Image-to-Text Adversarial Attack on Evaluation set
97.4ASRFRA-Attack
Evaluation Results
| Method | Links | ||
|---|---|---|---|
| FRA-AttackVictim Model=GLM-4.6V, Similarity Threshold=0.32026.05 | 97.4 | 68.7 | |
| FRA-AttackVictim Model=Qwen3-VL-8B, Similarity Threshold=0.32026.05 | 95.6 | 65.3 | |
| M-Attack-V2Victim Model=GLM-4.6V, Similarity Threshold=0.32026.05 | 95.4 | 61.8 | |
| FRA-AttackVictim Model=Qwen3-VL-32B, Similarity Threshold=0.32026.05 | 94.8 | 61.7 | |
| M-Attack-V2Victim Model=Qwen3-VL-8B, Similarity Threshold=0.32026.05 | 93.1 | 62 | |
| FOA-AttackVictim Model=GLM-4.6V, Similarity Threshold=0.32026.05 | 90.5 | 55.4 | |
| FRA-AttackVictim Model=Kimi-K2.5, Similarity Threshold=0.32026.05 | 90.4 | 56.8 | |
| M-Attack-V2Victim Model=Qwen3-VL-32B, Similarity Threshold=0.32026.05 | 89.4 | 56.7 | |
| FOA-AttackVictim Model=Qwen3-VL-8B, Similarity Threshold=0.32026.05 | 89.2 | 54.7 | |
| M-AttackVictim Model=GLM-4.6V, Similarity Threshold=0.32026.05 | 88.5 | 51.8 | |
| FOA-AttackVictim Model=Qwen3-VL-32B, Similarity Threshold=0.32026.05 | 87.9 | 49.1 | |
| M-AttackVictim Model=Qwen3-VL-8B, Similarity Threshold=0.32026.05 | 85.1 | 50.9 | |
| M-AttackVictim Model=Qwen3-VL-32B, Similarity Threshold=0.32026.05 | 83.4 | 45.9 | |
| FRA-AttackVictim Model=Llama-3.2-11B-V, Similarity Threshold=0.32026.05 | 82.2 | 48.1 | |
| M-Attack-V2Victim Model=Kimi-K2.5, Similarity Threshold=0.32026.05 | 81 | 48.3 | |
| M-Attack-V2Victim Model=Gemma-3-27B-it, Similarity Threshold=0.32026.05 | 80.6 | 39.6 | |
| M-Attack-V2Victim Model=Llama-3.2-11B-V, Similarity Threshold=0.32026.05 | 80.3 | 44.9 | |
| FOA-AttackVictim Model=Kimi-K2.5, Similarity Threshold=0.32026.05 | 77.4 | 40.8 | |
| FRA-AttackVictim Model=Gemma-3-27B-it, Similarity Threshold=0.32026.05 | 77.3 | 36.9 | |
| FOA-AttackVictim Model=Gemma-3-27B-it, Similarity Threshold=0.32026.05 | 73.5 | 33.9 | |
| M-AttackVictim Model=Gemma-3-27B-it, Similarity Threshold=0.32026.05 | 72 | 31.8 | |
| FOA-AttackVictim Model=Llama-3.2-11B-V, Similarity Threshold=0.32026.05 | 70.1 | 38 | |
| M-AttackVictim Model=Kimi-K2.5, Similarity Threshold=0.32026.05 | 69.6 | 36.4 | |
| AdvDiffVLMVictim Model=Gemma-3-27B-it, Similarity Threshold=0.32026.05 | 68 | 26.6 | |
| SSA-CWAVictim Model=Gemma-3-27B-it, Similarity Threshold=0.32026.05 | 66 | 27.2 | |
| M-AttackVictim Model=Llama-3.2-11B-V, Similarity Threshold=0.32026.05 | 65.6 | 35.4 | |
| AnyAttackVictim Model=Gemma-3-27B-it, Similarity Threshold=0.32026.05 | 56 | 21.6 | |
| AttackVLMVictim Model=Gemma-3-27B-it, Similarity Threshold=0.32026.05 | 54 | 25.8 | |
| AttackVLMVictim Model=Qwen3-VL-8B, Similarity Threshold=0.32026.05 | 11 | 7.3 | |
| AttackVLMVictim Model=Qwen3-VL-32B, Similarity Threshold=0.32026.05 | 10 | 5.8 | |
| AdvDiffVLMVictim Model=GLM-4.6V, Similarity Threshold=0.32026.05 | 9 | 4.5 | |
| AdvDiffVLMVictim Model=Qwen3-VL-32B, Similarity Threshold=0.32026.05 | 8 | 4.6 | |
| AttackVLMVictim Model=GLM-4.6V, Similarity Threshold=0.32026.05 | 7 | 3.5 | |
| AdvDiffVLMVictim Model=Qwen3-VL-8B, Similarity Threshold=0.32026.05 | 7 | 3.3 | |
| SSA-CWAVictim Model=Qwen3-VL-32B, Similarity Threshold=0.32026.05 | 7 | 4.3 | |
| AdvDiffVLMVictim Model=Llama-3.2-11B-V, Similarity Threshold=0.32026.05 | 6 | 3.4 | |
| AdvDiffVLMVictim Model=Kimi-K2.5, Similarity Threshold=0.32026.05 | 6 | 3.8 | |
| AnyAttackVictim Model=Qwen3-VL-8B, Similarity Threshold=0.32026.05 | 6 | 3.7 | |
| AnyAttackVictim Model=Qwen3-VL-32B, Similarity Threshold=0.32026.05 | 6 | 5.2 | |
| AnyAttackVictim Model=GLM-4.6V, Similarity Threshold=0.32026.05 | 6 | 4 | |
| AnyAttackVictim Model=Llama-3.2-11B-V, Similarity Threshold=0.32026.05 | 6 | 2.8 | |
| AttackVLMVictim Model=Llama-3.2-11B-V, Similarity Threshold=0.32026.05 | 5 | 2.5 | |
| AttackVLMVictim Model=Kimi-K2.5, Similarity Threshold=0.32026.05 | 5 | 2.7 | |
| SSA-CWAVictim Model=Qwen3-VL-8B, Similarity Threshold=0.32026.05 | 4 | 2.4 | |
| AnyAttackVictim Model=Kimi-K2.5, Similarity Threshold=0.32026.05 | 4 | 2.6 | |
| SSA-CWAVictim Model=GLM-4.6V, Similarity Threshold=0.32026.05 | 3 | 3.3 | |
| SSA-CWAVictim Model=Llama-3.2-11B-V, Similarity Threshold=0.32026.05 | 3 | 2.5 | |
| SSA-CWAVictim Model=Kimi-K2.5, Similarity Threshold=0.32026.05 | 1 | 1.7 |