Jailbreak Attack Evaluation on SafeBench 100 sampled harmful queries
97ASRStructBreak
Evaluation Results
| Method | Links | |
|---|---|---|
| StructBreakTarget MLLM=Gemini2026.05 | 97 | |
| StructBreakTarget MLLM=Max2026.05 | 97 | |
| StructBreakTarget MLLM=GPT-52026.05 | 95 | |
| StructBreakTarget MLLM=Qwen2.5-VL2026.05 | 95 | |
| StructBreakTarget MLLM=GPT-4o2026.05 | 93 | |
| FigStepTarget MLLM=Qwen2.5-VL2026.05 | 92 | |
| FigStepTarget MLLM=Max2026.05 | 92 | |
| StructBreakTarget MLLM=Avg.2026.05 | 92 | |
| StructBreakTarget MLLM=GPT-5-mini2026.05 | 90 | |
| MM-SafetyBenchTarget MLLM=Gemini2026.05 | 88 | |
| MM-SafetyBenchTarget MLLM=Max2026.05 | 88 | |
| MM-SafetyBenchTarget MLLM=Qwen2.5-VL2026.05 | 85 | |
| StructBreakTarget MLLM=Claude2026.05 | 82 | |
| Typeset RewrittenTarget MLLM=Gemini2026.05 | 77 | |
| Typeset RewrittenTarget MLLM=Max2026.05 | 77 | |
| FigStepTarget MLLM=Gemini2026.05 | 76 | |
| RewrittenTarget MLLM=Gemini2026.05 | 70 | |
| RewrittenTarget MLLM=Max2026.05 | 70 | |
| Typeset RewrittenTarget MLLM=Qwen2.5-VL2026.05 | 70 | |
| MM-SafetyBenchTarget MLLM=Avg.2026.05 | 61.2 | |
| MM-SafetyBenchTarget MLLM=GPT-4o2026.05 | 61 | |
| RewrittenTarget MLLM=GPT-4o2026.05 | 60 | |
| Typeset RewrittenTarget MLLM=GPT-4o2026.05 | 57 | |
| RewrittenTarget MLLM=Claude2026.05 | 55 | |
| FigStepTarget MLLM=Avg.2026.05 | 53.8 | |
| Typeset RewrittenTarget MLLM=Avg.2026.05 | 53 | |
| RewrittenTarget MLLM=Avg.2026.05 | 51.7 | |
| RewrittenTarget MLLM=Qwen2.5-VL2026.05 | 49 | |
| MM-SafetyBenchTarget MLLM=GPT-52026.05 | 46 | |
| FigStepTarget MLLM=GPT-4o2026.05 | 45 | |
| MM-SafetyBenchTarget MLLM=Claude2026.05 | 45 | |
| Typeset RewrittenTarget MLLM=GPT-5-mini2026.05 | 43 | |
| Typeset RewrittenTarget MLLM=GPT-52026.05 | 42 | |
| MM-SafetyBenchTarget MLLM=GPT-5-mini2026.05 | 42 | |
| FigStepTarget MLLM=GPT-5-mini2026.05 | 41 | |
| RewrittenTarget MLLM=GPT-5-mini2026.05 | 38 | |
| RewrittenTarget MLLM=GPT-52026.05 | 38 | |
| FigStepTarget MLLM=GPT-52026.05 | 38 | |
| OriginalTarget MLLM=GPT-52026.05 | 33 | |
| OriginalTarget MLLM=Max2026.05 | 33 | |
| FigStepTarget MLLM=Claude2026.05 | 31 | |
| OriginalTarget MLLM=GPT-4o2026.05 | 30 | |
| OriginalTarget MLLM=GPT-5-mini2026.05 | 29 | |
| OriginalTarget MLLM=Claude2026.05 | 29 | |
| Typeset RewrittenTarget MLLM=Claude2026.05 | 29 | |
| OriginalTarget MLLM=Avg.2026.05 | 27.7 | |
| OriginalTarget MLLM=Gemini2026.05 | 26 | |
| OriginalTarget MLLM=Qwen2.5-VL2026.05 | 19 |