Jailbreak Attack Defense on SPA-VL
22.64Attack Success Rate (ASR)VSFA
Evaluation results
| Method | Links | ||
|---|---|---|---|
| VSFAModel=Qwen3-VL-8B2026.03 | 22.64 | 52 | |
| VSFAModel=Qwen2.5-VL-7B2026.03 | 24.53 | 54 | |
| VLGuardModel=Qwen3-VL-8B, Defense Protocol=Fine-tuned on manually labeled harmful image-text pairs2026.03 | 28.49 | 31 | |
| VSFAModel=LLaVA-v1.6-7B2026.03 | 28.68 | 49 | |
| VLGuardModel=Qwen2.5-VL-7B, Defense Protocol=Fine-tuned on manually labeled harmful image-text pairs2026.03 | 30.57 | 33 | |
| AdaShieldModel=Qwen3-VL-8B, Defense Protocol=Inference-time defense via safety prompting2026.03 | 32.45 | 5 | |
| VSFAModel=LLaVA-1.5-7B2026.03 | 32.45 | 46 | |
| VLGuardModel=LLaVA-v1.6-7B, Defense Protocol=Fine-tuned on manually labeled harmful image-text pairs2026.03 | 34.53 | 29 | |
| AdaShieldModel=Qwen2.5-VL-7B, Defense Protocol=Inference-time defense via safety prompting2026.03 | 35.28 | 6 | |
| AdaShieldModel=LLaVA-v1.6-7B, Defense Protocol=Inference-time defense via safety prompting2026.03 | 38.49 | 4 | |
| VLGuardModel=LLaVA-1.5-7B, Defense Protocol=Fine-tuned on manually labeled harmful image-text pairs2026.03 | 42.64 | 26 | |
| No DefenseModel=Qwen3-VL-8B2026.03 | 45.28 | 11 | |
| AdaShieldModel=LLaVA-1.5-7B, Defense Protocol=Inference-time defense via safety prompting2026.03 | 45.28 | 3 | |
| No DefenseModel=Qwen2.5-VL-7B2026.03 | 48.49 | 13 | |
| No DefenseModel=LLaVA-v1.6-7B2026.03 | 54.34 | 9 | |
| No DefenseModel=LLaVA-1.5-7B2026.03 | 65.47 | 7 |