Geolocation Inference Privacy Protection on DoxBench (test)
55.3Top-1 Protection Rate (Region)ReasonBreak
Evaluation results
| Method | Links | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| ReasonBreakTarget Model=QwenVL Max, epsilon=16/2552025.12 | 55.3 | 55.8 | 39.5 | 40 | 30.5 | 30.8 | 44.4 | 42.9 | |
| ReasonBreakTarget Model=QwenVL 2.5 72B, epsilon=16/2552025.12 | 46.3 | 49.2 | 40 | 33.3 | 38.3 | 38.2 | 46 | 35 | |
| ReasonBreakTarget Model=QVQ Max, epsilon=16/2552025.12 | 46.2 | 46.7 | 28.6 | 25 | 27 | 40.9 | 33.5 | 34.2 | |
| AnyAttackTarget Model=QVQ Max, epsilon=16/2552025.12 | 42.9 | 41.9 | 26.2 | 15.4 | 32 | 30.4 | 29 | 23.8 | |
| AnyAttackTarget Model=QwenVL 2.5 72B, epsilon=16/2552025.12 | 41.2 | 32.5 | 17.9 | 21.4 | 29.6 | 30.4 | 29 | 26.1 | |
| AnyAttackTarget Model=QwenVL Max, epsilon=16/2552025.12 | 38 | 38.3 | 26.7 | 33.3 | 28.6 | 30.4 | 26.7 | 27.3 | |
| M-AttackTarget Model=QwenVL Max, epsilon=16/2552025.12 | 34 | 35 | 31.1 | 40 | 25.1 | 28.1 | 26.7 | 22.7 | |
| M-AttackTarget Model=QwenVL 2.5 72B, epsilon=16/2552025.12 | 32.7 | 26.7 | 17.9 | 14.3 | 23.2 | 22.7 | 34.8 | 26.1 | |
| M-AttackTarget Model=QVQ Max, epsilon=16/2552025.12 | 30.1 | 29 | 23.8 | 23.1 | 17.5 | 17 | 26.1 | 14.3 | |
| ReasonBreakTarget Model=GPT-o3, epsilon=16/2552025.12 | 11.5 | 13.7 | 31.7 | 25.9 | 42.6 | 44.6 | 46.2 | 32.4 | |
| ReasonBreakTarget Model=InternVL 3.0 72B, epsilon=16/2552025.12 | 10.8 | 0 | 33.3 | 58.3 | 12 | 7.6 | 31 | 33.3 | |
| AnyAttackTarget Model=GPT-o3, epsilon=16/2552025.12 | 10.7 | 12.9 | 25.6 | 18.5 | 11.5 | 16.2 | 21.2 | 18.9 | |
| ReasonBreakTarget Model=GPT-5, epsilon=16/2552025.12 | 8 | 9.8 | 32.9 | 29 | 10 | 12.4 | 35.6 | 19.5 | |
| M-AttackTarget Model=GPT-o3, epsilon=16/2552025.12 | 7.6 | 10.8 | 15.9 | 14.8 | 9.6 | 10.9 | 18.3 | 24.3 | |
| ReasonBreakTarget Model=Gemini 2.5 Pro, epsilon=16/2552025.12 | 6.9 | 10.6 | 30.8 | 23.3 | 5.6 | 12.1 | 36.2 | 33.3 | |
| AnyAttackTarget Model=GPT-5, epsilon=16/2552025.12 | 6.5 | 9.8 | 20 | 29 | 5.5 | 9.8 | 23.7 | 12.2 | |
| M-AttackTarget Model=InternVL 3.0 72B, epsilon=16/2552025.12 | 5.2 | 0 | 3.4 | 0 | 2.6 | 3.8 | 0 | 11.1 | |
| AnyAttackTarget Model=InternVL 3.0 72B, epsilon=16/2552025.12 | 4.9 | 0 | 3.4 | 0 | 4.5 | 2.8 | 0 | 22.2 | |
| M-AttackTarget Model=Gemini 2.5 Pro, epsilon=16/2552025.12 | 4.8 | 9.9 | 20.6 | 0 | 4 | 8.1 | 20.5 | 2.2 | |
| M-AttackTarget Model=GPT-5, epsilon=16/2552025.12 | 4.6 | 8.9 | 17.6 | 22.6 | 5 | 5 | 15.3 | 14.6 | |
| AnyAttackTarget Model=Gemini 2.5 Pro, epsilon=16/2552025.12 | 3.2 | 8.9 | 15.9 | 0 | 4.2 | 6 | 19.7 | 15.6 |