Jailbreak Attack on JailBreakV_28K
88.32Attack Success Rate (ASR)UJEM-KL
Evaluation Results
| Method | Links | ||
|---|---|---|---|
| UJEM-KLSource Model=LLaVA-1.5, Target Model=LLaVA-1.52026.05 | 88.32 | — | |
| SEASource Model=LLaVA-1.5, Target Model=LLaVA-1.52026.05 | 85.23 | — | |
| UJEMSource Model=LLaVA-1.5, Target Model=LLaVA-1.52026.05 | 84.33 | — | |
| ForceSource Model=LLaVA-1.5, Target Model=LLaVA-1.52026.05 | 84.02 | — | |
| UJEM-KLSource Model=InternVL3.5, Target Model=InternVL3.52026.05 | 83.67 | — | |
| SEASource Model=InternVL3.5, Target Model=InternVL3.52026.05 | 83.39 | — | |
| FigStepSource Model=LLaVA-1.5, Target Model=LLaVA-1.52026.05 | 82.28 | — | |
| UJEM-KLSource Model=Qwen2.5-VL, Target Model=Qwen2.5-VL2026.05 | 82.23 | — | |
| ForceSource Model=InternVL3.5, Target Model=InternVL3.52026.05 | 82.14 | — | |
| SEASource Model=Qwen2.5-VL, Target Model=Qwen2.5-VL2026.05 | 81.64 | — | |
| UJEMSource Model=InternVL3.5, Target Model=InternVL3.52026.05 | 81.22 | — | |
| ForceSource Model=Qwen2.5-VL, Target Model=Qwen2.5-VL2026.05 | 79.27 | — | |
| FigStepSource Model=Qwen2.5-VL, Target Model=Qwen2.5-VL2026.05 | 78.43 | — | |
| UJASource Model=LLaVA-1.5, Target Model=LLaVA-1.52026.05 | 78.06 | — | |
| UJEMSource Model=Qwen2.5-VL, Target Model=Qwen2.5-VL2026.05 | 76.41 | — | |
| FigStepSource Model=InternVL3.5, Target Model=InternVL3.52026.05 | 75.17 | — | |
| UJASource Model=Qwen2.5-VL, Target Model=Qwen2.5-VL2026.05 | 72.58 | — | |
| UJASource Model=InternVL3.5, Target Model=InternVL3.52026.05 | 70.21 | — | |
| FigStepSource Model=LLaVA-1.5, Target Model=Qwen2.5-VL2026.05 | 67.33 | — | |
| UJEM-KLSource Model=LLaVA-1.5, Target Model=Qwen2.5-VL2026.05 | 67.14 | — | |
| UJEM-KLSource Model=LLaVA-1.5, Target Model=InternVL3.52026.05 | 62.44 | — | |
| UJEM-KLSource Model=InternVL3.5, Target Model=LLaVA-1.52026.05 | 60.77 | — | |
| Baseline2026.03 | 58.97 | 79.1 | |
| UJEMSource Model=LLaVA-1.5, Target Model=Qwen2.5-VL2026.05 | 57.16 | — | |
| UJEM-KLSource Model=Qwen2.5-VL, Target Model=LLaVA-1.52026.05 | 56.63 | — | |
| FigStepSource Model=Qwen2.5-VL, Target Model=LLaVA-1.52026.05 | 54.4 | — | |
| UJEMSource Model=LLaVA-1.5, Target Model=InternVL3.52026.05 | 54.34 | — | |
| FigStepSource Model=LLaVA-1.5, Target Model=InternVL3.52026.05 | 52.94 | — | |
| UJEMSource Model=InternVL3.5, Target Model=LLaVA-1.52026.05 | 52.61 | — | |
| SEASource Model=LLaVA-1.5, Target Model=Qwen2.5-VL2026.05 | 48.86 | — | |
| UJEM-KLSource Model=Qwen2.5-VL, Target Model=InternVL3.52026.05 | 48.62 | — | |
| UJEMSource Model=Qwen2.5-VL, Target Model=LLaVA-1.52026.05 | 48.5 | — | |
| ForceSource Model=LLaVA-1.5, Target Model=Qwen2.5-VL2026.05 | 47.29 | — | |
| FigStepSource Model=InternVL3.5, Target Model=LLaVA-1.52026.05 | 46.89 | — | |
| Post-hoc Safety Filtering2026.03 | 45.13 | 72.7 | |
| UJEM-KLSource Model=InternVL3.5, Target Model=Qwen2.5-VL2026.05 | 44.94 | — | |
| SEASource Model=LLaVA-1.5, Target Model=InternVL3.52026.05 | 44.1 | — | |
| SEASource Model=Qwen2.5-VL, Target Model=LLaVA-1.52026.05 | 44.03 | — | |
| UJASource Model=LLaVA-1.5, Target Model=Qwen2.5-VL2026.05 | 43.95 | — | |
| FigStepSource Model=Qwen2.5-VL, Target Model=InternVL3.52026.05 | 43.82 | — | |
| SEASource Model=InternVL3.5, Target Model=LLaVA-1.52026.05 | 43.76 | — | |
| ForceSource Model=LLaVA-1.5, Target Model=InternVL3.52026.05 | 43.02 | — | |
| ForceSource Model=InternVL3.5, Target Model=LLaVA-1.52026.05 | 42.73 | — | |
| ForceSource Model=Qwen2.5-VL, Target Model=LLaVA-1.52026.05 | 41.47 | — | |
| FigStepSource Model=InternVL3.5, Target Model=Qwen2.5-VL2026.05 | 41.38 | — | |
| UJEMSource Model=Qwen2.5-VL, Target Model=InternVL3.52026.05 | 40.64 | — | |
| UJEMSource Model=InternVL3.5, Target Model=Qwen2.5-VL2026.05 | 40.27 | — | |
| UJASource Model=LLaVA-1.5, Target Model=InternVL3.52026.05 | 38.67 | — | |
| UJASource Model=Qwen2.5-VL, Target Model=LLaVA-1.52026.05 | 38.35 | — | |
| SEASource Model=Qwen2.5-VL, Target Model=InternVL3.52026.05 | 35.24 | — | |
| UJASource Model=InternVL3.5, Target Model=LLaVA-1.52026.05 | 34.42 | — | |
| SEASource Model=InternVL3.5, Target Model=Qwen2.5-VL2026.05 | 33.42 | — | |
| ForceSource Model=Qwen2.5-VL, Target Model=InternVL3.52026.05 | 33.16 | — | |
| ForceSource Model=InternVL3.5, Target Model=Qwen2.5-VL2026.05 | 31.62 | — | |
| UJASource Model=Qwen2.5-VL, Target Model=InternVL3.52026.05 | 29.08 | — | |
| UJASource Model=InternVL3.5, Target Model=Qwen2.5-VL2026.05 | 26.05 | — | |
| SFCoT2026.03 | 12.31 | — |