Jailbreak Attack on SafeBench (HF and ASR)
1.7HFFigStep-Pro
Evaluation results
| Method | Links | ||
|---|---|---|---|
| FigStep-ProTarget Model=GPT-4o2026.03 | 1.7 | 4.9 | |
| SI-AttackTarget Model=GPT-4o2026.03 | 2 | 17.7 | |
| VanillaTarget Model=Qwen3-VL-Flash2026.03 | 2.5 | 0.9 | |
| VanillaTarget Model=Qwen2.5VL-7B2026.03 | 2.5 | 1.1 | |
| VanillaTarget Model=Gemini-2.0-Flash2026.03 | 2.6 | 1.1 | |
| VanillaTarget Model=GPT-4o2026.03 | 2.8 | 2 | |
| FigStepTarget Model=GPT-4o2026.03 | 2.9 | 6.3 | |
| VanillaTarget Model=Gemini-2.5-Flash2026.03 | 3 | 1.7 | |
| JOODTarget Model=GPT-4o2026.03 | 3.2 | 11.4 | |
| SI-AttackTarget Model=Gemini-2.0-Flash2026.03 | 3.7 | 51.4 | |
| HADESTarget Model=Qwen3-VL-Flash2026.03 | 3.8 | 5.4 | |
| SI-AttackTarget Model=Qwen2.5VL-7B2026.03 | 3.8 | 7.1 | |
| JOODTarget Model=Gemini-2.5-Flash2026.03 | 4 | 19.7 | |
| VanillaTarget Model=InternVL-3-9B2026.03 | 4 | 16.3 | |
| JOODTarget Model=Qwen3-VL-Flash2026.03 | 4.1 | 13.7 | |
| SI-AttackTarget Model=Qwen3-VL-Flash2026.03 | 4.3 | 24.6 | |
| SI-AttackTarget Model=InternVL-3-9B2026.03 | 4.3 | 35.7 | |
| HADESTarget Model=GPT-4o2026.03 | 4.4 | 20.6 | |
| FigStepTarget Model=Gemini-2.5-Flash2026.03 | 4.5 | 20.9 | |
| HADESTarget Model=Gemini-2.0-Flash2026.03 | 4.6 | 34 | |
| JOODTarget Model=Gemini-2.0-Flash2026.03 | 4.6 | 36.3 | |
| SI-AttackTarget Model=Gemini-2.5-Flash2026.03 | 4.6 | 28.6 | |
| FigStepTarget Model=Qwen3-VL-Flash2026.03 | 4.7 | 26.9 | |
| FigStepTarget Model=Qwen2.5VL-7B2026.03 | 4.7 | 46.6 | |
| HADESTarget Model=Gemini-2.5-Flash2026.03 | 4.8 | 25.4 | |
| FigStep-ProTarget Model=Gemini-2.5-Flash2026.03 | 4.9 | 34.4 | |
| FigStep-ProTarget Model=Qwen3-VL-Flash2026.03 | 5.2 | 38.9 | |
| FigStep-ProTarget Model=Qwen2.5VL-7B2026.03 | 5.4 | 52.9 | |
| HADESTarget Model=InternVL-3-9B2026.03 | 5.4 | 41.1 | |
| StructAttack (v3)Target Model=InternVL-3-9B2026.03 | 5.4 | 60.6 | |
| StructAttack (v3)Target Model=Qwen2.5VL-7B2026.03 | 5.6 | 74 | |
| JOODTarget Model=Qwen2.5VL-7B2026.03 | 5.8 | 40.6 | |
| HADESTarget Model=Qwen2.5VL-7B2026.03 | 5.9 | 36 | |
| FigStep-ProTarget Model=InternVL-3-9B2026.03 | 5.9 | 65.1 | |
| FigStepTarget Model=Gemini-2.0-Flash2026.03 | 6 | 51.4 | |
| StructAttack (v2)Target Model=Gemini-2.5-Flash2026.03 | 6 | 54 | |
| StructAttack (v2)Target Model=GPT-4o2026.03 | 6.1 | 55.7 | |
| StructAttack (v1)Target Model=Qwen2.5VL-7B2026.03 | 6.1 | 77.7 | |
| StructAttack (v2)Target Model=Qwen2.5VL-7B2026.03 | 6.1 | 80.6 | |
| JOODTarget Model=InternVL-3-9B2026.03 | 6.1 | 56.3 | |
| StructAttack (v2)Target Model=InternVL-3-9B2026.03 | 6.1 | 70.9 | |
| StructAttack (v1)Target Model=GPT-4o2026.03 | 6.3 | 56 | |
| StructAttack (v2)Target Model=Gemini-2.0-Flash2026.03 | 6.3 | 60 | |
| StructAttack (v1)Target Model=InternVL-3-9B2026.03 | 6.3 | 74.6 | |
| StructAttack (v3)Target Model=GPT-4o2026.03 | 6.4 | 56 | |
| StructAttack (v1)Target Model=Gemini-2.0-Flash2026.03 | 6.4 | 67.7 | |
| StructAttack (v1)Target Model=Gemini-2.5-Flash2026.03 | 6.4 | 50.9 | |
| StructAttack (v3)Target Model=Gemini-2.5-Flash2026.03 | 6.4 | 52.3 | |
| FigStepTarget Model=InternVL-3-9B2026.03 | 6.4 | 54 | |
| StructAttack (v3)Target Model=Gemini-2.0-Flash2026.03 | 6.5 | 59.7 | |
| StructAttack (v2)Target Model=Qwen3-VL-Flash2026.03 | 6.8 | 54 | |
| FigStep-ProTarget Model=Gemini-2.0-Flash2026.03 | 7 | 63.1 | |
| StructAttack (v1)Target Model=Qwen3-VL-Flash2026.03 | 7 | 56 | |
| StructAttack (v3)Target Model=Qwen3-VL-Flash2026.03 | 7 | 56.9 |