Attack Success Rate (ASR) Evaluation on OSWorld (885-sample split)
98.08Eligible RateUT-opt.
Evaluation results
| Method | Links | ||||||
|---|---|---|---|---|---|---|---|
| UT-opt.Victim=Claude-Sonnet-4.6, pass@k=32026.04 | 98.08 | 7.03 | 11.98 | 17.51 | 20.28 | 22.24 | |
| Rand. Inject.Victim=Claude-Sonnet-4.6, pass@k=32026.04 | 97.97 | 1.27 | 2.08 | 2.19 | 2.65 | 3.23 | |
| GO-opt.Victim=Claude-Sonnet-4.6, pass@k=32026.04 | 97.97 | 7.84 | 13.15 | 16.84 | 19.26 | 21.91 | |
| Rand. Inject.Victim=Qwen3-VL-32B-Instruct, pass@k=32026.04 | 97.29 | 1.97 | 2.9 | 4.18 | 5.11 | 5.46 | |
| GO-opt.Victim=Qwen3-VL-32B-Instruct, pass@k=32026.04 | 96.84 | 9.1 | 16.1 | 19.6 | 22.64 | 25.09 | |
| UT-opt.Victim=Qwen3-VL-32B-Instruct, pass@k=32026.04 | 96.72 | 9.11 | 15.07 | 19.63 | 22.9 | 25.47 | |
| UT-opt.Victim=Qwen3-VL-8B-Instruct, pass@k=32026.04 | 96.61 | 13.33 | 20.35 | 26.08 | 29.12 | 31.7 | |
| GO-opt.Victim=Qwen3-VL-8B-Instruct, pass@k=32026.04 | 96.61 | 11.7 | 20.7 | 25.38 | 29.82 | 32.87 | |
| Rand. Inject.Victim=Qwen3-VL-8B-Instruct, pass@k=32026.04 | 96.5 | 2.34 | 3.98 | 6.21 | 7.14 | 8.43 | |
| GO-opt.Victim=Qwen3-VL-4B-Instruct, pass@k=32026.04 | 95.14 | 13.3 | 19.95 | 26.13 | 29.45 | 31.59 | |
| UT-opt.Victim=Qwen3-VL-4B-Instruct, pass@k=32026.04 | 94.92 | 13.21 | 20.24 | 25.6 | 28.57 | 31.19 | |
| Rand. Inject.Victim=Qwen3-VL-4B-Instruct, pass@k=32026.04 | 94.58 | 2.87 | 4.54 | 6.09 | 7.05 | 8.12 | |
| Rand. Inject.Victim=Qwen3-VL-2B-Instruct, pass@k=32026.04 | 90.4 | 5.12 | 8.25 | 10.5 | 12 | 13.88 | |
| GO-opt.Victim=Qwen3-VL-2B-Instruct, pass@k=32026.04 | 90.4 | 14.5 | 25.75 | 30.63 | 34.88 | 38.25 | |
| UT-opt.Victim=Qwen3-VL-2B-Instruct, pass@k=32026.04 | 89.72 | 16.25 | 24.81 | 31.36 | 35.77 | 38.54 |