# Jailbreaking MLLMs on AdvBench Source: [Jailbreaking MLLMs on AdvBench]() Collection index: [llms.txt]() Data updated: 2026-05-19T09:31:56.632Z Evaluation of Multi-Modal Large Language Model (MLLM) susceptibility to jailbreaking prompts using the AdvBench dataset, measured by WASR and W-Toxicity Score. A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. | Scope | Recorded value | | --- | --- | | Task | Jailbreaking MLLMs | | Dataset (including any stated split) | AdvBench | | Metric | WASR | | Unit | PERCENT | | Direction | Higher is better | | Results loaded | 32 of 32 | | Coverage | All results currently returned for this benchmark | Evaluation settings may differ between results. The original papers and recorded configurations are needed to establish comparability. A shared metric name alone does not establish an identical protocol. ## Metrics - [WASR](): Higher is better; unit: PERCENT. - [W-Toxicity Score](): Lower is better; unit: SCALAR. ## Recorded results | Method | WASR | Result date | Report paper | | --- | --- | --- | --- | | wide-net-casting jailbreak method | 100 | Not recorded | 6a0beec1dbc836b87d82c63a | | Ours (Wide-Net-Casting) | 99.6 | Not recorded | 6a0beec1dbc836b87d82c63a | | Naive Strategy 2 | 95.8 | Not recorded | 6a0beec1dbc836b87d82c63a | | Naive Strategy 1 | 95.5 | Not recorded | 6a0beec1dbc836b87d82c63a | | Naive Strategy 2 | 93.6 | Not recorded | 6a0beec1dbc836b87d82c63a | | MLAI+PixArt-α | 93.3 | Not recorded | 6a0beec1dbc836b87d82c63a | | Naive Strategy 1 | 92.4 | Not recorded | 6a0beec1dbc836b87d82c63a | | Baseline (MLAI + PixArt-α) | 89.4 | Not recorded | 6a0beec1dbc836b87d82c63a | | wide-net-casting jailbreak method | 50.8 | Not recorded | 6a0beec1dbc836b87d82c63a | | wide-net-casting jailbreak method | 47.8 | Not recorded | 6a0beec1dbc836b87d82c63a | | Ours (Wide-Net-Casting) | 46.2 | Not recorded | 6a0beec1dbc836b87d82c63a | | Ours (Wide-Net-Casting) | 44.2 | Not recorded | 6a0beec1dbc836b87d82c63a | | wide-net-casting jailbreak method | 42 | Not recorded | 6a0beec1dbc836b87d82c63a | | Naive Strategy 2 | 41.1 | Not recorded | 6a0beec1dbc836b87d82c63a | | Ours (Wide-Net-Casting) | 40.6 | Not recorded | 6a0beec1dbc836b87d82c63a | | Naive Strategy 1 | 40.6 | Not recorded | 6a0beec1dbc836b87d82c63a | | Naive Strategy 2 | 39.4 | Not recorded | 6a0beec1dbc836b87d82c63a | | Naive Strategy 1 | 38.6 | Not recorded | 6a0beec1dbc836b87d82c63a | | MLAI+PixArt-α | 37.5 | Not recorded | 6a0beec1dbc836b87d82c63a | | MLAI+PixArt-α | 36.9 | Not recorded | 6a0beec1dbc836b87d82c63a | | Naive Strategy 2 | 35.5 | Not recorded | 6a0beec1dbc836b87d82c63a | | Naive Strategy 1 | 34.7 | Not recorded | 6a0beec1dbc836b87d82c63a | | Naive Strategy 2 | 34.4 | Not recorded | 6a0beec1dbc836b87d82c63a | | Naive Strategy 2 | 33.9 | Not recorded | 6a0beec1dbc836b87d82c63a | | Naive Strategy 1 | 33.8 | Not recorded | 6a0beec1dbc836b87d82c63a | | Naive Strategy 1 | 33.2 | Not recorded | 6a0beec1dbc836b87d82c63a | | Naive Strategy 2 | 32.7 | Not recorded | 6a0beec1dbc836b87d82c63a | | Baseline (MLAI + PixArt-α) | 32.3 | Not recorded | 6a0beec1dbc836b87d82c63a | | Naive Strategy 1 | 32 | Not recorded | 6a0beec1dbc836b87d82c63a | | Baseline (MLAI + PixArt-α) | 31.5 | Not recorded | 6a0beec1dbc836b87d82c63a | | MLAI+PixArt-α | 30.7 | Not recorded | 6a0beec1dbc836b87d82c63a | | Baseline (MLAI + PixArt-α) | 28.1 | Not recorded | 6a0beec1dbc836b87d82c63a | ### wide-net-casting jailbreak method WASR: 100. Result ID: 6a0c2d63fbc373592c0295b5. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment":"Original Safety Alignment"}. This record does not assert independent reproduction. ### Ours (Wide-Net-Casting) WASR: 99.6. Result ID: 6a0c2d63fbc373592c02957f. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment Strategy":"Original Safety Alignment"}. This record does not assert independent reproduction. ### Naive Strategy 2 WASR: 95.8. Result ID: 6a0c2d63fbc373592c0295b1. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment":"Original Safety Alignment"}. This record does not assert independent reproduction. ### Naive Strategy 1 WASR: 95.5. Result ID: 6a0c2d63fbc373592c0295ad. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment":"Original Safety Alignment"}. This record does not assert independent reproduction. ### Naive Strategy 2 WASR: 93.6. Result ID: 6a0c2d63fbc373592c02957b. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment Strategy":"Original Safety Alignment"}. This record does not assert independent reproduction. ### MLAI+PixArt-α WASR: 93.3. Result ID: 6a0c2d63fbc373592c0295a9. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment":"Original Safety Alignment"}. This record does not assert independent reproduction. ### Naive Strategy 1 WASR: 92.4. Result ID: 6a0c2d63fbc373592c029577. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment Strategy":"Original Safety Alignment"}. This record does not assert independent reproduction. ### Baseline (MLAI + PixArt-α) WASR: 89.4. Result ID: 6a0c2d63fbc373592c029573. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment Strategy":"Original Safety Alignment"}. This record does not assert independent reproduction. ### wide-net-casting jailbreak method WASR: 50.8. Result ID: 6a0c2d63fbc373592c0295b6. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment":"Original Safety Alignment + VLGuard"}. This record does not assert independent reproduction. ### wide-net-casting jailbreak method WASR: 47.8. Result ID: 6a0c2d63fbc373592c0295b7. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment":"Original Safety Alignment + IMMUNE"}. This record does not assert independent reproduction. ### Ours (Wide-Net-Casting) WASR: 46.2. Result ID: 6a0c2d63fbc373592c029580. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment Strategy":"Original Safety Alignment + VLGuard"}. This record does not assert independent reproduction. ### Ours (Wide-Net-Casting) WASR: 44.2. Result ID: 6a0c2d63fbc373592c029581. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment Strategy":"Original Safety Alignment + IMMUNE"}. This record does not assert independent reproduction. ### wide-net-casting jailbreak method WASR: 42. Result ID: 6a0c2d63fbc373592c0295b8. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment":"Original Safety Alignment + ASTRA"}. This record does not assert independent reproduction. ### Naive Strategy 2 WASR: 41.1. Result ID: 6a0c2d63fbc373592c0295b2. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment":"Original Safety Alignment + VLGuard"}. This record does not assert independent reproduction. ### Ours (Wide-Net-Casting) WASR: 40.6. Result ID: 6a0c2d63fbc373592c029582. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment Strategy":"Original Safety Alignment + ASTRA"}. This record does not assert independent reproduction. ### Naive Strategy 1 WASR: 40.6. Result ID: 6a0c2d63fbc373592c0295ae. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment":"Original Safety Alignment + VLGuard"}. This record does not assert independent reproduction. ### Naive Strategy 2 WASR: 39.4. Result ID: 6a0c2d63fbc373592c0295b3. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment":"Original Safety Alignment + IMMUNE"}. This record does not assert independent reproduction. ### Naive Strategy 1 WASR: 38.6. Result ID: 6a0c2d63fbc373592c0295af. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment":"Original Safety Alignment + IMMUNE"}. This record does not assert independent reproduction. ### MLAI+PixArt-α WASR: 37.5. Result ID: 6a0c2d63fbc373592c0295aa. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment":"Original Safety Alignment + VLGuard"}. This record does not assert independent reproduction. ### MLAI+PixArt-α WASR: 36.9. Result ID: 6a0c2d63fbc373592c0295ab. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment":"Original Safety Alignment + IMMUNE"}. This record does not assert independent reproduction. ### Naive Strategy 2 WASR: 35.5. Result ID: 6a0c2d63fbc373592c02957c. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment Strategy":"Original Safety Alignment + VLGuard"}. This record does not assert independent reproduction. ### Naive Strategy 1 WASR: 34.7. Result ID: 6a0c2d63fbc373592c029578. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment Strategy":"Original Safety Alignment + VLGuard"}. This record does not assert independent reproduction. ### Naive Strategy 2 WASR: 34.4. Result ID: 6a0c2d63fbc373592c02957d. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment Strategy":"Original Safety Alignment + IMMUNE"}. This record does not assert independent reproduction. ### Naive Strategy 2 WASR: 33.9. Result ID: 6a0c2d63fbc373592c0295b4. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment":"Original Safety Alignment + ASTRA"}. This record does not assert independent reproduction. ### Naive Strategy 1 WASR: 33.8. Result ID: 6a0c2d63fbc373592c029579. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment Strategy":"Original Safety Alignment + IMMUNE"}. This record does not assert independent reproduction. ### Naive Strategy 1 WASR: 33.2. Result ID: 6a0c2d63fbc373592c0295b0. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment":"Original Safety Alignment + ASTRA"}. This record does not assert independent reproduction. ### Naive Strategy 2 WASR: 32.7. Result ID: 6a0c2d63fbc373592c02957e. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment Strategy":"Original Safety Alignment + ASTRA"}. This record does not assert independent reproduction. ### Baseline (MLAI + PixArt-α) WASR: 32.3. Result ID: 6a0c2d63fbc373592c029574. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment Strategy":"Original Safety Alignment + VLGuard"}. This record does not assert independent reproduction. ### Naive Strategy 1 WASR: 32. Result ID: 6a0c2d63fbc373592c02957a. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment Strategy":"Original Safety Alignment + ASTRA"}. This record does not assert independent reproduction. ### Baseline (MLAI + PixArt-α) WASR: 31.5. Result ID: 6a0c2d63fbc373592c029575. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment Strategy":"Original Safety Alignment + IMMUNE"}. This record does not assert independent reproduction. ### MLAI+PixArt-α WASR: 30.7. Result ID: 6a0c2d63fbc373592c0295ac. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment":"Original Safety Alignment + ASTRA"}. This record does not assert independent reproduction. ### Baseline (MLAI + PixArt-α) WASR: 28.1. Result ID: 6a0c2d63fbc373592c029576. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment Strategy":"Original Safety Alignment + ASTRA"}. This record does not assert independent reproduction. Page 1 of 1. This is an index page, not the full collection.