Defense against Visual Prompt Injection Attack on VMA Attacks
0Manipulation ScoreDIFFPURE
Evaluation results
| Method | Links | ||||||
|---|---|---|---|---|---|---|---|
| DIFFPUREModel=QWEN2-VL2026.05 | 0 | 0 | 0 | 0 | 0 | 0 | |
| Gradient-guided Token MaskingModel=QWEN2-VL2026.05 | 0 | 0 | 0 | 0 | 0 | 0 | |
| DIFFPUREModel=PHI-3-VISION2026.05 | 0 | 0 | 0 | 0 | 0 | 0 | |
| Gradient-guided Token MaskingModel=PHI-3-VISION2026.05 | 0 | 0 | 0 | 6.36 | 1.82 | 1.64 | |
| DIFFPUREModel=LLAVA-V1.52026.05 | 0 | 0 | 0 | 0 | 0 | 0 | |
| Gradient-guided Token MaskingModel=LLAVA-V1.52026.05 | 0.91 | 0 | 0 | 3.64 | 1.82 | 1.27 | |
| ECSOModel=QWEN2-VL2026.05 | 92.73 | 90 | 4.55 | 88.18 | 64.55 | 68 | |
| ECSOModel=LLAVA-V1.52026.05 | 96.36 | 14.55 | 21.82 | 65.45 | 85.45 | 56.73 | |
| ECSOModel=PHI-3-VISION2026.05 | 97.27 | 10.91 | 98.18 | 94.55 | 80.91 | 76.36 | |
| W/O DEFENSEModel=QWEN2-VL2026.05 | 98.18 | 98.18 | 78.18 | 97.27 | 80.91 | 90.54 | |
| W/O DEFENSEModel=PHI-3-VISION2026.05 | 99.09 | 100 | 98.18 | 99.09 | 99.09 | 99.09 | |
| W/O DEFENSEModel=LLAVA-V1.52026.05 | 100 | 100 | 98.18 | 100 | 100 | 99.64 |