Jailbreak Attack Success Rate on VAJA
92.3Identity Attack Success RateZO-SPSA
Evaluation results
| Method | Links | ||||
|---|---|---|---|---|---|
| ZO-SPSAVictim Model=MiniGPT-4, Input=adv. image (ε = 64/255)2026.01 | 92.3 | 100 | 80 | 49.6 | |
| ZO-SPSAVictim Model=InstructBLIP, Input=adv. image (unconstrained)2026.01 | 80 | 90 | 93.8 | 80 | |
| ZO-SPSAVictim Model=MiniGPT-4, Input=adv. image (unconstrained)2026.01 | 80 | 90 | 80 | 60 | |
| ZO-SPSAVictim Model=InstructBLIP, Input=adv. image (ε = 64/255)2026.01 | 75 | 80 | 81.3 | 60 | |
| ZO-SPSAVictim Model=LLaVA, Input=adv. image (unconstrained)2026.01 | 70 | 60 | 90 | 70 | |
| ZO-SPSAVictim Model=InstructBLIP, Input=adv. image (ε = 32/255)2026.01 | 65 | 70 | 87.5 | 80 | |
| ZO-SPSAVictim Model=MiniGPT-4, Input=adv. image (ε = 32/255)2026.01 | 61.5 | 71.4 | 80 | 50 | |
| ZO-SPSAVictim Model=InstructBLIP, Input=adv. image (ε = 16/255)2026.01 | 55 | 60 | 75 | 60 | |
| ZO-SPSAVictim Model=MiniGPT-4, Input=adv. image (ε = 16/255)2026.01 | 50 | 60 | 80 | 50 | |
| ZO-SPSAVictim Model=LLaVA, Input=adv. image (ε = 64/255)2026.01 | 40 | 66.7 | 80 | 50 | |
| ZO-SPSAVictim Model=LLaVA, Input=adv. image (ε = 32/255)2026.01 | 36 | 60 | 67.5 | 45.7 | |
| ZO-SPSAVictim Model=LLaVA, Input=adv. image (ε = 16/255)2026.01 | 34 | 55 | 62.5 | 44.4 | |
| No AttackVictim Model=MiniGPT-4, Input=benign image (no attack)2026.01 | 26.2 | 48.9 | 50.1 | 20 | |
| No AttackVictim Model=LLaVA, Input=benign image (no attack)2026.01 | 12.2 | 40 | 15.4 | 44 | |
| No AttackVictim Model=InstructBLIP, Input=benign image (no attack)2026.01 | 5 | 30 | 12.5 | 40 |