Jailbreak Attack Defense on FigStep, MM-SafetyBench, SPA-VL Average
14.18Attack Success Rate (ASR)VSFA
Evaluation results
| Method | Links | ||
|---|---|---|---|
| VSFAModel=Qwen3-VL-8B2026.03 | 14.18 | 50 | |
| VLGuardModel=Qwen3-VL-8B, Defense Protocol=Fine-tuned on manually labeled harmful image-text pairs2026.03 | 14.37 | 31 | |
| AdaShieldModel=Qwen3-VL-8B, Defense Protocol=Inference-time defense via safety prompting2026.03 | 14.47 | 4 | |
| VSFAModel=Qwen2.5-VL-7B2026.03 | 15.88 | 52 | |
| VLGuardModel=Qwen2.5-VL-7B, Defense Protocol=Fine-tuned on manually labeled harmful image-text pairs2026.03 | 15.98 | 33 | |
| AdaShieldModel=Qwen2.5-VL-7B, Defense Protocol=Inference-time defense via safety prompting2026.03 | 16.32 | 5 | |
| VSFAModel=LLaVA-v1.6-7B2026.03 | 18.68 | 47 | |
| VLGuardModel=LLaVA-v1.6-7B, Defense Protocol=Fine-tuned on manually labeled harmful image-text pairs2026.03 | 19.26 | 28 | |
| AdaShieldModel=LLaVA-v1.6-7B, Defense Protocol=Inference-time defense via safety prompting2026.03 | 19.46 | 3 | |
| VSFAModel=LLaVA-1.5-7B2026.03 | 23.76 | 44 | |
| VLGuardModel=LLaVA-1.5-7B, Defense Protocol=Fine-tuned on manually labeled harmful image-text pairs2026.03 | 23.97 | 25 | |
| AdaShieldModel=LLaVA-1.5-7B, Defense Protocol=Inference-time defense via safety prompting2026.03 | 26.75 | 2 | |
| No DefenseModel=Qwen3-VL-8B2026.03 | 38.77 | 11 | |
| No DefenseModel=Qwen2.5-VL-7B2026.03 | 42.12 | 13 | |
| No DefenseModel=LLaVA-v1.6-7B2026.03 | 48.52 | 9 | |
| No DefenseModel=LLaVA-1.5-7B2026.03 | 68.71 | 7 |