Attack Success Rate Evaluation on 40 diverse smartphone tasks Persuade subcategory
100Target ASRHG-IDA*
Evaluation results
| Method | Links | ||
|---|---|---|---|
| HG-IDA*Target Model=Gemini-2.0-pro2025.10 | 100 | 93.3 | |
| HG-IDA*Target Model=GPT-4o2025.10 | 80 | 73.3 | |
| HG-IDA*Target Model=Deepseek-VL22025.10 | 80 | 20 | |
| DATarget Model=Gemini-2.0-pro2025.10 | 66.7 | 33.3 | |
| PrefixTarget Model=Gemini-2.0-pro2025.10 | 53.3 | 33.3 | |
| GCGTarget Model=Gemini-2.0-pro2025.10 | 40 | 13.3 | |
| HG-IDA*Target Model=LLaVA-OneVision2025.10 | 40 | 33.3 | |
| DATarget Model=LLaVA-OneVision2025.10 | 20 | 20 | |
| DATarget Model=Deepseek-VL22025.10 | 6.7 | 6.7 | |
| DATarget Model=GPT-4o2025.10 | 0 | 0 | |
| PrefixTarget Model=GPT-4o2025.10 | 0 | 0 | |
| GCGTarget Model=GPT-4o2025.10 | 0 | 0 | |
| PrefixTarget Model=Deepseek-VL22025.10 | 0 | 0 | |
| GCGTarget Model=Deepseek-VL22025.10 | 0 | 0 | |
| PrefixTarget Model=LLaVA-OneVision2025.10 | 0 | 0 | |
| GCGTarget Model=LLaVA-OneVision2025.10 | 0 | 0 |