Jailbreak Attack on SafeBench
0ASRArtPrompt
Evaluation Results
| Method | Links | |
|---|---|---|
| ArtPromptSystem=Gemini-2.0-flash2025.12 | 0 | |
| StegoAttackTarget System=GPT-4o2025.12 | 0 | |
| StegoAttackTarget System=Gemini-2.0-pro2025.12 | 0 | |
| StegoAttackTarget System=Gemini-2.0-flash2025.12 | 0 | |
| StegoAttackTarget System=Grok-32025.12 | 0 | |
| CipherChatSystem=Gemini-2.0-pro2025.12 | 0 | |
| ArtPromptSystem=Gemini-2.0-flash2025.12 | 0 | |
| CipherChatSystem=Gemini-2.0-flash2025.12 | 2 | |
| VAESystem=Gemini-2.0-pro2025.12 | 4 | |
| CipherChatSystem=Gemini-2.0-flash2025.12 | 4 | |
| CipherChatSystem=GPT-4o2025.12 | 6 | |
| FigStep-proSystem=Gemini-2.0-flash2025.12 | 6 | |
| HADESSystem=Gemini-2.0-flash2025.12 | 6 | |
| CipherChatSystem=GPT-4o2025.12 | 6 | |
| VAESystem=Gemini-2.0-pro2025.12 | 9 | |
| CS-DJTarget Model=GPT-52026.05 | 10.2 | |
| FigStepTarget Model=GPT-52026.05 | 11.6 | |
| HADESSystem=Gemini-2.0-flash2025.12 | 12 | |
| FigStepTarget Model=o32026.05 | 12.2 | |
| FigStepTarget Model=o4-mini2026.05 | 13 | |
| FigStepTarget Model=Claude Sonnet 42026.05 | 13 | |
| FigStep-proSystem=GPT-4o2025.12 | 16 | |
| ArtPromptSystem=Gemini-2.0-pro2025.12 | 16 | |
| UMKSystem=Gemini-2.0-flash2025.12 | 16 | |
| FigStepTarget Model=Claude-3.5-Sonnet, System Prompt=None2024.11 | 16.6 | |
| CS-DJTarget Model=o32026.05 | 17 | |
| OdysseusSystem=GPT-4o2025.12 | 18 | |
| FigStepTarget Model=GPT-4V2026.05 | 18.2 | |
| FigStepTarget Model=Gemini-2.5-pro2026.05 | 18.8 | |
| QueryRelatedTarget Model=Claude-3.5-Sonnet, System Prompt=None2024.11 | 19.4 | |
| UJASource Model=InternVL3.5, Target Model=Qwen2.5-VL2026.05 | 19.69 | |
| FigStepTarget Model=GPT-4o2026.05 | 19.8 | |
| HADESSystem=Gemini-2.0-pro2025.12 | 20 | |
| MM-SafetyBenchSystem=Gemini-2.0-flash2025.12 | 20 | |
| FigStepTarget Model=Qwen3-VL-plus2026.05 | 20.2 | |
| FigStepTarget Model=Average2026.05 | 20.22 | |
| UJADefense Strategy=UniGuard, Evaluation Protocol=three-judge intersection, Perturbation budget=l-infinity, epsilon = 8/2552026.05 | 21.3 | |
| FigStepTarget Model=Seed1.5-VL2026.05 | 22 | |
| MMLTarget Model=Claude-3.5-Sonnet, Encryption=Base64 Encoding, System Prompt=None2024.11 | 22.4 | |
| UJASource Model=Qwen2.5-VL, Target Model=InternVL3.52026.05 | 22.76 | |
| FigStepSource Model=InternVL3.5, Target Model=Qwen2.5-VL2026.05 | 23.39 | |
| ForceSource Model=InternVL3.5, Target Model=Qwen2.5-VL2026.05 | 23.85 | |
| MM-SafetyBenchSystem=Gemini-2.0-pro2025.12 | 24 | |
| VAESystem=Gemini-2.0-flash2025.12 | 24 | |
| HADESSystem=Gemini-2.0-pro2025.12 | 24 | |
| UJADefense Strategy=R-TOFU, Evaluation Protocol=three-judge intersection, Perturbation budget=l-infinity, epsilon = 8/2552026.05 | 24.5 | |
| FigStepSource Model=Qwen2.5-VL, Target Model=InternVL3.52026.05 | 25.89 | |
| MM-SafetyBenchSystem=GPT-4o2025.12 | 26 | |
| MM-SafetyBenchSystem=Grok-32025.12 | 26 | |
| UMKSystem=Gemini-2.0-flash2025.12 | 26 | |
| UJASource Model=Qwen2.5-VL, Target Model=LLaVA-1.52026.05 | 26.18 | |
| CS-DJTarget Model=Qwen3-VL-plus2026.05 | 26.2 | |
| FigStepSource Model=InternVL3.5, Target Model=LLaVA-1.52026.05 | 26.51 | |
| SEASource Model=InternVL3.5, Target Model=Qwen2.5-VL2026.05 | 26.51 | |
| UJASource Model=InternVL3.5, Target Model=LLaVA-1.52026.05 | 26.87 | |
| ForceSource Model=Qwen2.5-VL, Target Model=InternVL3.52026.05 | 26.93 | |
| CS-DJTarget Model=Seed1.5-VL2026.05 | 27 | |
| FigStepDefense Strategy=UniGuard, Evaluation Protocol=three-judge intersection, Perturbation budget=l-infinity, epsilon = 8/2552026.05 | 27.1 | |
| QueryRelatedTarget Model=GPT-4o, System Prompt=None2024.11 | 27.2 | |
| CS-DJTarget Model=Gemini-2.5-pro2026.05 | 27.2 | |
| HIMRDSystem=GPT-4o2025.12 | 28 | |
| Text-onlyModel=Janus2026.03 | 29 | |
| SEASource Model=Qwen2.5-VL, Target Model=InternVL3.52026.05 | 29.01 | |
| UJEMSource Model=InternVL3.5, Target Model=Qwen2.5-VL2026.05 | 29.36 | |
| UJASource Model=LLaVA-1.5, Target Model=InternVL3.52026.05 | 29.51 | |
| UMKSystem=Gemini-2.0-pro2025.12 | 30 | |
| ArtPromptSystem=Gemini-2.0-pro2025.12 | 30 | |
| FigStep-proSystem=Gemini-2.0-flash2025.12 | 30 | |
| CS-DJTarget Model=Average2026.05 | 30.18 | |
| ForceSource Model=Qwen2.5-VL, Target Model=LLaVA-1.52026.05 | 30.76 | |
| FigStepDefense Strategy=R-TOFU, Evaluation Protocol=three-judge intersection, Perturbation budget=l-infinity, epsilon = 8/2552026.05 | 30.8 | |
| UJEMDefense Strategy=UniGuard, Evaluation Protocol=three-judge intersection, Perturbation budget=l-infinity, epsilon = 8/2552026.05 | 30.9 | |
| FigStepSource Model=Qwen2.5-VL, Target Model=LLaVA-1.52026.05 | 31.23 | |
| ForceSource Model=InternVL3.5, Target Model=LLaVA-1.52026.05 | 31.66 | |
| HADESSystem=GPT-4o2025.12 | 32 | |
| ArtPromptSystem=GPT-4o2025.12 | 32 | |
| FigStep-proSystem=Gemini-2.0-pro2025.12 | 32 | |
| HIMRDSystem=GPT-4o2025.12 | 32 | |
| QueryRelatedTarget Model=GPT-4o-Mini, System Prompt=None2024.11 | 32.2 | |
| ForceDefense Strategy=UniGuard, Evaluation Protocol=three-judge intersection, Perturbation budget=l-infinity, epsilon = 8/2552026.05 | 32.4 | |
| UJEM-KLDefense Strategy=UniGuard, Evaluation Protocol=three-judge intersection, Perturbation budget=l-infinity, epsilon = 8/2552026.05 | 32.7 | |
| UJEMSource Model=Qwen2.5-VL, Target Model=InternVL3.52026.05 | 32.74 | |
| FigStepSource Model=LLaVA-1.5, Target Model=InternVL3.52026.05 | 32.86 | |
| FigStepTarget Model=GPT-4o, System Prompt=None2024.11 | 33 | |
| SEASource Model=Qwen2.5-VL, Target Model=LLaVA-1.52026.05 | 33.36 | |
| SEADefense Strategy=UniGuard, Evaluation Protocol=three-judge intersection, Perturbation budget=l-infinity, epsilon = 8/2552026.05 | 33.8 | |
| CS-DJTarget Model=Gemini-2.5-flash2026.05 | 33.8 | |
| ForceSource Model=LLaVA-1.5, Target Model=InternVL3.52026.05 | 33.98 | |
| ArtPromptSystem=Grok-32025.12 | 34 | |
| VAESystem=Gemini-2.0-flash2025.12 | 34 | |
| PAIRModel=Janus2026.03 | 34 | |
| SEASource Model=InternVL3.5, Target Model=LLaVA-1.52026.05 | 35.82 | |
| UJEMSource Model=Qwen2.5-VL, Target Model=LLaVA-1.52026.05 | 36.09 | |
| UJEMDefense Strategy=R-TOFU, Evaluation Protocol=three-judge intersection, Perturbation budget=l-infinity, epsilon = 8/2552026.05 | 36.1 | |
| UJASource Model=LLaVA-1.5, Target Model=Qwen2.5-VL2026.05 | 36.97 | |
| CS-DJTarget Model=o4-mini2026.05 | 37.4 | |
| UJEM-KLSource Model=InternVL3.5, Target Model=Qwen2.5-VL2026.05 | 37.54 | |
| GCGModel=Janus2026.03 | 37.6 | |
| UMKSystem=GPT-4o2025.12 | 38 | |
| UMKSystem=Gemini-2.0-pro2025.12 | 38 |