Jailbreak Attack on Advbench-M
0Attack Success Rate (ASR%)Vanilla
Evaluation results
| Method | Links | ||
|---|---|---|---|
| VanillaTarget Model=GPT-4o2026.03 | 0 | 0 | |
| FigStepTarget Model=GPT-4o2026.03 | 0 | 0.8 | |
| Qwen3-VL-Plus2026.04 | 0 | — | |
| Gemini-3-Flash2026.04 | 0 | — | |
| Claude-Haiku-4.52026.04 | 0 | — | |
| GPT-5-Mini2026.04 | 0 | — | |
| Qwen3-VL-8B-InstructParameters=8B, Alignment=Instruct2026.04 | 0 | — | |
| DeepSeek-V3.22026.04 | 0.14 | — | |
| Kimi-K2.52026.04 | 0.41 | — | |
| VanillaTarget Model=Gemini-2.0-Flash2026.03 | 0.5 | 1.3 | |
| VanillaTarget Model=Gemini-2.5-Flash2026.03 | 0.5 | 1.3 | |
| FigStepTarget Model=Gemini-2.5-Flash2026.03 | 0.9 | 1.8 | |
| VanillaTarget Model=Qwen3-VL-Flash2026.03 | 0.9 | 1.5 | |
| Mistral-Medium-32026.04 | 1.1 | — | |
| Llama-3.2-11B-VisionParameters=11B, Type=Vision2026.04 | 1.51 | — | |
| VanillaTarget Model=Qwen2.5VL-7B2026.03 | 1.9 | 1.6 | |
| SI-AttackTarget Model=InternVL-3-9B2026.03 | 1.9 | 2.4 | |
| VanillaTarget Model=InternVL-3-9B2026.03 | 2.3 | 1.3 | |
| FigStepTarget Model=Qwen2.5VL-7B2026.03 | 2.8 | 3 | |
| FigStepTarget Model=Qwen3-VL-Flash2026.03 | 3.2 | 2.9 | |
| SI-AttackTarget Model=Qwen3-VL-Flash2026.03 | 3.7 | 2.8 | |
| HADESTarget Model=Gemini-2.0-Flash2026.03 | 5.1 | 1.7 | |
| JOODTarget Model=Gemini-2.5-Flash2026.03 | 5.1 | 1.9 | |
| HADESTarget Model=Qwen3-VL-Flash2026.03 | 5.1 | 2.1 | |
| FigStepTarget Model=Gemini-2.0-Flash2026.03 | 7.4 | 2.8 | |
| HADESTarget Model=Gemini-2.5-Flash2026.03 | 7.9 | 1.8 | |
| FigStep-ProTarget Model=Gemini-2.5-Flash2026.03 | 8.3 | 2.5 | |
| HADESTarget Model=GPT-4o2026.03 | 10.2 | 1.5 | |
| FigStep-ProTarget Model=GPT-4o2026.03 | 10.7 | 1.7 | |
| SI-AttackTarget Model=Qwen2.5VL-7B2026.03 | 11.1 | 2.9 | |
| FigStepTarget Model=InternVL-3-9B2026.03 | 15.7 | 2.4 | |
| JOODTarget Model=Gemini-2.0-Flash2026.03 | 16.2 | 2.3 | |
| LLaVA-v1.6-Vicuna-7BBackbone=Vicuna-7B2026.04 | 17.56 | — | |
| JOODTarget Model=Qwen3-VL-Flash2026.03 | 18.5 | 2.9 | |
| JOODTarget Model=GPT-4o2026.03 | 19.9 | 2 | |
| SI-AttackTarget Model=Gemini-2.5-Flash2026.03 | 21.3 | 2.3 | |
| HADESTarget Model=Qwen2.5VL-7B2026.03 | 22.7 | 3.3 | |
| HADESTarget Model=InternVL-3-9B2026.03 | 24.5 | 2.1 | |
| SI-AttackTarget Model=GPT-4o2026.03 | 32.9 | 2.5 | |
| JOODTarget Model=Qwen2.5VL-7B2026.03 | 33.3 | 3.1 | |
| SI-AttackTarget Model=Gemini-2.0-Flash2026.03 | 47.7 | 2.8 | |
| FigStep-ProTarget Model=Qwen3-VL-Flash2026.03 | 48.6 | 4.1 | |
| StructAttack (v2)Target Model=Gemini-2.5-Flash2026.03 | 49.1 | 5.4 | |
| StructAttack (v3)Target Model=Gemini-2.5-Flash2026.03 | 49.5 | 5.8 | |
| StructAttack (v1)Target Model=Gemini-2.5-Flash2026.03 | 52.3 | 6.1 | |
| JOODTarget Model=InternVL-3-9B2026.03 | 54.2 | 3.4 | |
| StructAttack (v1)Target Model=Qwen3-VL-Flash2026.03 | 59.3 | 5.9 | |
| FigStep-ProTarget Model=Gemini-2.0-Flash2026.03 | 62.5 | 5.8 | |
| FigStep-ProTarget Model=Qwen2.5VL-7B2026.03 | 64.4 | 5 | |
| StructAttack (v3)Target Model=GPT-4o2026.03 | 65.3 | 5.5 | |
| StructAttack (v1)Target Model=GPT-4o2026.03 | 69 | 5.3 | |
| StructAttack (v2)Target Model=GPT-4o2026.03 | 69 | 5.6 | |
| StructAttack (v1)Target Model=Gemini-2.0-Flash2026.03 | 69.9 | 7 | |
| StructAttack (v3)Target Model=Gemini-2.0-Flash2026.03 | 70.4 | 6.7 | |
| StructAttack (v3)Target Model=Qwen3-VL-Flash2026.03 | 70.4 | 6.8 | |
| StructAttack (v2)Target Model=Qwen3-VL-Flash2026.03 | 70.8 | 6.6 | |
| StructAttack (v2)Target Model=Gemini-2.0-Flash2026.03 | 73.6 | 6.5 | |
| StructAttack (v2)Target Model=Qwen2.5VL-7B2026.03 | 84.7 | 6 | |
| FigStep-ProTarget Model=InternVL-3-9B2026.03 | 86.1 | 5.5 | |
| StructAttack (v3)Target Model=Qwen2.5VL-7B2026.03 | 86.6 | 6.4 | |
| StructAttack (v1)Target Model=InternVL-3-9B2026.03 | 87 | 5.8 | |
| StructAttack (v1)Target Model=Qwen2.5VL-7B2026.03 | 88.4 | 6.7 | |
| StructAttack (v3)Target Model=InternVL-3-9B2026.03 | 89.8 | 5.1 | |
| StructAttack (v2)Target Model=InternVL-3-9B2026.03 | 92.1 | 5.4 |