List your company
ResearchFormerly WizWand

Jailbreak Attack on SafeBench

0ASRArtPrompt
-1.528.741929.26Nov 30, 2024Feb 27, 2025May 27, 2025Aug 24, 2025Nov 21, 2025Feb 18, 2026May 18, 2026
Updated 5mo ago

Evaluation results

MethodLinks
ArtPromptSystem=Gemini-2.0-flash2025.120
StegoAttackTarget System=GPT-4o2025.120
StegoAttackTarget System=Gemini-2.0-pro2025.120
StegoAttackTarget System=Gemini-2.0-flash2025.120
StegoAttackTarget System=Grok-32025.120
CipherChatSystem=Gemini-2.0-pro2025.120
ArtPromptSystem=Gemini-2.0-flash2025.120
CipherChatSystem=Gemini-2.0-flash2025.122
VAESystem=Gemini-2.0-pro2025.124
CipherChatSystem=Gemini-2.0-flash2025.124
CipherChatSystem=GPT-4o2025.126
FigStep-proSystem=Gemini-2.0-flash2025.126
HADESSystem=Gemini-2.0-flash2025.126
CipherChatSystem=GPT-4o2025.126
VAESystem=Gemini-2.0-pro2025.129
CS-DJTarget Model=GPT-52026.0510.2
FigStepTarget Model=GPT-52026.0511.6
HADESSystem=Gemini-2.0-flash2025.1212
FigStepTarget Model=o32026.0512.2
FigStepTarget Model=o4-mini2026.0513
FigStepTarget Model=Claude Sonnet 42026.0513
FigStep-proSystem=GPT-4o2025.1216
ArtPromptSystem=Gemini-2.0-pro2025.1216
UMKSystem=Gemini-2.0-flash2025.1216
FigStepTarget Model=Claude-3.5-Sonnet, System Prompt=None2024.1116.6
CS-DJTarget Model=o32026.0517
OdysseusSystem=GPT-4o2025.1218
FigStepTarget Model=GPT-4V2026.0518.2
FigStepTarget Model=Gemini-2.5-pro2026.0518.8
QueryRelatedTarget Model=Claude-3.5-Sonnet, System Prompt=None2024.1119.4
UJASource Model=InternVL3.5, Target Model=Qwen2.5-VL2026.0519.69
FigStepTarget Model=GPT-4o2026.0519.8
HADESSystem=Gemini-2.0-pro2025.1220
MM-SafetyBenchSystem=Gemini-2.0-flash2025.1220
FigStepTarget Model=Qwen3-VL-plus2026.0520.2
FigStepTarget Model=Average2026.0520.22
UJADefense Strategy=UniGuard, Evaluation Protocol=three-judge intersection, Perturbation budget=l-infinity, epsilon = 8/2552026.0521.3
FigStepTarget Model=Seed1.5-VL2026.0522
MMLTarget Model=Claude-3.5-Sonnet, Encryption=Base64 Encoding, System Prompt=None2024.1122.4
UJASource Model=Qwen2.5-VL, Target Model=InternVL3.52026.0522.76
FigStepSource Model=InternVL3.5, Target Model=Qwen2.5-VL2026.0523.39
ForceSource Model=InternVL3.5, Target Model=Qwen2.5-VL2026.0523.85
MM-SafetyBenchSystem=Gemini-2.0-pro2025.1224
VAESystem=Gemini-2.0-flash2025.1224
HADESSystem=Gemini-2.0-pro2025.1224
UJADefense Strategy=R-TOFU, Evaluation Protocol=three-judge intersection, Perturbation budget=l-infinity, epsilon = 8/2552026.0524.5
FigStepSource Model=Qwen2.5-VL, Target Model=InternVL3.52026.0525.89
MM-SafetyBenchSystem=GPT-4o2025.1226
MM-SafetyBenchSystem=Grok-32025.1226
UMKSystem=Gemini-2.0-flash2025.1226
UJASource Model=Qwen2.5-VL, Target Model=LLaVA-1.52026.0526.18
CS-DJTarget Model=Qwen3-VL-plus2026.0526.2
FigStepSource Model=InternVL3.5, Target Model=LLaVA-1.52026.0526.51
SEASource Model=InternVL3.5, Target Model=Qwen2.5-VL2026.0526.51
UJASource Model=InternVL3.5, Target Model=LLaVA-1.52026.0526.87
ForceSource Model=Qwen2.5-VL, Target Model=InternVL3.52026.0526.93
CS-DJTarget Model=Seed1.5-VL2026.0527
FigStepDefense Strategy=UniGuard, Evaluation Protocol=three-judge intersection, Perturbation budget=l-infinity, epsilon = 8/2552026.0527.1
QueryRelatedTarget Model=GPT-4o, System Prompt=None2024.1127.2
CS-DJTarget Model=Gemini-2.5-pro2026.0527.2
HIMRDSystem=GPT-4o2025.1228
Text-onlyModel=Janus2026.0329
SEASource Model=Qwen2.5-VL, Target Model=InternVL3.52026.0529.01
UJEMSource Model=InternVL3.5, Target Model=Qwen2.5-VL2026.0529.36
UJASource Model=LLaVA-1.5, Target Model=InternVL3.52026.0529.51
UMKSystem=Gemini-2.0-pro2025.1230
ArtPromptSystem=Gemini-2.0-pro2025.1230
FigStep-proSystem=Gemini-2.0-flash2025.1230
CS-DJTarget Model=Average2026.0530.18
ForceSource Model=Qwen2.5-VL, Target Model=LLaVA-1.52026.0530.76
FigStepDefense Strategy=R-TOFU, Evaluation Protocol=three-judge intersection, Perturbation budget=l-infinity, epsilon = 8/2552026.0530.8
UJEMDefense Strategy=UniGuard, Evaluation Protocol=three-judge intersection, Perturbation budget=l-infinity, epsilon = 8/2552026.0530.9
FigStepSource Model=Qwen2.5-VL, Target Model=LLaVA-1.52026.0531.23
ForceSource Model=InternVL3.5, Target Model=LLaVA-1.52026.0531.66
HADESSystem=GPT-4o2025.1232
ArtPromptSystem=GPT-4o2025.1232
FigStep-proSystem=Gemini-2.0-pro2025.1232
HIMRDSystem=GPT-4o2025.1232
QueryRelatedTarget Model=GPT-4o-Mini, System Prompt=None2024.1132.2
ForceDefense Strategy=UniGuard, Evaluation Protocol=three-judge intersection, Perturbation budget=l-infinity, epsilon = 8/2552026.0532.4
UJEM-KLDefense Strategy=UniGuard, Evaluation Protocol=three-judge intersection, Perturbation budget=l-infinity, epsilon = 8/2552026.0532.7
UJEMSource Model=Qwen2.5-VL, Target Model=InternVL3.52026.0532.74
FigStepSource Model=LLaVA-1.5, Target Model=InternVL3.52026.0532.86
FigStepTarget Model=GPT-4o, System Prompt=None2024.1133
SEASource Model=Qwen2.5-VL, Target Model=LLaVA-1.52026.0533.36
SEADefense Strategy=UniGuard, Evaluation Protocol=three-judge intersection, Perturbation budget=l-infinity, epsilon = 8/2552026.0533.8
CS-DJTarget Model=Gemini-2.5-flash2026.0533.8
ForceSource Model=LLaVA-1.5, Target Model=InternVL3.52026.0533.98
ArtPromptSystem=Grok-32025.1234
VAESystem=Gemini-2.0-flash2025.1234
PAIRModel=Janus2026.0334
SEASource Model=InternVL3.5, Target Model=LLaVA-1.52026.0535.82
UJEMSource Model=Qwen2.5-VL, Target Model=LLaVA-1.52026.0536.09
UJEMDefense Strategy=R-TOFU, Evaluation Protocol=three-judge intersection, Perturbation budget=l-infinity, epsilon = 8/2552026.0536.1
UJASource Model=LLaVA-1.5, Target Model=Qwen2.5-VL2026.0536.97
CS-DJTarget Model=o4-mini2026.0537.4
UJEM-KLSource Model=InternVL3.5, Target Model=Qwen2.5-VL2026.0537.54
GCGModel=Janus2026.0337.6
UMKSystem=GPT-4o2025.1238
UMKSystem=Gemini-2.0-pro2025.1238