Jailbreak Attack on Malicious goals dataset (test)
0ASRFigStep
Evaluation results
| Method | Links | ||
|---|---|---|---|
| FigStepInput Modality=Multimodal, Target Model=Claude-3-7-Sonnet2025.10 | 0 | 1.03 | |
| HadesInput Modality=Multimodal, Target Model=Claude-3-7-Sonnet2025.10 | 0 | 1.016 | |
| Query-AttackInput Modality=Multimodal, Target Model=Gemini-2.5-Flash2025.10 | 0 | 1.008 | |
| Query-AttackInput Modality=Multimodal, Target Model=Claude-3-7-Sonnet2025.10 | 0 | 1.013 | |
| MML-MInput Modality=Multimodal, Target Model=Claude-3-7-Sonnet2025.10 | 0 | 1.014 | |
| MM-SafetyBenchInput Modality=Multimodal, Target Model=Claude-3-7-Sonnet2025.10 | 0.5 | 1.03 | |
| JOODInput Modality=Text-only, Target Model=Claude-3-7-Sonnet2025.10 | 0.75 | 1.054 | |
| Query-AttackInput Modality=Multimodal, Target Model=GPT-4.12025.10 | 0.75 | 1.05 | |
| Query-AttackInput Modality=Multimodal, Target Model=GPT-4o2025.10 | 2 | 1.134 | |
| FigStepInput Modality=Multimodal, Target Model=GPT-4.12025.10 | 2.25 | 1.087 | |
| FigStepInput Modality=Multimodal, Target Model=GPT-4o2025.10 | 3 | 1.108 | |
| HadesInput Modality=Multimodal, Target Model=GPT-4.12025.10 | 3.75 | 1.209 | |
| MML-MInput Modality=Multimodal, Target Model=GPT-4.12025.10 | 3.75 | 1.181 | |
| FigStepInput Modality=Multimodal, Target Model=Gemini-2.5-Flash2025.10 | 5.25 | 1.184 | |
| HadesInput Modality=Multimodal, Target Model=LLaMA3.2-Vision2025.10 | 6 | 1.255 | |
| ArtPromptInput Modality=Text-only, Target Model=Claude-3-7-Sonnet2025.10 | 6.25 | 1.382 | |
| MML-MInput Modality=Multimodal, Target Model=LLaMA3.2-Vision2025.10 | 6.5 | 1.297 | |
| MM-SafetyBenchInput Modality=Multimodal, Target Model=GPT-4.12025.10 | 7.5 | 1.197 | |
| DRAInput Modality=Text-only, Target Model=Claude-3-7-Sonnet2025.10 | 8.25 | 2.617 | |
| MML-MInput Modality=Multimodal, Target Model=Gemini-2.5-Flash2025.10 | 8.5 | 1.319 | |
| HadesInput Modality=Multimodal, Target Model=Gemini-2.5-Flash2025.10 | 9 | 1.317 | |
| MM-SafetyBenchInput Modality=Multimodal, Target Model=LLaMA3.2-Vision2025.10 | 10 | 1.36 | |
| MM-SafetyBenchInput Modality=Multimodal, Target Model=Gemini-2.5-Flash2025.10 | 10 | 1.343 | |
| ArtPromptInput Modality=Text-only, Target Model=LLaVA-v1.62025.10 | 12.75 | 2.565 | |
| FlipAttackInput Modality=Text-only, Target Model=LLaVA-v1.52025.10 | 13.25 | 2.486 | |
| ArtPromptInput Modality=Text-only, Target Model=Qwen2.5-VL2025.10 | 13.75 | 1.55 | |
| HadesInput Modality=Multimodal, Target Model=GPT-4o2025.10 | 14.25 | 1.535 | |
| MML-MInput Modality=Multimodal, Target Model=GPT-4o2025.10 | 14.75 | 1.54 | |
| MML-MInput Modality=Multimodal, Target Model=Qwen2.5-VL2025.10 | 15.5 | 1.714 | |
| MML-MInput Modality=Multimodal, Target Model=Average2025.10 | 16.66 | 1.654 | |
| HadesInput Modality=Multimodal, Target Model=Qwen2.5-VL2025.10 | 16.75 | 1.788 | |
| JOODInput Modality=Text-only, Target Model=GPT-4.12025.10 | 17.5 | 1.605 | |
| FlipAttackInput Modality=Text-only, Target Model=Qwen2.5-VL2025.10 | 17.5 | 2.743 | |
| Query-AttackInput Modality=Multimodal, Target Model=LLaMA3.2-Vision2025.10 | 17.5 | 1.137 | |
| JOODInput Modality=Text-only, Target Model=Qwen2.5-VL2025.10 | 18.25 | 1.861 | |
| Query-AttackInput Modality=Multimodal, Target Model=Average2025.10 | 18.63 | 1.562 | |
| MM-SafetyBenchInput Modality=Multimodal, Target Model=GPT-4o2025.10 | 18.75 | 1.593 | |
| HadesInput Modality=Multimodal, Target Model=Average2025.10 | 19.63 | 1.79 | |
| JOODInput Modality=Text-only, Target Model=Gemini-2.5-Flash2025.10 | 23 | 1.915 | |
| ArtPromptInput Modality=Text-only, Target Model=GPT-4.12025.10 | 23.5 | 1.736 | |
| MM-SafetyBenchInput Modality=Multimodal, Target Model=Qwen2.5-VL2025.10 | 23.5 | 2.054 | |
| Query-AttackInput Modality=Multimodal, Target Model=Qwen2.5-VL2025.10 | 23.5 | 1.107 | |
| DRAInput Modality=Text-only, Target Model=GPT-4o2025.10 | 24 | 2.752 | |
| FigStepInput Modality=Multimodal, Target Model=Qwen2.5-VL2025.10 | 24 | 2.035 | |
| FlipAttackInput Modality=Text-only, Target Model=LLaVA-v1.62025.10 | 24.5 | 3.106 | |
| JOODInput Modality=Text-only, Target Model=Average2025.10 | 24.88 | 1.961 | |
| MM-SafetyBenchInput Modality=Multimodal, Target Model=Average2025.10 | 26.06 | 1.967 | |
| ArtPromptInput Modality=Text-only, Target Model=Average2025.10 | 26.38 | 2.092 | |
| Query-AttackInput Modality=Multimodal, Target Model=LLaVA-v1.62025.10 | 27.5 | 2.047 | |
| JOODInput Modality=Text-only, Target Model=LLaMA3.2-Vision2025.10 | 28.25 | 1.9 | |
| ArtPromptInput Modality=Text-only, Target Model=LLaMA3.2-Vision2025.10 | 29 | 1.975 | |
| JOODInput Modality=Text-only, Target Model=LLaVA-v1.52025.10 | 29.5 | 2.189 | |
| DarkCiteInput Modality=Text-only, Target Model=Claude-3-7-Sonnet2025.10 | 29.75 | 1.59 | |
| JOODInput Modality=Text-only, Target Model=GPT-4o2025.10 | 31.5 | 2.259 | |
| FigStepInput Modality=Multimodal, Target Model=Average2025.10 | 32.25 | 2.243 | |
| PolyJailbreakInput Modality=Multimodal, Target Model=Claude-3-7-Sonnet2025.10 | 34.5 | 3.179 | |
| ArtPromptInput Modality=Text-only, Target Model=Gemini-2.5-Flash2025.10 | 35.5 | 2.132 | |
| ArtPromptInput Modality=Text-only, Target Model=GPT-4o2025.10 | 35.75 | 2.207 | |
| MML-MInput Modality=Multimodal, Target Model=LLaVA-v1.62025.10 | 37.54 | 2.354 | |
| FlipAttackInput Modality=Text-only, Target Model=Claude-3-7-Sonnet2025.10 | 46 | 3.165 | |
| MML-MInput Modality=Multimodal, Target Model=LLaVA-v1.52025.10 | 46.75 | 2.81 | |
| DRAInput Modality=Text-only, Target Model=GPT-4.12025.10 | 50 | 3.684 | |
| JOODInput Modality=Text-only, Target Model=LLaVA-v1.62025.10 | 50.25 | 2.905 | |
| HadesInput Modality=Multimodal, Target Model=LLaVA-v1.62025.10 | 50.75 | 2.904 | |
| FlipAttackInput Modality=Text-only, Target Model=LLaMA3.2-Vision2025.10 | 53.5 | 3.25 | |
| FlipAttackInput Modality=Text-only, Target Model=Average2025.10 | 54.06 | 3.633 | |
| DRAInput Modality=Text-only, Target Model=Average2025.10 | 54.19 | 3.874 | |
| ArtPromptInput Modality=Text-only, Target Model=LLaVA-v1.52025.10 | 54.5 | 3.187 | |
| HadesInput Modality=Multimodal, Target Model=LLaVA-v1.52025.10 | 56.5 | 3.299 | |
| DarkCiteInput Modality=Text-only, Target Model=LLaMA3.2-Vision2025.10 | 58 | 2.385 | |
| DarkCiteInput Modality=Text-only, Target Model=Gemini-2.5-Flash2025.10 | 58.75 | 2.664 | |
| MM-SafetyBenchInput Modality=Multimodal, Target Model=LLaVA-v1.62025.10 | 62 | 3.333 | |
| FigStepInput Modality=Multimodal, Target Model=LLaMA3.2-Vision2025.10 | 62.75 | 3.28 | |
| DRAInput Modality=Text-only, Target Model=LLaVA-v1.52025.10 | 64 | 4.301 | |
| DRAInput Modality=Text-only, Target Model=Qwen2.5-VL2025.10 | 64.25 | 4.249 | |
| DarkCiteInput Modality=Text-only, Target Model=Average2025.10 | 65.19 | 2.526 | |
| DarkCiteInput Modality=Text-only, Target Model=GPT-4o2025.10 | 68 | 2.394 | |
| DRAInput Modality=Text-only, Target Model=LLaVA-v1.62025.10 | 69 | 4.389 | |
| DRAInput Modality=Text-only, Target Model=LLaMA3.2-Vision2025.10 | 71.75 | 4.463 | |
| DarkCiteInput Modality=Text-only, Target Model=LLaVA-v1.52025.10 | 71.75 | 2.709 | |
| DarkCiteInput Modality=Text-only, Target Model=GPT-4.12025.10 | 75.5 | 2.598 | |
| PolyJailbreakInput Modality=Multimodal, Target Model=LLaMA3.2-Vision2025.10 | 75.94 | 3.517 | |
| FigStepInput Modality=Multimodal, Target Model=LLaVA-v1.52025.10 | 76.25 | 4.062 | |
| MM-SafetyBenchInput Modality=Multimodal, Target Model=LLaVA-v1.52025.10 | 76.25 | 3.829 | |
| DarkCiteInput Modality=Text-only, Target Model=Qwen2.5-VL2025.10 | 77.25 | 2.937 | |
| Query-AttackInput Modality=Multimodal, Target Model=LLaVA-v1.52025.10 | 77.75 | 3.998 | |
| PolyJailbreakInput Modality=Multimodal, Target Model=Qwen2.5-VL2025.10 | 80 | 3.762 | |
| DRAInput Modality=Text-only, Target Model=Gemini-2.5-Flash2025.10 | 82.25 | 4.536 | |
| DarkCiteInput Modality=Text-only, Target Model=LLaVA-v1.62025.10 | 82.5 | 2.934 | |
| PolyJailbreakInput Modality=Multimodal, Target Model=Average2025.10 | 83.34 | 3.976 | |
| FigStepInput Modality=Multimodal, Target Model=LLaVA-v1.62025.10 | 84.5 | 4.154 | |
| PolyJailbreakInput Modality=Multimodal, Target Model=GPT-4.12025.10 | 86 | 4.118 | |
| FlipAttackInput Modality=Text-only, Target Model=GPT-4.12025.10 | 90.5 | 4.691 | |
| FlipAttackInput Modality=Text-only, Target Model=GPT-4o2025.10 | 90.75 | 4.769 | |
| FlipAttackInput Modality=Text-only, Target Model=Gemini-2.5-Flash2025.10 | 96.5 | 4.857 | |
| PolyJailbreakInput Modality=Multimodal, Target Model=LLaVA-v1.62025.10 | 97 | 4.443 | |
| PolyJailbreakInput Modality=Multimodal, Target Model=Gemini-2.5-Flash2025.10 | 97.25 | 4.343 | |
| PolyJailbreakInput Modality=Multimodal, Target Model=GPT-4o2025.10 | 97.5 | 4.28 | |
| PolyJailbreakInput Modality=Multimodal, Target Model=LLaVA-v1.52025.10 | 98.5 | 4.164 |