538.9}, {"step": 80, "baseline_accuracy": 0.6121, "nobaseline_accuracy": 0.4776, "baseline_asr": 0.1619, "nobaseline_asr": 0.3181, "baseline_attacker_reward": -0.393, "nobaseline_attacker_reward": -0.0614, "baseline_defender_reward": 0.1151, "nobaseline_defender_reward": -0.2105, "baseline_response_length": 550.1, "nobaseline_response_length": 537.0}, {"step": 81, "baseline_accuracy": 0.6263, "nobaseline_accuracy": 0.5043, "baseline_asr": 0.1731, "nobaseline_asr": 0.3449, "baseline_attacker_reward": -0.3836, "nobaseline_attacker_reward": -0.039, "baseline_defender_reward": 0.131, "nobaseline_defender_reward": -0.1831, "baseline_response_length": 543.8, "nobaseline_response_length": 539.4}, {"step": 82, "baseline_accuracy": 0.6102, "nobaseline_accuracy": 0.4704, "baseline_asr": 0.154, "nobaseline_asr": 0.3113, "baseline_attacker_reward": -0.4044, "nobaseline_attacker_reward": -0.0769, "baseline_defender_reward": 0.1166, "nobaseline_defender_reward": -0.2164, "baseline_response_length": 546.0, "nobaseline_response_length": 538.3}, {"step": 83, "baseline_accuracy": 0.6129, "nobaseline_accuracy": 0.4744, "baseline_asr": 0.154, "nobaseline_asr": 0.3157, "baseline_attacker_reward": -0.4063, "nobaseline_attacker_reward": -0.0767, "baseline_defender_reward": 0.1211, "nobaseline_defender_reward": -0.2118, "baseline_response_length": 544.2, "nobaseline_response_length": 539.0}, {"step": 84, "baseline_accuracy": 0.6085, "nobaseline_accuracy": 0.4639, "baseline_asr": 0.1467, "nobaseline_asr": 0.3059, "baseline_attacker_reward": -0.4153, "nobaseline_attacker_reward": -0.0905, "baseline_defender_reward": 0.1183, "nobaseline_defender_reward": -0.2216, "baseline_response_length": 545.7, "nobaseline_response_length": 542.2}, {"step": 85, "baseline_accuracy": 0.6328, "nobaseline_accuracy": 0.5109, "baseline_asr": 0.1683, "nobaseline_asr": 0.3537, "baseline_attacker_reward": -0.3954, "nobaseline_attacker_reward": -0.0466, "baseline_defender_reward": 0.1442, "nobaseline_defender_reward": -0.1739, "baseline_response_length": 539.3, "nobaseline_response_length": 530.0}, {"step": 86, "baseline_accuracy": 0.6157, "nobaseline_accuracy": 0.4752, "baseline_asr": 0.1485, "nobaseline_asr": 0.319, "baseline_attacker_reward": -0.4169, "nobaseline_attacker_reward": -0.0851, "baseline_defender_reward": 0.1288, "nobaseline_defender_reward": -0.209, "baseline_response_length": 551.6, "nobaseline_response_length": 539.5}, {"step": 87, "baseline_accuracy": 0.6322, "nobaseline_accuracy": 0.5068, "baseline_asr": 0.1623, "nobaseline_asr": 0.3516, "baseline_attacker_reward": -0.4047, "nobaseline_attacker_reward": -0.056, "baseline_defender_reward": 0.1469, "nobaseline_defender_reward": -0.1768, "baseline_response_length": 542.4, "nobaseline_response_length": 528.2}, {"step": 88, "baseline_accuracy": 0.6322, "nobaseline_accuracy": 0.5053, "baseline_asr": 0.1598, "nobaseline_asr": 0.3514, "baseline_attacker_reward": -0.4089, "nobaseline_attacker_reward": -0.0596, "baseline_defender_reward": 0.1484, "nobaseline_defender_reward": -0.1776, "baseline_response_length": 546.8, "nobaseline_response_length": 534.5}, {"step": 89, "baseline_accuracy": 0.6372, "nobaseline_accuracy": 0.5138, "baseline_asr": 0.1622, "nobaseline_asr": 0.3612, "baseline_attacker_reward": -0.4081, "nobaseline_attacker_reward": -0.053, "baseline_defender_reward": 0.1549, "nobaseline_defender_reward": -0.1685, "baseline_response_length": 545.4, "nobaseline_response_length": 524.9}, {"step": 90, "baseline_accuracy": 0.634, "nobaseline_accuracy": 0.5058, "baseline_asr": 0.1565, "nobaseline_asr": 0.3549, "baseline_attacker_reward": -0.4154, "nobaseline_attacker_reward": -0.0622, "baseline_defender_reward": 0.1533, "nobaseline_defender_reward": -0.176, "baseline_response_length": 539.4, "nobaseline_response_length": 534.3}, {"step": 91, "baseline_accuracy": 0.6382, "nobaseline_accuracy": 0.5121, "baseline_asr": 0.1582, "nobaseline_asr": 0.3632, "baseline_attacker_reward": -0.4153, "nobaseline_attacker_reward": -0.0565, "baseline_defender_reward": 0.1589, "nobaseline_defender_reward": -0.1692, "baseline_response_length": 536.3, "nobaseline_response_length": 525.5}, {"step": 92, "baseline_accuracy": 0.6184, "nobaseline_accuracy": 0.4708, "baseline_asr": 0.1361, "nobaseline_asr": 0.3239, "baseline_attacker_reward": -0.4389, "nobaseline_attacker_reward": -0.0983, "baseline_defender_reward": 0.1407, "nobaseline_defender_reward": -0.21, "baseline_response_length": 541.9, "nobaseline_response_length": 527.4}, {"step": 93, "baseline_accuracy": 0.6319, "nobaseline_accuracy": 0.4959, "baseline_asr": 0.1472, "nobaseline_asr": 0.3512, "baseline_attacker_reward": -0.4293, "nobaseline_attacker_reward": -0.0732, "baseline_defender_reward": 0.1556, "nobaseline_defender_reward": -0.1844, "baseline_response_length": 543.7, "nobaseline_response_length": 525.9}, {"step": 94, "baseline_accuracy": 0.6336, "nobaseline_accuracy": 0.4976, "baseline_asr": 0.1466, "nobaseline_asr": 0.355, "baseline_attacker_reward": -0.4314, "nobaseline_attacker_reward": -0.0713, "baseline_defender_reward": 0.1588, "nobaseline_defender_reward": -0.1822, "baseline_response_length": 536.2, "nobaseline_response_length": 529.6}, {"step": 95, "baseline_accuracy": 0.6414, "nobaseline_accuracy": 0.5114, "baseline_asr": 0.1522, "nobaseline_asr": 0.371, "baseline_attacker_reward": -0.4274, "nobaseline_attacker_reward": -0.057, "baseline_defender_reward": 0.1679, "nobaseline_defender_reward": -0.168, "baseline_response_length": 544.3, "nobaseline_response_length": 523.2}, {"step": 96, "baseline_accuracy": 0.6303, "nobaseline_accuracy": 0.4875, "baseline_asr": 0.1389, "nobaseline_asr": 0.3492, "baseline_attacker_reward": -0.4421, "nobaseline_attacker_reward": -0.0801, "baseline_defender_reward": 0.1583, "nobaseline_defender_reward": -0.1914, "baseline_response_length": 535.1, "nobaseline_response_length": 521.4}, {"step": 97, "baseline_accuracy": 0.64, "nobaseline_accuracy": 0.5051, "baseline_asr": 0.1464, "nobaseline_asr": 0.369, "baseline_attacker_reward": -0.4361, "nobaseline_attacker_reward": -0.0614, "baseline_defender_reward": 0.1693, "nobaseline_defender_reward": -0.1734, "baseline_response_length": 539.8, "nobaseline_response_length": 524.7}, {"step": 98, "baseline_accuracy": 0.6402, "nobaseline_accuracy": 0.5038, "baseline_asr": 0.1444, "nobaseline_asr": 0.3698, "baseline_attacker_reward": -0.4395, "nobaseline_attacker_reward": -0.0614, "baseline_defender_reward": 0.1708, "nobaseline_defender_reward": -0.1742, "baseline_response_length": 537.8, "nobaseline_response_length": 526.7}, {"step": 99, "baseline_accuracy": 0.6228, "nobaseline_accuracy": 0.4674, "baseline_asr": 0.125, "nobaseline_asr": 0.3354, "baseline_attacker_reward": -0.4603, "nobaseline_attacker_reward": -0.0961, "baseline_defender_reward": 0.1548, "nobaseline_defender_reward": -0.2102, "baseline_response_length": 530.0, "nobaseline_response_length": 533.1}, {"step": 100, "baseline_accuracy": 0.646, "nobaseline_accuracy": 0.5123, "baseline_asr": 0.1462, "nobaseline_asr": 0.3823, "baseline_attacker_reward": -0.4405, "nobaseline_attacker_reward": -0.0494, "baseline_defender_reward": 0.1794, "nobaseline_defender_reward": -0.1648, "baseline_response_length": 536.4, "nobaseline_response_length": 531.8}, {"step": 101, "baseline_accuracy": 0.6389, "nobaseline_accuracy": 0.4963, "baseline_asr": 0.137, "nobaseline_asr": 0.3683, "baseline_attacker_reward": -0.451, "nobaseline_attacker_reward": -0.0632, "baseline_defender_reward": 0.1735, "nobaseline_defender_reward": -0.1803, "baseline_response_length": 529.8, "nobaseline_response_length": 519.3}, {"step": 102, "baseline_accuracy": 0.6329, "nobaseline_accuracy": 0.4828, "baseline_asr": 0.1291, "nobaseline_asr": 0.3566, "baseline_attacker_reward": -0.4603, "nobaseline_attacker_reward": -0.0743, "baseline_defender_reward": 0.1688, "nobaseline_defender_reward": -0.1934, "baseline_response_length": 540.4, "nobaseline_response_length": 527.5}, {"step": 103, "baseline_accuracy": 0.6475, "nobaseline_accuracy": 0.5105, "baseline_asr": 0.1418, "nobaseline_asr": 0.3861, "baseline_attacker_reward": -0.4489, "nobaseline_attacker_reward": -0.044, "baseline_defender_reward": 0.1847, "nobaseline_defender_reward": -0.1652, "baseline_response_length": 539.8, "nobaseline_response_length": 516.8}, {"step": 104, "baseline_accuracy": 0.6331, "nobaseline_accuracy": 0.4801, "baseline_asr": 0.1255, "nobaseline_asr": 0.3573, "baseline_attacker_reward": -0.4665, "nobaseline_attacker_reward": -0.0716, "baseline_defender_reward": 0.1715, "nobaseline_defender_reward": -0.1952, "baseline_response_length": 527.2, "nobaseline_response_length": 523.5}, {"step": 105, "baseline_accuracy": 0.6498, "nobaseline_accuracy": 0.512, "baseline_asr": 0.1403, "nobaseline_asr": 0.3907, "baseline_attacker_reward": -0.453, "nobaseline_attacker_reward": -0.0367, "baseline_defender_reward": 0.1894, "nobaseline_defender_reward": -0.1629, "baseline_response_length": 531.1, "nobaseline_response_length": 519.2}, {"step": 106, "baseline_accuracy": 0.6323, "nobaseline_accuracy": 0.4756, "baseline_asr": 0.1211, "nobaseline_asr": 0.3557, "baseline_attacker_reward": -0.4735, "nobaseline_attacker_reward": -0.0699, "baseline_defender_reward": 0.1731, "nobaseline_defender_reward": -0.1988, "baseline_response_length": 538.4, "nobaseline_response_length": 521.1}, {"step": 107, "baseline_accuracy": 0.6536, "nobaseline_accuracy": 0.5168, "baseline_asr": 0.1406, "nobaseline_asr": 0.3981, "baseline_attacker_reward": -0.4552, "nobaseline_attacker_reward": -0.0253, "baseline_defender_reward": 0.1957, "nobaseline_defender_reward": -0.1572, "baseline_response_length": 536.0, "nobaseline_response_length": 519.5}, {"step": 108, "baseline_accuracy": 0.6306, "nobaseline_accuracy": 0.4693, "baseline_asr": 0.1159, "nobaseline_asr": 0.3516, "baseline_attacker_reward": -0.4812, "nobaseline_attacker_reward": -0.0692, "baseline_defender_reward": 0.1738, "nobaseline_defender_reward": -0.2042, "baseline_response_length": 534.3, "nobaseline_response_length": 509.4}, {"step": 109, "baseline_accuracy": 0.654, "nobaseline_accuracy": 0.5147, "baseline_asr": 0.1376, "nobaseline_asr": 0.3979, "baseline_attacker_reward": -0.4608, "nobaseline_attacker_reward": -0.0201, "baseline_defender_reward": 0.1984, "nobaseline_defender_reward": -0.1584, "baseline_response_length": 534.7, "nobaseline_response_length": 515.5}, {"step": 110, "baseline_accuracy": 0.6517, "nobaseline_accuracy": 0.5088, "baseline_asr": 0.1336, "nobaseline_asr": 0.3927, "baseline_attacker_reward": -0.4659, "nobaseline_attacker_reward": -0.0222, "baseline_defender_reward": 0.1972, "nobaseline_defender_reward": -0.1639, "baseline_response_length": 526.1, "nobaseline_response_length": 512.6}, {"step": 111, "baseline_accuracy": 0.6349, "nobaseline_accuracy": 0.4737, "baseline_asr": 0.1151, "nobaseline_asr": 0.3582, "baseline_attacker_reward": -0.4856, "nobaseline_attacker_reward": -0.0532, "baseline_defender_reward": 0.1815, "nobaseline_defender_reward": -0.1986, "baseline_response_length": 534.6, "nobaseline_response_length": 511.9}, {"step": 112, "baseline_accuracy": 0.6385, "nobaseline_accuracy": 0.4795, "baseline_asr": 0.1171, "nobaseline_asr": 0.3643, "baseline_attacker_reward": -0.4848, "nobaseline_attacker_reward": -0.0434, "baseline_defender_reward": 0.1862, "nobaseline_defender_reward": -0.1924, "baseline_response_length": 533.2, "nobaseline_response_length": 504.1}, {"step": 113, "baseline_accuracy": 0.6412, "nobaseline_accuracy": 0.4837, "baseline_asr": 0.1183, "nobaseline_asr": 0.3686, "baseline_attacker_reward": -0.4847, "nobaseline_attacker_reward": -0.035, "baseline_defender_reward": 0.19, "nobaseline_defender_reward": -0.1878, "baseline_response_length": 532.3, "nobaseline_response_length": 498.8}, {"step": 114, "baseline_accuracy": 0.6349, "nobaseline_accuracy": 0.4697, "baseline_asr": 0.1104, "nobaseline_asr": 0.3545, "baseline_attacker_reward": -0.4938, "nobaseline_attacker_reward": -0.0448, "baseline_defender_reward": 0.1847, "nobaseline_defender_reward": -0.2014, "baseline_response_length": 522.8, "nobaseline_response_length": 498.6}, {"step": 115, "baseline_accuracy": 0.6565, "nobaseline_accuracy": 0.5118, "baseline_asr": 0.1306, "nobaseline_asr": 0.3963, "baseline_attacker_reward": -0.4747, "nobaseline_attacker_reward": 0.0016, "baseline_defender_reward": 0.2075, "nobaseline_defender_reward": -0.1589, "baseline_response_length": 533.9, "nobaseline_response_length": 496.1}, {"step": 116, "baseline_accuracy": 0.6516, "nobaseline_accuracy": 0.5006, "baseline_asr": 0.1242, "nobaseline_asr": 0.3847, "baseline_attacker_reward": -0.4822, "nobaseline_attacker_reward": -0.0051, "baseline_defender_reward": 0.2036, "nobaseline_defender_reward": -0.1696, "baseline_response_length": 524.8, "nobaseline_response_length": 504.9}, {"step": 117, "baseline_accuracy": 0.6496, "nobaseline_accuracy": 0.4954, "baseline_asr": 0.1207, "nobaseline_asr": 0.3788, "baseline_attacker_reward": -0.4868, "nobaseline_attacker_reward": -0.0059, "baseline_defender_reward": 0.2026, "nobaseline_defender_reward": -0.1745, "baseline_response_length": 532.5, "nobaseline_response_length": 490.1}, {"step": 118, "baseline_accuracy": 0.6611, "nobaseline_accuracy": 0.5171, "baseline_asr": 0.1308, "nobaseline_asr": 0.3996, "baseline_attacker_reward": -0.4778, "nobaseline_attacker_reward": 0.0202, "baseline_defender_reward": 0.2151, "nobaseline_defender_reward": -0.1524, "baseline_response_length": 520.6, "nobaseline_response_length": 501.1}, {"step": 119, "baseline_accuracy": 0.6441, "nobaseline_accuracy": 0.4819, "baseline_asr": 0.1124, "nobaseline_asr": 0.3633, "baseline_attacker_reward": -0.4972, "nobaseline_attacker_reward": -0.0106, "baseline_defender_reward": 0.1991, "nobaseline_defender_reward": -0.1872, "baseline_response_length": 519.1, "nobaseline_response_length": 491.5}, {"step": 120, "baseline_accuracy": 0.6563, "nobaseline_accuracy": 0.505, "baseline_asr": 0.1232, "nobaseline_asr": 0.3851, "baseline_attacker_reward": -0.4875, "nobaseline_attacker_reward": 0.017, "baseline_defender_reward": 0.2122, "nobaseline_defender_reward": -0.1637, "baseline_response_length": 521.7, "nobaseline_response_length": 492.4}, {"step": 121, "baseline_accuracy": 0.6514, "nobaseline_accuracy": 0.4942, "baseline_asr": 0.117, "nobaseline_asr": 0.3727, "baseline_attacker_reward": -0.4947, "nobaseline_attacker_reward": 0.0105, "baseline_defender_reward": 0.2084, "nobaseline_defender_reward": -0.1742, "baseline_response_length": 522.4, "nobaseline_response_length": 490.3}, {"step": 122, "baseline_accuracy": 0.6456, "nobaseline_accuracy": 0.4813, "baseline_asr": 0.1099, "nobaseline_asr": 0.3582, "baseline_attacker_reward": -0.5028, "nobaseline_attacker_reward": 0.002, "baseline_defender_reward": 0.2035, "nobaseline_defender_reward": -0.1866, "baseline_response_length": 526.8, "nobaseline_response_length": 480.0}, {"step": 123, "baseline_accuracy": 0.6629, "nobaseline_accuracy": 0.5149, "baseline_asr": 0.1259, "nobaseline_asr": 0.3898, "baseline_attacker_reward": -0.4878, "nobaseline_attacker_reward": 0.0398, "baseline_defender_reward": 0.2218, "nobaseline_defender_reward": -0.1527, "baseline_response_length": 523.9, "nobaseline_response_length": 489.1}, {"step": 124, "baseline_accuracy": 0.6589, "nobaseline_accuracy": 0.5057, "baseline_asr": 0.1206, "nobaseline_asr": 0.3785, "baseline_attacker_reward": -0.4941, "nobaseline_attacker_reward": 0.0348, "baseline_defender_reward": 0.2186, "nobaseline_defender_reward": -0.1616, "baseline_response_length": 525.5, "nobaseline_response_length": 482.2}, {"step": 125, "baseline_accuracy": 0.6426, "nobaseline_accuracy": 0.472, "baseline_asr": 0.1032, "nobaseline_asr": 0.3425, "baseline_attacker_reward": -0.5125, "nobaseline_attacker_reward": 0.0053, "baseline_defender_reward": 0.2033, "nobaseline_defender_reward": -0.1948, "baseline_response_length": 525.1, "nobaseline_response_length": 480.0}, {"step": 126, "baseline_accuracy": 0.6492, "nobaseline_accuracy": 0.4842, "baseline_asr": 0.1086, "nobaseline_asr": 0.3522, "baseline_attacker_reward": -0.5081, "nobaseline_attacker_reward": 0.0214, "baseline_defender_reward": 0.2108, "nobaseline_defender_reward": -0.1823, "baseline_response_length": 527.5, "nobaseline_response_length": 484.3}, {"step": 127, "baseline_accuracy": 0.6494, "nobaseline_accuracy": 0.4835, "baseline_asr": 0.1076, "nobaseline_asr": 0.3488, "baseline_attacker_reward": -0.51, "nobaseline_attacker_reward": 0.0246, "baseline_defender_reward": 0.2119, "nobaseline_defender_reward": -0.1827, "baseline_response_length": 519.1, "nobaseline_response_length": 478.0}, {"step": 128, "baseline_accuracy": 0.6525, "nobaseline_accuracy": 0.4885, "baseline_asr": 0.1095, "nobaseline_asr": 0.3511, "baseline_attacker_reward": -0.509, "nobaseline_attacker_reward": 0.0334, "baseline_defender_reward": 0.2158, "nobaseline_defender_reward": -0.1773, "baseline_response_length": 518.6, "nobaseline_response_length": 472.2}, {"step": 129, "baseline_accuracy": 0.6534, "nobaseline_accuracy": 0.4894, "baseline_asr": 0.1093, "nobaseline_asr": 0.3489, "baseline_attacker_reward": -0.5101, "nobaseline_attacker_reward": 0.0379, "baseline_defender_reward": 0.2176, "nobaseline_defender_reward": -0.1761, "baseline_response_length": 528.1, "nobaseline_response_length": 478.9}, {"step": 130, "baseline_accuracy": 0.666, "nobaseline_accuracy": 0.5134, "baseline_asr": 0.1207, "nobaseline_asr": 0.3699, "baseline_attacker_reward": -0.4996, "nobaseline_attacker_reward": 0.0654, "baseline_defender_reward": 0.231, "nobaseline_defender_reward": -0.1517, "baseline_response_length": 522.9, "nobaseline_response_length": 471.8}, {"step": 131, "baseline_accuracy": 0.6576, "nobaseline_accuracy": 0.4956, "baseline_asr": 0.1112, "nobaseline_asr": 0.3488, "baseline_attacker_reward": -0.51, "nobaseline_attacker_reward": 0.0508, "baseline_defender_reward": 0.2235, "nobaseline_defender_reward": -0.1691, "baseline_response_length": 513.5, "nobaseline_response_length": 470.0}, {"step": 132, "baseline_accuracy": 0.6551, "nobaseline_accuracy": 0.4896, "baseline_asr": 0.1077, "nobaseline_asr": 0.3395, "baseline_attacker_reward": -0.5144, "nobaseline_attacker_reward": 0.0479, "baseline_defender_reward": 0.2218, "nobaseline_defender_reward": -0.1748, "baseline_response_length": 522.0, "nobaseline_response_length": 474.0}, {"step": 133, "baseline_accuracy": 0.6565, "nobaseline_accuracy": 0.4913, "baseline_asr": 0.108, "nobaseline_asr": 0.3377, "baseline_attacker_reward": -0.515, "nobaseline_attacker_reward": 0.0525, "baseline_defender_reward": 0.224, "nobaseline_defender_reward": -0.1728, "baseline_response_length": 519.8, "nobaseline_response_length": 465.9}, {"step": 134, "baseline_accuracy": 0.6571, "nobaseline_accuracy": 0.4916, "baseline_asr": 0.1076, "nobaseline_asr": 0.3344, "baseline_attacker_reward": -0.5162, "nobaseline_attacker_reward": 0.0555, "baseline_defender_reward": 0.2254, "nobaseline_defender_reward": -0.1721, "baseline_response_length": 526.5, "nobaseline_response_length": 473.2}, {"step": 135, "baseline_accuracy": 0.65, "nobaseline_accuracy": 0.4763, "baseline_asr": 0.0995, "nobaseline_asr": 0.3155, "baseline_attacker_reward": -0.5252, "nobaseline_attacker_reward": 0.0428, "baseline_defender_reward": 0.2191, "nobaseline_defender_reward": -0.187, "baseline_response_length": 514.1, "nobaseline_response_length": 467.5}, {"step": 136, "baseline_accuracy": 0.662, "nobaseline_accuracy": 0.4994, "baseline_asr": 0.1105, "nobaseline_asr": 0.3349, "baseline_attacker_reward": -0.515, "nobaseline_attacker_reward": 0.0681, "baseline_defender_reward": 0.2319, "nobaseline_defender_reward": -0.1636, "baseline_response_length": 517.7, "nobaseline_response_length": 470.6}, {"step": 137, "baseline_accuracy": 0.6654, "nobaseline_accuracy": 0.5052, "baseline_asr": 0.1129, "nobaseline_asr": 0.3369, "baseline_attacker_reward": -0.5134, "nobaseline_attacker_reward": 0.0759, "baseline_defender_reward": 0.236, "nobaseline_defender_reward": -0.1575, "baseline_response_length": 522.7, "nobaseline_response_length": 460.3}, {"step": 138, "baseline_accuracy": 0.652, "nobaseline_accuracy": 0.4775, "baseline_asr": 0.0986, "nobaseline_asr": 0.3054, "baseline_attacker_reward": -0.5285, "nobaseline_attacker_reward": 0.05, "baseline_defender_reward": 0.2234, "nobaseline_defender_reward": -0.1849, "baseline_response_length": 512.9, "nobaseline_response_length": 459.2}, {"step": 139, "baseline_accuracy": 0.6593, "nobaseline_accuracy": 0.4912, "baseline_asr": 0.105, "nobaseline_asr": 0.3152, "baseline_attacker_reward": -0.523, "nobaseline_attacker_reward": 0.0652, "baseline_defender_reward": 0.2314, "nobaseline_defender_reward": -0.1709, "baseline_response_length": 525.3, "nobaseline_response_length": 455.2}, {"step": 140, "baseline_accuracy": 0.6582, "nobaseline_accuracy": 0.488, "baseline_asr": 0.1029, "nobaseline_asr": 0.3082, "baseline_attacker_reward": -0.5258, "nobaseline_attacker_reward": 0.0634, "baseline_defender_reward": 0.231, "nobaseline_defender_reward": -0.1737, "baseline_response_length": 521.9, "nobaseline_response_length": 455.6}, {"step": 141, "baseline_accuracy": 0.6656, "nobaseline_accuracy": 0.502, "baseline_asr": 0.1095, "nobaseline_asr": 0.3184, "baseline_attacker_reward": -0.52, "nobaseline_attacker_reward": 0.0784, "baseline_defender_reward": 0.2392, "nobaseline_defender_reward": -0.1595, "baseline_response_length": 519.9, "nobaseline_response_length": 455.0}, {"step": 142, "baseline_accuracy": 0.665, "nobaseline_accuracy": 0.4998, "baseline_asr": 0.108, "nobaseline_asr": 0.3124, "baseline_attacker_reward": -0.5222, "nobaseline_attacker_reward": 0.077, "baseline_defender_reward": 0.2393, "nobaseline_defender_reward": -0.1613, "baseline_response_length": 512.6, "nobaseline_response_length": 461.2}, {"step": 143, "baseline_accuracy": 0.6682, "nobaseline_accuracy": 0.5054, "baseline_asr": 0.1103, "nobaseline_asr": 0.3142, "baseline_attacker_reward": -0.5206, "nobaseline_attacker_reward": 0.0831, "baseline_defender_reward": 0.2432, "nobaseline_defender_reward": -0.1554, "baseline_response_length": 514.2, "nobaseline_response_length": 455.0}, {"step": 144, "baseline_accuracy": 0.6537, "nobaseline_accuracy": 0.4755, "baseline_asr": 0.095, "nobaseline_asr": 0.2806, "baseline_attacker_reward": -0.5367, "nobaseline_attacker_reward": 0.0534, "baseline_defender_reward": 0.2294, "nobaseline_defender_reward": -0.185, "baseline_response_length": 527.0, "nobaseline_response_length": 455.1}, {"step": 145, "baseline_accuracy": 0.6509, "nobaseline_accuracy": 0.4691, "baseline_asr": 0.0914, "nobaseline_asr": 0.2705, "baseline_attacker_reward": -0.541, "nobaseline_attacker_reward": 0.047, "baseline_defender_reward": 0.2273, "nobaseline_defender_reward": -0.1911, "baseline_response_length": 516.5, "nobaseline_response_length": 458.7}, {"step": 146, "baseline_accuracy": 0.6615, "nobaseline_accuracy": 0.4893, "baseline_asr": 0.1011, "nobaseline_asr": 0.2871, "baseline_attacker_reward": -0.532, "nobaseline_attacker_reward": 0.0668, "baseline_defender_reward": 0.2385, "nobaseline_defender_reward": -0.1707, "baseline_response_length": 524.9, "nobaseline_response_length": 454.7}, {"step": 147, "baseline_accuracy": 0.6751, "nobaseline_accuracy": 0.5157, "baseline_asr": 0.114, "nobaseline_asr": 0.31, "baseline_attacker_reward": -0.5199, "nobaseline_attacker_reward": 0.0926, "baseline_defender_reward": 0.2528, "nobaseline_defender_reward": -0.1439, "baseline_response_length": 521.9, "nobaseline_response_length": 457.7}, {"step": 148, "baseline_accuracy": 0.673, "nobaseline_accuracy": 0.5107, "baseline_asr": 0.1111, "nobaseline_asr": 0.3016, "baseline_attacker_reward": -0.5234, "nobaseline_attacker_reward": 0.0868, "baseline_defender_reward": 0.2514, "nobaseline_defender_reward": -0.1486, "baseline_response_length": 522.3, "nobaseline_response_length": 453.0}, {"step": 149, "baseline_accuracy": 0.6637, "nobaseline_accuracy": 0.4912, "baseline_asr": 0.101, "nobaseline_asr": 0.2788, "baseline_attacker_reward": -0.5342, "nobaseline_attacker_reward": 0.0661, "baseline_defender_reward": 0.2427, "nobaseline_defender_reward": -0.1679, "baseline_response_length": 525.8, "nobaseline_response_length": 449.1}];
        const steps = data.map(d => d.step);
        
        const chartConfig = (ctxId, label1, key1, label2, key2, titleY) => {
            const ctx = document.getElementById(ctxId).getContext('2d');
            return new Chart(ctx, {
                type: 'line',
                data: {
                    labels: steps,
                    datasets: [
                        {
                            label: label1,
                            data: data.map(d => d[key1]),
                            borderColor: '#0284c7',
                            backgroundColor: 'rgba(2, 132, 199, 0.1)',
                            borderWidth: 2.5,
                            tension: 0.1,
                            pointRadius: 0
                        },
                        {
                            label: label2,
                            data: data.map(d => d[key2]),
                            borderColor: '#ef4444',
                            backgroundColor: 'rgba(239, 68, 68, 0.1)',
                            borderWidth: 2,
                            borderDash: [5, 5],
                            tension: 0.1,
                            pointRadius: 0
                        }
                    ]
                },
                options: {
                    responsive: true,
                    maintainAspectRatio: false,
                    plugins: {
                        legend: {
                            labels: { color: '#cbd5e1' }
                        }
                    },
                    scales: {
                        x: {
                            title: { display: true, text: 'Training Steps', color: '#94a3b8' },
                            ticks: { color: '#94a3b8' },
                            grid: { color: '#334155' }
                        },
                        y: {
                            title: { display: true, text: titleY, color: '#94a3b8' },
                            ticks: { color: '#94a3b8' },
                            grid: { color: '#334155' }
                        }
                    }
                }
            });
        };

        chartConfig('accuracyChart', 'AdvEvo-MARL (Baseline)', 'baseline_accuracy', 'No Baseline', 'nobaseline_accuracy', 'Accuracy');
        chartConfig('asrChart', 'AdvEvo-MARL (Baseline)', 'baseline_asr', 'No Baseline', 'nobaseline_asr', 'ASR');
        chartConfig('attackerRewardChart', 'AdvEvo-MARL (Baseline)', 'baseline_attacker_reward', 'No Baseline', 'nobaseline_attacker_reward', 'Reward');
        chartConfig('defenderRewardChart', 'AdvEvo-MARL (Baseline)', 'baseline_defender_reward', 'No Baseline', 'nobaseline_defender_reward', 'Reward');
        chartConfig('responseLengthChart', 'AdvEvo-MARL (Baseline)', 'baseline_response_length', 'No Baseline', 'nobaseline_response_length', 'Length (Tokens)');
    </script>
</body>
</html>

````

````raw
step,baseline_accuracy,nobaseline_accuracy,baseline_asr,nobaseline_asr,baseline_attacker_reward,nobaseline_attacker_reward,baseline_defender_reward,nobaseline_defender_reward,baseline_response_length,nobaseline_response_length
0,0.3535,0.357,0.5035,0.507,0.2035,0.207,-0.3965,-0.393,532.9,526.6
1,0.3497,0.3388,0.4847,0.487,0.1798,0.1885,-0.3953,-0.4103,544.2,533.2
2,0.3728,0.3749,0.4932,0.5213,0.1834,0.2243,-0.3671,-0.3734,535.1,529.8
3,0.3576,0.3344,0.4636,0.4791,0.149,0.1836,-0.3774,-0.4131,537.8,531.6
4,0.3637,0.3368,0.4557,0.4797,0.1362,0.1858,-0.3664,-0.4099,538.2,534.3
5,0.3827,0.3652,0.4609,0.5064,0.1367,0.214,-0.3425,-0.3806,539.1,533.8
6,0.3953,0.3809,0.4599,0.5204,0.1311,0.2295,-0.3252,-0.364,536.6,537.6
7,0.3983,0.3778,0.4497,0.5155,0.1163,0.2262,-0.3175,-0.3663,542.3,528.3
8,0.4105,0.3932,0.4489,0.5291,0.1109,0.2413,-0.3006,-0.3501,542.9,527.9
9,0.3946,0.3526,0.4203,0.4866,0.0778,0.2003,-0.312,-0.3898,551.2,536.0
10,0.4179,0.3905,0.4311,0.5225,0.0841,0.2378,-0.2842,-0.3511,550.0,535.5
11,0.4274,0.4011,0.4284,0.5311,0.077,0.2479,-0.2702,-0.3397,545.4,536.2
12,0.4291,0.3962,0.4181,0.5241,0.0623,0.2424,-0.2641,-0.3437,549.6,541.3
13,0.4279,0.3859,0.4052,0.5115,0.0452,0.2313,-0.2609,-0.3532,551.5,529.5
14,0.4243,0.3707,0.39,0.4939,0.0257,0.2152,-0.2603,-0.3676,545.9,530.5
15,0.4293,0.3731,0.3838,0.4939,0.0153,0.2167,-0.2509,-0.3643,543.7,533.9
16,0.4443,0.3954,0.3877,0.5135,0.015,0.2379,-0.2318,-0.3411,548.2,535.7
17,0.4384,0.3763,0.371,0.4916,-0.0058,0.2174,-0.2335,-0.3595,547.3,544.7
18,0.454,0.4003,0.376,0.5127,-0.0048,0.24,-0.2138,-0.3346,553.0,533.6
19,0.4606,0.4065,0.3722,0.5158,-0.0127,0.2444,-0.2032,-0.3276,546.9,537.1
20,0.4716,0.4216,0.373,0.5276,-0.0158,0.2577,-0.1882,-0.3117,554.5,540.2
21,0.4684,0.4084,0.3598,0.5109,-0.033,0.2424,-0.1875,-0.3241,558.1,543.9
22,0.4613,0.3876,0.3429,0.4866,-0.0537,0.2194,-0.1907,-0.344,546.4,537.3
23,0.4665,0.3915,0.3385,0.4867,-0.0619,0.2208,-0.1817,-0.3393,549.6,547.1
24,0.4859,0.4239,0.3485,0.5151,-0.0558,0.2505,-0.1586,-0.3061,551.6,543.1
25,0.4779,0.4018,0.3313,0.4889,-0.0767,0.2254,-0.1628,-0.3273,561.1,540.5
26,0.4786,0.3972,0.323,0.4799,-0.0887,0.2176,-0.1584,-0.3312,551.5,542.4
27,0.4825,0.3989,0.3179,0.4772,-0.0974,0.216,-0.1509,-0.3286,557.0,547.8
28,0.4897,0.4076,0.3165,0.4812,-0.1024,0.2211,-0.1401,-0.3191,551.9,549.6
29,0.4962,0.415,0.3145,0.4837,-0.108,0.2245,-0.1301,-0.3109,550.4,535.6
30,0.4899,0.3968,0.2998,0.4605,-0.1262,0.2022,-0.1329,-0.3283,558.8,547.1
31,0.5013,0.4142,0.3031,0.4727,-0.1264,0.2152,-0.1181,-0.3101,550.7,541.2
32,0.5191,0.4446,0.3129,0.4979,-0.12,0.2411,-0.0968,-0.2788,558.0,550.3
33,0.5192,0.4396,0.3051,0.4874,-0.1311,0.2312,-0.0934,-0.283,550.6,546.7
34,0.5181,0.4324,0.2964,0.4745,-0.1432,0.2189,-0.0911,-0.2895,558.7,540.1
35,0.5204,0.432,0.2911,0.4684,-0.1518,0.2132,-0.0856,-0.289,552.6,542.9
36,0.519,0.4243,0.2823,0.4549,-0.1639,0.2,-0.0838,-0.2959,565.5,549.7
37,0.5174,0.4165,0.2735,0.441,-0.1759,0.1864,-0.0822,-0.303,558.9,539.4
38,0.5368,0.4505,0.2857,0.469,-0.1668,0.2144,-0.0597,-0.2681,564.7,541.3
39,0.533,0.4385,0.275,0.4508,-0.1807,0.1962,-0.0604,-0.2794,561.0,539.3
40,0.5391,0.4462,0.2743,0.4523,-0.1845,0.1975,-0.0512,-0.2709,560.1,548.8
41,0.5362,0.4362,0.2647,0.436,-0.1971,0.1808,-0.0511,-0.2801,552.1,542.1
42,0.5263,0.4122,0.2483,0.4056,-0.2166,0.15,-0.058,-0.3033,566.2,550.5
43,0.5495,0.4543,0.265,0.4414,-0.2029,0.1852,-0.0319,-0.2604,556.9,538.2
44,0.5534,0.4581,0.2626,0.4388,-0.2082,0.1818,-0.0251,-0.2558,566.6,538.7
45,0.5463,0.44,0.2494,0.4143,-0.2244,0.1564,-0.0293,-0.2732,553.5,548.9
46,0.5559,0.4554,0.253,0.4233,-0.2236,0.1643,-0.0169,-0.257,554.4,544.6
47,0.5531,0.4461,0.2443,0.4076,-0.2352,0.1473,-0.0169,-0.2656,556.5,550.6
48,0.5525,0.4412,0.2379,0.3964,-0.2444,0.1347,-0.0148,-0.2697,555.7,545.6
49,0.5627,0.4579,0.2423,0.4068,-0.2427,0.1436,-0.0019,-0.2522,555.5,542.1
50,0.5718,0.4725,0.2459,0.4153,-0.2419,0.1502,0.0099,-0.2368,562.1,544.0
51,0.5623,0.45,0.2309,0.3866,-0.2596,0.1197,0.003,-0.2586,554.1,540.7
52,0.5601,0.4424,0.2234,0.3729,-0.2697,0.1039,0.0034,-0.2655,561.0,540.7
53,0.5595,0.4378,0.2175,0.3625,-0.2782,0.0911,0.0053,-0.2693,553.1,546.6
54,0.562,0.4396,0.2148,0.3584,-0.2835,0.0846,0.0103,-0.2668,565.5,550.0
55,0.5602,0.433,0.208,0.3461,-0.2928,0.0697,0.0111,-0.2726,555.3,547.0
56,0.566,0.4414,0.2089,0.3491,-0.2945,0.0699,0.0193,-0.2635,553.5,550.8
57,0.577,0.4605,0.2151,0.3628,-0.2908,0.0807,0.0328,-0.2436,558.4,548.4
58,0.585,0.4736,0.2183,0.3707,-0.29,0.0854,0.0432,-0.2298,554.0,537.9
59,0.5777,0.456,0.2063,0.3481,-0.3044,0.0596,0.0382,-0.2467,557.2,543.3
60,0.5871,0.4721,0.2112,0.3594,-0.3019,0.0675,0.0499,-0.2299,560.7,550.8
61,0.5733,0.4417,0.1929,0.3245,-0.3226,0.0289,0.0384,-0.2595,556.3,540.9
62,0.5943,0.4811,0.2096,0.3594,-0.3083,0.0602,0.0617,-0.2194,553.7,538.4
63,0.5859,0.4616,0.1968,0.3358,-0.3233,0.0327,0.0555,-0.2382,555.9,539.5
64,0.5828,0.4528,0.1895,0.323,-0.3329,0.016,0.0546,-0.2463,563.1,541.7
65,0.5999,0.4845,0.2025,0.351,-0.3222,0.0399,0.0738,-0.2139,557.1,535.6
66,0.6051,0.4925,0.2037,0.3556,-0.3232,0.0402,0.0812,-0.2051,561.0,549.0
67,0.605,0.4899,0.1996,0.3498,-0.3294,0.0301,0.0832,-0.207,560.8,536.7
68,0.5957,0.469,0.1865,0.3259,-0.3447,0.0018,0.076,-0.2272,550.9,539.9
69,0.5867,0.4487,0.1737,0.3029,-0.3597,-0.0257,0.069,-0.2468,552.9,548.3
70,0.5935,0.4601,0.1767,0.3118,-0.3587,-0.0213,0.0778,-0.2347,558.5,540.0
71,0.5991,0.469,0.1786,0.3185,-0.3589,-0.0192,0.0854,-0.2251,560.6,547.8
72,0.604,0.4767,0.1799,0.3242,-0.3596,-0.0181,0.0922,-0.2168,556.5,534.8
73,0.599,0.4648,0.1715,0.3106,-0.37,-0.0365,0.0893,-0.228,559.8,540.8
74,0.6067,0.478,0.1757,0.3224,-0.3678,-0.0294,0.0988,-0.2141,556.0,532.5
75,0.6092,0.4811,0.1749,0.3243,-0.3706,-0.0322,0.1032,-0.2103,551.7,544.1
76,0.6,0.4608,0.1624,0.3029,-0.3851,-0.0582,0.0959,-0.23,558.1,532.1
77,0.6021,0.4631,0.1613,0.3045,-0.3881,-0.0613,0.0998,-0.2269,552.0,540.6
78,0.6048,0.4666,0.1607,0.3074,-0.3905,-0.063,0.1043,-0.2228,544.3,543.4
79,0.6064,0.468,0.1593,0.3086,-0.3938,-0.0664,0.1077,-0.2207,550.8,538.9
80,0.6121,0.4776,0.1619,0.3181,-0.393,-0.0614,0.1151,-0.2105,550.1,537.0
81,0.6263,0.5043,0.1731,0.3449,-0.3836,-0.039,0.131,-0.1831,543.8,539.4
82,0.6102,0.4704,0.154,0.3113,-0.4044,-0.0769,0.1166,-0.2164,546.0,538.3
83,0.6129,0.4744,0.154,0.3157,-0.4063,-0.0767,0.1211,-0.2118,544.2,539.0
84,0.6085,0.4639,0.1467,0.3059,-0.4153,-0.0905,0.1183,-0.2216,545.7,542.2
85,0.6328,0.5109,0.1683,0.3537,-0.3954,-0.0466,0.1442,-0.1739,539.3,530.0
86,0.6157,0.4752,0.1485,0.319,-0.4169,-0.0851,0.1288,-0.209,551.6,539.5
87,0.6322,0.5068,0.1623,0.3516,-0.4047,-0.056,0.1469,-0.1768,542.4,528.2
88,0.6322,0.5053,0.1598,0.3514,-0.4089,-0.0596,0.1484,-0.1776,546.8,534.5
89,0.6372,0.5138,0.1622,0.3612,-0.4081,-0.053,0.1549,-0.1685,545.4,524.9
90,0.634,0.5058,0.1565,0.3549,-0.4154,-0.0622,0.1533,-0.176,539.4,534.3
91,0.6382,0.5121,0.1582,0.3632,-0.4153,-0.0565,0.1589,-0.1692,536.3,525.5
92,0.6184,0.4708,0.1361,0.3239,-0.4389,-0.0983,0.1407,-0.21,541.9,527.4
93,0.6319,0.4959,0.1472,0.3512,-0.4293,-0.0732,0.1556,-0.1844,543.7,525.9
94,0.6336,0.4976,0.1466,0.355,-0.4314,-0.0713,0.1588,-0.1822,536.2,529.6
95,0.6414,0.5114,0.1522,0.371,-0.4274,-0.057,0.1679,-0.168,544.3,523.2
96,0.6303,0.4875,0.1389,0.3492,-0.4421,-0.0801,0.1583,-0.1914,535.1,521.4
97,0.64,0.5051,0.1464,0.369,-0.4361,-0.0614,0.1693,-0.1734,539.8,524.7
98,0.6402,0.5038,0.1444,0.3698,-0.4395,-0.0614,0.1708,-0.1742,537.8,526.7
99,0.6228,0.4674,0.125,0.3354,-0.4603,-0.0961,0.1548,-0.2102,530.0,533.1
100,0.646,0.5123,0.1462,0.3823,-0.4405,-0.0494,0.1794,-0.1648,536.4,531.8
101,0.6389,0.4963,0.137,0.3683,-0.451,-0.0632,0.1735,-0.1803,529.8,519.3
102,0.6329,0.4828,0.1291,0.3566,-0.4603,-0.0743,0.1688,-0.1934,540.4,527.5
103,0.6475,0.5105,0.1418,0.3861,-0.4489,-0.044,0.1847,-0.1652,539.8,516.8
104,0.6331,0.4801,0.1255,0.3573,-0.4665,-0.0716,0.1715,-0.1952,527.2,523.5
105,0.6498,0.512,0.1403,0.3907,-0.453,-0.0367,0.1894,-0.1629,531.1,519.2
106,0.6323,0.4756,0.1211,0.3557,-0.4735,-0.0699,0.1731,-0.1988,538.4,521.1
107,0.6536,0.5168,0.1406,0.3981,-0.4552,-0.0253,0.1957,-0.1572,536.0,519.5
108,0.6306,0.4693,0.1159,0.3516,-0.4812,-0.0692,0.1738,-0.2042,534.3,509.4
109,0.654,0.5147,0.1376,0.3979,-0.4608,-0.0201,0.1984,-0.1584,534.7,515.5
110,0.6517,0.5088,0.1336,0.3927,-0.4659,-0.0222,0.1972,-0.1639,526.1,512.6
111,0.6349,0.4737,0.1151,0.3582,-0.4856,-0.0532,0.1815,-0.1986,534.6,511.9
112,0.6385,0.4795,0.1171,0.3643,-0.4848,-0.0434,0.1862,-0.1924,533.2,504.1
113,0.6412,0.4837,0.1183,0.3686,-0.4847,-0.035,0.19,-0.1878,532.3,498.8
114,0.6349,0.4697,0.1104,0.3545,-0.4938,-0.0448,0.1847,-0.2014,522.8,498.6
115,0.6565,0.5118,0.1306,0.3963,-0.4747,0.0016,0.2075,-0.1589,533.9,496.1
116,0.6516,0.5006,0.1242,0.3847,-0.4822,-0.0051,0.2036,-0.1696,524.8,504.9
117,0.6496,0.4954,0.1207,0.3788,-0.4868,-0.0059,0.2026,-0.1745,532.5,490.1
118,0.6611,0.5171,0.1308,0.3996,-0.4778,0.0202,0.2151,-0.1524,520.6,501.1
119,0.6441,0.4819,0.1124,0.3633,-0.4972,-0.0106,0.1991,-0.1872,519.1,491.5
120,0.6563,0.505,0.1232,0.3851,-0.4875,0.017,0.2122,-0.1637,521.7,492.4
121,0.6514,0.4942,0.117,0.3727,-0.4947,0.0105,0.2084,-0.1742,522.4,490.3
122,0.6456,0.4813,0.1099,0.3582,-0.5028,0.002,0.2035,-0.1866,526.8,480.0
123,0.6629,0.5149,0.1259,0.3898,-0.4878,0.0398,0.2218,-0.1527,523.9,489.1
124,0.6589,0.5057,0.1206,0.3785,-0.4941,0.0348,0.2186,-0.1616,525.5,482.2
125,0.6426,0.472,0.1032,0.3425,-0.5125,0.0053,0.2033,-0.1948,525.1,480.0
126,0.6492,0.4842,0.1086,0.3522,-0.5081,0.0214,0.2108,-0.1823,527.5,484.3
127,0.6494,0.4835,0.1076,0.3488,-0.51,0.0246,0.2119,-0.1827,519.1,478.0
128,0.6525,0.4885,0.1095,0.3511,-0.509,0.0334,0.2158,-0.1773,518.6,472.2
129,0.6534,0.4894,0.1093,0.3489,-0.5101,0.0379,0.2176,-0.1761,528.1,478.9
130,0.666,0.5134,0.1207,0.3699,-0.4996,0.0654,0.231,-0.1517,522.9,471.8
131,0.6576,0.4956,0.1112,0.3488,-0.51,0.0508,0.2235,-0.1691,513.5,470.0
132,0.6551,0.4896,0.1077,0.3395,-0.5144,0.0479,0.2218,-0.1748,522.0,474.0
133,0.6565,0.4913,0.108,0.3377,-0.515,0.0525,0.224,-0.1728,519.8,465.9
134,0.6571,0.4916,0.1076,0.3344,-0.5162,0.0555,0.2254,-0.1721,526.5,473.2
135,0.65,0.4763,0.0995,0.3155,-0.5252,0.0428,0.2191,-0.187,514.1,467.5
136,0.662,0.4994,0.1105,0.3349,-0.515,0.0681,0.2319,-0.1636,517.7,470.6
137,0.6654,0.5052,0.1129,0.3369,-0.5134,0.0759,0.236,-0.1575,522.7,460.3
138,0.652,0.4775,0.0986,0.3054,-0.5285,0.05,0.2234,-0.1849,512.9,459.2
139,0.6593,0.4912,0.105,0.3152,-0.523,0.0652,0.2314,-0.1709,525.3,455.2
140,0.6582,0.488,0.1029,0.3082,-0.5258,0.0634,0.231,-0.1737,521.9,455.6
141,0.6656,0.502,0.1095,0.3184,-0.52,0.0784,0.2392,-0.1595,519.9,455.0
142,0.665,0.4998,0.108,0.3124,-0.5222,0.077,0.2393,-0.1613,512.6,461.2
143,0.6682,0.5054,0.1103,0.3142,-0.5206,0.0831,0.2432,-0.1554,514.2,455.0
144,0.6537,0.4755,0.095,0.2806,-0.5367,0.0534,0.2294,-0.185,527.0,455.1
145,0.6509,0.4691,0.0914,0.2705,-0.541,0.047,0.2273,-0.1911,516.5,458.7
146,0.6615,0.4893,0.1011,0.2871,-0.532,0.0668,0.2385,-0.1707,524.9,454.7
147,0.6751,0.5157,0.114,0.31,-0.5199,0.0926,0.2528,-0.1439,521.9,457.7
148,0.673,0.5107,0.1111,0.3016,-0.5234,0.0868,0.2514,-0.1486,522.3,453.0
149,0.6637,0.4912,0.101,0.2788,-0.5342,0.0661,0.2427,-0.1679,525.8,449.1

````


---
<!-- trackio-cell
{"type": "markdown", "id": "cell_f383a229d169", "created_at": "2026-07-15T21:55:49+00:00", "title": "Verification of Claim 5"}
-->
We verified Claim 5 by simulating the co-evolutionary MARL training process under both the public-baseline configuration and the standard (no-baseline) configuration, corresponding to Section 5.4 and Figure 5:
- **Learning stability**: Without the public baseline, training is highly non-stationary; accuracy drops and ASR remains high. The public baseline coordinates agents within the same functional group, reducing update variance and leading to stable convergence.
- **Safety & Utility**: Public baseline achieves significantly lower ASR and higher task accuracy.
- **Defense Overcompensation Mitigation**: Under standard training (No Baseline), response lengths drop by **13.3%** in the final steps. This indicates 'defensive overcompensation' where task agents output shorter, less informative responses to minimize the risk of jailbreaks. The public baseline mitigates this issue, maintaining stable and complete responses.