Image Retrieval on MS-COCO
100R@1HQA-VLAttack
Evaluation Results
| Method | Links | |||
|---|---|---|---|---|
| HQA-VLAttackSurrogate Model=CLIPViT, Victim Model=CLIPViT2026.04 | 100 | — | — | |
| HQA-VLAttackSurrogate Model=CLIPCNN, Victim Model=CLIPCNN2026.04 | 100 | — | — | |
| HQA-VLAttackSurrogate Model=ALBEF, Victim Model=ALBEF2026.04 | 99.97 | — | — | |
| HQA-VLAttackSurrogate Model=TCL, Victim Model=TCL2026.04 | 99.97 | — | — | |
| SGASurrogate Model=CLIPCNN, Victim Model=CLIPCNN2026.04 | 99.8 | — | — | |
| SGASurrogate Model=CLIPViT, Victim Model=CLIPViT2026.04 | 99.79 | — | — | |
| DRASurrogate Model=CLIPViT, Victim Model=CLIPViT2026.04 | 99.7 | — | — | |
| DRASurrogate Model=CLIPCNN, Victim Model=CLIPCNN2026.04 | 99.7 | — | — | |
| SGASurrogate Model=TCL, Victim Model=TCL2026.04 | 99.15 | — | — | |
| DRASurrogate Model=TCL, Victim Model=TCL2026.04 | 99.15 | — | — | |
| Co-AttackSurrogate Model=CLIPViT, Victim Model=CLIPViT2026.04 | 98.8 | — | — | |
| Co-AttackSurrogate Model=CLIPCNN, Victim Model=CLIPCNN2026.04 | 98.56 | — | — | |
| SGASurrogate Model=ALBEF, Victim Model=ALBEF2026.04 | 96.95 | — | — | |
| DRASurrogate Model=ALBEF, Victim Model=ALBEF2026.04 | 96.47 | — | — | |
| Sep-AttackSurrogate Model=CLIPCNN, Victim Model=CLIPCNN2026.04 | 92.49 | — | — | |
| Co-AttackSurrogate Model=TCL, Victim Model=TCL2026.04 | 91.39 | — | — | |
| Sep-AttackSurrogate Model=ALBEF, Victim Model=ALBEF2026.04 | 89.88 | — | — | |
| HQA-VLAttackSurrogate Model=CLIPViT, Victim Model=CLIPCNN2026.04 | 89.26 | — | — | |
| Co-AttackSurrogate Model=ALBEF, Victim Model=ALBEF2026.04 | 87.83 | — | — | |
| HQA-VLAttackSurrogate Model=ALBEF, Victim Model=TCL2026.04 | 87.81 | — | — | |
| HQA-VLAttackSurrogate Model=TCL, Victim Model=ALBEF2026.04 | 86.32 | — | — | |
| PGDSurrogate Model=ALBEF, Victim Model=ALBEF2026.04 | 86.3 | — | — | |
| HQA-VLAttackSurrogate Model=CLIPCNN, Victim Model=CLIPViT2026.04 | 84.56 | — | — | |
| PGDSurrogate Model=CLIPCNN, Victim Model=CLIPCNN2026.04 | 84.2 | — | — | |
| HQA-VLAttackSurrogate Model=ALBEF, Victim Model=CLIPCNN2026.04 | 81.64 | — | — | |
| HQA-VLAttackSurrogate Model=ALBEF, Victim Model=CLIPViT2026.04 | 80.2 | — | — | |
| Sep-AttackSurrogate Model=TCL, Victim Model=TCL2026.04 | 78.97 | — | — | |
| HQA-VLAttackSurrogate Model=TCL, Victim Model=CLIPCNN2026.04 | 78.22 | — | — | |
| Sep-AttackSurrogate Model=CLIPViT, Victim Model=CLIPViT2026.04 | 77.94 | — | — | |
| HQA-VLAttackSurrogate Model=TCL, Victim Model=CLIPViT2026.04 | 76.22 | — | — | |
| DRASurrogate Model=TCL, Victim Model=ALBEF2026.04 | 75.86 | — | — | |
| SGASurrogate Model=TCL, Victim Model=ALBEF2026.04 | 73.3 | — | — | |
| DRASurrogate Model=CLIPViT, Victim Model=CLIPCNN2026.04 | 69.99 | — | — | |
| PGDSurrogate Model=TCL, Victim Model=TCL2026.04 | 69.53 | — | — | |
| DRASurrogate Model=ALBEF, Victim Model=CLIPCNN2026.04 | 69.22 | — | — | |
| DRASurrogate Model=ALBEF, Victim Model=TCL2026.04 | 67.46 | — | — | |
| DRASurrogate Model=ALBEF, Victim Model=CLIPViT2026.04 | 67.43 | — | — | |
| X-FMEvaluation protocol=Fine-Tune, Model size=base-size2023.01 | 67 | 87.2 | 92.4 | |
| PGDSurrogate Model=CLIPViT, Victim Model=CLIPViT2026.04 | 66.85 | — | — | |
| SGASurrogate Model=ALBEF, Victim Model=CLIPCNN2026.04 | 66.52 | — | — | |
| X2-VLMEvaluation protocol=Fine-Tune, Model size=base-size2023.01 | 66.2 | 87.1 | 92.2 | |
| HQA-VLAttackSurrogate Model=CLIPViT, Victim Model=ALBEF2026.04 | 66.03 | — | — | |
| SGASurrogate Model=CLIPViT, Victim Model=CLIPCNN2026.04 | 65.83 | — | — | |
| SGASurrogate Model=TCL, Victim Model=CLIPCNN2026.04 | 65.7 | — | — | |
| DRASurrogate Model=TCL, Victim Model=CLIPCNN2026.04 | 65.7 | — | — | |
| SGASurrogate Model=ALBEF, Victim Model=TCL2026.04 | 65.38 | — | — | |
| mPLUG-2Evaluation protocol=Fine-Tune, Model size=base-size2023.01 | 65.3 | 86.9 | 92.4 | |
| SGASurrogate Model=ALBEF, Victim Model=CLIPViT2026.04 | 65.25 | — | — | |
| HQA-VLAttackSurrogate Model=CLIPViT, Victim Model=TCL2026.04 | 65.25 | — | — | |
| DRASurrogate Model=CLIPCNN, Victim Model=CLIPViT2026.04 | 64.87 | — | — | |
| SGASurrogate Model=TCL, Victim Model=CLIPViT2026.04 | 63.99 | — | — | |
| DRASurrogate Model=TCL, Victim Model=CLIPViT2026.04 | 63.99 | — | — | |
| X-VLMEvaluation protocol=Fine-Tune, Model size=base-size2023.01 | 63.1 | 85.7 | 91.6 | |
| Co-AttackSurrogate Model=CLIPViT, Victim Model=CLIPCNN2026.04 | 62.51 | — | — | |
| Co-AttackSurrogate Model=TCL, Victim Model=CLIPCNN2026.04 | 62.49 | — | — | |
| HQA-VLAttackSurrogate Model=CLIPCNN, Victim Model=TCL2026.04 | 62.49 | — | — | |
| BERT-AttackSurrogate Model=CLIPCNN, Victim Model=CLIPCNN2026.04 | 62.17 | — | — | |
| HQA-VLAttackSurrogate Model=CLIPCNN, Victim Model=ALBEF2026.04 | 62.13 | — | — | |
| FALCON#Images=4M, Evaluation Protocol=Fine-tuned2025.05 | 61.5 | 83.6 | 90.2 | |
| BERT-AttackSurrogate Model=TCL, Victim Model=CLIPCNN2026.04 | 61.26 | — | — | |
| Sep-AttackSurrogate Model=TCL, Victim Model=CLIPCNN2026.04 | 61.26 | — | — | |
| MAFA#Images=4M, Evaluation Protocol=Fine-tuned2025.05 | 61.2 | 83.9 | 90.2 | |
| X-FMEvaluation protocol=Zero-Shot, Model size=base-size2023.01 | 61.1 | 84.5 | 90.6 | |
| SGASurrogate Model=CLIPCNN, Victim Model=CLIPViT2026.04 | 60.77 | — | — | |
| Co-AttackSurrogate Model=TCL, Victim Model=CLIPViT2026.04 | 60.46 | — | — | |
| Sep-AttackSurrogate Model=TCL, Victim Model=CLIPViT2026.04 | 60.13 | — | — | |
| ALIGN#Images=1.2B, Evaluation Protocol=Fine-tuned2025.05 | 59.9 | 83.3 | 89.8 | |
| GRIT-VLP#Images=4M, Evaluation Protocol=Fine-tuned2025.05 | 59.6 | 83.3 | 89.9 | |
| TCL#Images=4M, Evaluation Protocol=Fine-tuned2025.05 | 59 | 83.2 | 89.9 | |
| Co-AttackSurrogate Model=CLIPCNN, Victim Model=CLIPViT2026.04 | 58.9 | — | — | |
| BERT-AttackSurrogate Model=TCL, Victim Model=CLIPViT2026.04 | 58.8 | — | — | |
| OmniVLEvaluation protocol=Fine-Tune, Model size=base-size2023.01 | 58.5 | 82.6 | 89.5 | |
| OSCARLModel scale=Large2020.04 | 57.5 | 82.8 | 89.8 | |
| BERT-AttackSurrogate Model=CLIPCNN, Victim Model=CLIPViT2026.04 | 57.49 | — | — | |
| Sep-AttackSurrogate Model=CLIPCNN, Victim Model=CLIPViT2026.04 | 57.11 | — | — | |
| Co-AttackSurrogate Model=TCL, Victim Model=ALBEF2026.04 | 57.09 | — | — | |
| ALBEF#Images=4M, Evaluation Protocol=Fine-tuned2025.05 | 56.8 | 81.5 | 89.2 | |
| Sep-AttackSurrogate Model=ALBEF, Victim Model=CLIPCNN2026.04 | 55.88 | — | — | |
| Co-AttackSurrogate Model=ALBEF, Victim Model=CLIPCNN2026.04 | 55.64 | — | — | |
| X-VLMEvaluation protocol=Zero-Shot, Model size=base-size2023.01 | 55.6 | 82.7 | 90 | |
| BERT-AttackSurrogate Model=CLIPViT, Victim Model=CLIPCNN2026.04 | 55.32 | — | — | |
| FALCON#Images=4M, Evaluation Protocol=Zero-shot2025.05 | 54.8 | 79.8 | 87.6 | |
| BERT-AttackSurrogate Model=ALBEF, Victim Model=CLIPCNN2026.04 | 54.75 | — | — | |
| Co-AttackSurrogate Model=ALBEF, Victim Model=CLIPViT2026.04 | 54.75 | — | — | |
| Sep-AttackSurrogate Model=ALBEF, Victim Model=CLIPViT2026.04 | 54.46 | — | — | |
| Uni-Perceiver-MoEEvaluation protocol=Fine-Tune, Model size=base-size2023.01 | 54.1 | — | — | |
| OSCARBModel scale=Base2020.04 | 54 | 80.8 | 88.5 | |
| MAFA#Images=4M, Evaluation Protocol=Zero-shot2025.05 | 53.9 | 79.6 | 87.7 | |
| TCL#Images=4M, Evaluation Protocol=Zero-shot2025.05 | 53.5 | 79 | 87.1 | |
| Sep-AttackSurrogate Model=TCL, Victim Model=ALBEF2026.04 | 52.97 | — | — | |
| UNITER#Images=4M, Evaluation Protocol=Fine-tuned2025.05 | 52.9 | 79.9 | 88 | |
| BERT-AttackSurrogate Model=ALBEF, Victim Model=CLIPViT2026.04 | 52.28 | — | — | |
| SoTALModel scale=Large2020.04 | 51.7 | 78.4 | 86.9 | |
| BERT-AttackSurrogate Model=CLIPViT, Victim Model=CLIPViT2026.04 | 51.68 | — | — | |
| Uni-Perceiver-MoEEvaluation protocol=Zero-Shot, Model size=base-size2023.01 | 51.6 | — | — | |
| ImageBERT#Images=6M, Evaluation Protocol=Fine-tuned2025.05 | 50.5 | 78.7 | 87.1 | |
| FLAVAEvaluation protocol=Fine-Tune, Model size=base-size2023.01 | 50.1 | 74.4 | 83.2 | |
| ALBEF#Images=4M, Evaluation Protocol=Zero-shot2025.05 | 50.1 | 76.4 | 84.5 | |
| Sep-AttackSurrogate Model=CLIPViT, Victim Model=CLIPCNN2026.04 | 49.76 | — | — | |
| UNITER#Images=4M, Evaluation Protocol=Zero-shot2025.05 | 48.8 | 76.7 | 85.8 |