Jailbreak Attack on HADES (Harm Category Success Rates)
66.67Success Rate (Animal)CS-DJ
Evaluation results
| Method | Links | ||||||
|---|---|---|---|---|---|---|---|
| CS-DJVictim Model=Qwen3-VL-30B-A3B2026.01 | 66.67 | 68.67 | 49.33 | 32.67 | 64 | 56.27 | |
| Text-DJVictim Model=Qwen3-VL-30B-A3B2026.01 | 63.33 | 70.67 | 48.67 | 38.67 | 66.67 | 57.6 | |
| Text-DJVictim Model=Qwen3-VL-4B2026.01 | 56 | 61.33 | 42 | 31.33 | 50 | 48.13 | |
| CS-DJVictim Model=Qwen3-VL-8B2026.01 | 49.33 | 49.33 | 32.67 | 20 | 41.33 | 38.53 | |
| CS-DJVictim Model=Qwen3-VL-4B2026.01 | 47.33 | 41.33 | 30 | 18 | 35.33 | 34.4 | |
| CLIP2025.02 | 44 | 59.67 | 69.22 | — | 77.22 | 62.41 | |
| Text-DJVictim Model=Qwen3-VL-8B2026.01 | 42.67 | 70.67 | 60 | 26 | 64 | 52.67 | |
| FARE^4Robustness Budget=4/2552025.02 | 33.67 | 52.44 | 65.33 | — | 72.33 | 55.94 | |
| CS-DJVictim Model=GPT 4.1 mini2026.01 | 33.33 | 74.67 | 77.33 | 30 | 64.67 | 56 | |
| Text-DJVictim Model=GPT 4o mini2026.01 | 32 | 79.33 | 78.67 | 38 | 68.67 | 59.33 | |
| Sim-CLIP^4Robustness Budget=4/2552025.02 | 31.89 | 52.44 | 66.11 | — | 72.67 | 55.78 | |
| Robust-LLaVA^4_GRobustness Budget=4/2552025.02 | 30.22 | 43 | 53.89 | — | 65.11 | 48.06 | |
| Text-DJVictim Model=GPT 4.1 mini2026.01 | 28.67 | 85.33 | 80.67 | 45.33 | 81.33 | 64.27 | |
| Robust-LLaVA^4_HRobustness Budget=4/2552025.02 | 27.56 | 38.11 | 51.11 | — | 64.89 | 45.41 | |
| CS-DJVictim Model=GPT 4o mini2026.01 | 24 | 64 | 66.67 | 20.67 | 58.67 | 46.8 | |
| CS-DJVictim Model=Gemini-2.5-Flash2026.01 | 16.67 | 64.67 | 44.67 | 26.67 | 50 | 40.53 | |
| Text-DJVictim Model=Gemini-2.5-Flash2026.01 | 16 | 73.33 | 54 | 28.67 | 48 | 44 | |
| HADESVictim Model=Gemini-2.5-Flash2026.01 | 10 | 39.33 | 29.33 | 4.67 | 23.33 | 21.33 | |
| HADESVictim Model=Qwen3-VL-4B2026.01 | 7.33 | 18.67 | 7.33 | 2 | 24 | 11.87 | |
| HADESVictim Model=Qwen3-VL-30B-A3B2026.01 | 7.33 | 26 | 15.33 | 6 | 13.33 | 13.6 | |
| HADESVictim Model=GPT 4.1 mini2026.01 | 4 | 14 | 12 | 3.33 | 8.67 | 8.4 | |
| HADESVictim Model=Qwen3-VL-8B2026.01 | 3.33 | 14.67 | 7.33 | 3.33 | 18 | 9.33 | |
| HADESVictim Model=GPT 4o mini2026.01 | 2.67 | 6 | 8 | 1.33 | 2.67 | 4.13 |