Jailbreak Attack on HADES
99.6Attack Success RateDMN
Evaluation results
| Method | Links | |||||
|---|---|---|---|---|---|---|
| DMNTarget Model=GPT-4V2026.05 | 99.6 | — | — | — | — | |
| DMNTarget Model=GPT-4o2026.05 | 99.47 | — | — | — | — | |
| DMNTarget Model=Seed1.5-VL2026.05 | 99.2 | — | — | — | — | |
| DMNTarget Model=Gemini-2.5-pro2026.05 | 98.67 | — | — | — | — | |
| INFER+Target Model=Qwen2-VL, Model Type=Open-source2026.07 | 97.52 | — | — | — | — | |
| MIDASTarget Model=Qwen2.5-VL2026.02 | 97.36 | — | — | — | 3.65 | |
| INFER+Target Model=InternVL2, Model Type=Open-source2026.07 | 96.21 | — | — | — | — | |
| DMNTarget Model=Gemini-2.5-flash2026.05 | 95.87 | — | — | — | — | |
| DMNTarget Model=Qwen3-VL-plus2026.05 | 95.73 | — | — | — | — | |
| DMNTarget Model=Claude Sonnet 42026.05 | 94.53 | — | — | — | — | |
| INFER+Target Model=Gemini 2.5 Flash Lite, Model Type=Closed-source, Surrogate Model=Qwen2-VL2026.07 | 94.31 | — | — | — | — | |
| MIDASTarget Model=QVQ-Max2026.02 | 94.24 | — | — | — | 4.21 | |
| INFERTarget Model=Qwen2-VL, Model Type=Open-source2026.07 | 94.02 | — | — | — | — | |
| MIDASTarget Model=Gemini-2.5-FT2026.02 | 93.34 | — | — | — | 4.32 | |
| DMNTarget Model=Average2026.05 | 93.09 | — | — | — | — | |
| INFER+Target Model=InternVL3.5, Model Type=Open-source2026.07 | 92.86 | — | — | — | — | |
| INFER+Target Model=Llama 3.2-Vision, Model Type=Open-source2026.07 | 92.57 | — | — | — | — | |
| INFER+Target Model=GPT-4.1 mini, Model Type=Closed-source, Surrogate Model=Qwen2-VL2026.07 | 91.11 | — | — | — | — | |
| DMNTarget Model=o4-mini2026.05 | 88.4 | — | — | — | — | |
| INFERTarget Model=InternVL2, Model Type=Open-source2026.07 | 87.61 | — | — | — | — | |
| CS-DJTarget Model=Qwen2-VL, Model Type=Open-source2026.07 | 86.59 | — | — | — | — | |
| INFERTarget Model=Llama 3.2-Vision, Model Type=Open-source2026.07 | 86.15 | — | — | — | — | |
| CS-DJTarget Model=InternVL2, Model Type=Open-source2026.07 | 85.57 | — | — | — | — | |
| MIDASTarget Model=Gemini-2.5-Pro2026.02 | 84.55 | — | — | — | 3.66 | |
| INFER+Target Model=Qwen3-VL, Model Type=Open-source2026.07 | 84.55 | — | — | — | — | |
| INFERTarget Model=InternVL3.5, Model Type=Open-source2026.07 | 84.11 | — | — | — | — | |
| TVPITarget Model=Qwen2-VL, Model Type=Open-source2026.07 | 83.82 | — | — | — | — | |
| CS-DJTarget Model=InternVL3.5, Model Type=Open-source2026.07 | 82.94 | — | — | — | — | |
| DMNTarget Model=GPT-52026.05 | 82 | — | — | — | — | |
| INFERTarget Model=Gemini 2.5 Flash Lite, Model Type=Closed-source2026.07 | 81.63 | — | — | — | — | |
| INFER+Target Model=Gemini 2.5 Flash, Model Type=Closed-source, Surrogate Model=Qwen2-VL2026.07 | 80.32 | — | — | — | — | |
| DMNTarget Model=o32026.05 | 77.47 | — | — | — | — | |
| LLaVA-1.5-7B (Baseline)VLM=LLaVA-1.5-7B2026.03 | 73.7 | — | — | — | — | |
| MIDASTarget Model=GPT-5-Chat2026.02 | 72.18 | — | — | — | 3.12 | |
| CMRMVLM=LLaVA-1.5-7B2026.03 | 71.4 | — | — | — | — | |
| INFERTarget Model=Qwen3-VL, Model Type=Open-source2026.07 | 69.97 | — | — | — | — | |
| VisCRATarget Model=QVQ-Max2026.02 | 65.87 | — | — | — | 2.83 | |
| HIMRDTarget Model=Qwen2.5-VL2026.02 | 65.8 | — | — | — | 2.47 | |
| ShiftDCVLM=LLaVA-1.5-7B2026.03 | 65.3 | — | — | — | — | |
| CS-DJTarget Model=GPT-4.1 mini, Model Type=Closed-source2026.07 | 65.01 | — | — | — | — | |
| ImageTypoTarget Model=Qwen2-VL, Model Type=Open-source2026.07 | 64.69 | — | — | — | — | |
| INFERTarget Model=GPT-4.1 mini, Model Type=Closed-source2026.07 | 61.66 | — | — | — | — | |
| MIDASTarget Model=GPT-4o2026.02 | 61.49 | — | — | — | 2.48 | |
| MIDASTarget Model=InternVL2.52026.02 | 59.44 | — | — | — | 2.1 | |
| CS-DJTarget Model=Llama 3.2-Vision, Model Type=Open-source2026.07 | 58.6 | — | — | — | — | |
| CS-DJTarget Model=Gemini 2.5 Flash Lite, Model Type=Closed-source2026.07 | 55.69 | — | — | — | — | |
| ShareGPT4V-7B (Baseline)VLM=ShareGPT4V-7B2026.03 | 55.1 | — | — | — | — | |
| INFERTarget Model=Gemini 2.5 Flash, Model Type=Closed-source2026.07 | 52.92 | — | — | — | — | |
| TVPITarget Model=Qwen3-VL, Model Type=Open-source2026.07 | 51.75 | — | — | — | — | |
| CS-DJTarget Model=Gemini 2.5 Flash, Model Type=Closed-source2026.07 | 50.87 | — | — | — | — | |
| VisCRATarget Model=Gemini-2.5-FT2026.02 | 46.98 | — | — | — | 2.22 | |
| TVPITarget Model=InternVL2, Model Type=Open-source2026.07 | 43.73 | — | — | — | — | |
| HADESTarget Model=QVQ-Max2026.02 | 43.37 | — | — | — | 1.74 | |
| VideoJailTarget Model=Qwen3-VL-plus2026.05 | 41.73 | — | — | — | — | |
| ImageTypoTarget Model=InternVL2, Model Type=Open-source2026.07 | 41.08 | — | — | — | — | |
| HIMRDTarget Model=Gemini-2.5-Pro2026.02 | 40.2 | — | — | — | 1.43 | |
| HIMRDTarget Model=GPT-4o2026.02 | 40.1 | — | — | — | 1.46 | |
| FigStepTarget Model=QVQ-Max2026.02 | 38.78 | — | — | — | 1.61 | |
| VisCRATarget Model=GPT-4o2026.02 | 34.28 | — | — | — | 1.34 | |
| ImageTypoTarget Model=InternVL3.5, Model Type=Open-source2026.07 | 29.74 | — | — | — | — | |
| ECSOVLM=ShareGPT4V-7B2026.03 | 29.6 | — | — | — | — | |
| SI-AttackTarget Model=Qwen2.5-VL2026.02 | 29.32 | — | — | — | 1.31 | |
| CS-DJTarget Model=Qwen3-VL, Model Type=Open-source2026.07 | 29.01 | — | — | — | — | |
| ECSOVLM=LLaVA-1.5-7B2026.03 | 27.6 | — | — | — | — | |
| AdaShieldVLM=LLaVA-1.5-7B2026.03 | 26.5 | — | — | — | — | |
| ShiftDCVLM=InternVL-Chat-19B2026.03 | 25.2 | — | — | — | — | |
| InternVL-Chat-19B (Baseline)VLM=InternVL-Chat-19B2026.03 | 24.9 | — | — | — | — | |
| SI-AttackTarget Model=InternVL2.52026.02 | 24.79 | — | — | — | 1.16 | |
| ShiftDCVLM=ShareGPT4V-7B2026.03 | 22.2 | — | — | — | — | |
| VideoJailTarget Model=Seed1.5-VL2026.05 | 22 | — | — | — | — | |
| VisCRATarget Model=InternVL2.52026.02 | 19.68 | — | — | — | 0.66 | |
| TVPITarget Model=Llama 3.2-Vision, Model Type=Open-source2026.07 | 18.66 | — | — | — | — | |
| TVPITarget Model=Gemini 2.5 Flash, Model Type=Closed-source2026.07 | 18.51 | — | — | — | — | |
| CMRMVLM=InternVL-Chat-19B2026.03 | 17.6 | — | — | — | — | |
| TVPITarget Model=InternVL3.5, Model Type=Open-source2026.07 | 17.35 | — | — | — | — | |
| HIMRDTarget Model=QVQ-Max2026.02 | 17 | — | — | — | 0.93 | |
| ECSOVLM=InternVL-Chat-19B2026.03 | 16.8 | — | — | — | — | |
| HADES (method)Target Model=Seed1.5-VL2026.05 | 16.8 | — | — | — | — | |
| ImageTypoTarget Model=Gemini 2.5 Flash, Model Type=Closed-source2026.07 | 15.89 | — | — | — | — | |
| FigStepTarget Model=InternVL2.52026.02 | 14.86 | — | — | — | 0.48 | |
| HADESTarget Model=InternVL2.52026.02 | 14.86 | — | — | — | 0.48 | |
| JRS-RemVLM=InternVL-Chat-19B2026.03 | 13.6 | — | — | — | — | |
| AdaShieldVLM=InternVL-Chat-19B2026.03 | 13.4 | — | — | — | — | |
| HADESTarget Model=Gemini-2.5-Pro2026.02 | 12.44 | — | — | — | 0.53 | |
| AdaShieldVLM=ShareGPT4V-7B2026.03 | 12.1 | — | — | — | — | |
| VisCRATarget Model=Gemini-2.5-Pro2026.02 | 12.05 | — | — | — | 0.74 | |
| SI-AttackTarget Model=QVQ-Max2026.02 | 11.89 | — | — | — | 1.01 | |
| HADESTarget Model=Qwen2.5-VL2026.02 | 10.04 | — | — | — | 0.42 | |
| VisCRATarget Model=Qwen2.5-VL2026.02 | 10.04 | — | — | — | 0.43 | |
| JRS-RemVLM=LLaVA-1.5-7B2026.03 | 9.4 | — | — | — | — | |
| ImageTypoTarget Model=Llama 3.2-Vision, Model Type=Open-source2026.07 | 9.33 | — | — | — | — | |
| HIMRDTarget Model=GPT-5-Chat2026.02 | 8.8 | — | — | — | 0.37 | |
| HADES (method)Target Model=Gemini-2.5-flash2026.05 | 8.8 | — | — | — | — | |
| VideoJailTarget Model=Average2026.05 | 8.77 | — | — | — | — | |
| HIMRDTarget Model=Gemini-2.5-FT2026.02 | 8.4 | — | — | — | 0.42 | |
| HADES (method)Target Model=Qwen3-VL-plus2026.05 | 8.4 | — | — | — | — | |
| SI-AttackTarget Model=GPT-4o2026.02 | 8.1 | — | — | — | 0.55 | |
| VisCRATarget Model=GPT-5-Chat2026.02 | 7.69 | — | — | — | 0.39 | |
| VideoJailTarget Model=GPT-4o2026.05 | 7.47 | — | — | — | — | |
| TVPITarget Model=GPT-4.1 mini, Model Type=Closed-source2026.07 | 7.29 | — | — | — | — |