# Jailbreaking MLLMs on MM-SafetyBench Source: [Jailbreaking MLLMs on MM-SafetyBench]() Collection index: [llms.txt]() Data updated: 2026-05-19T09:31:56.669Z Evaluation of model susceptibility to jailbreaking attacks on the MM-SafetyBench dataset, measured by WASR and W-Toxicity Score. A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. | Scope | Recorded value | | --- | --- | | Task | Jailbreaking MLLMs | | Dataset (including any stated split) | MM-SafetyBench | | Metric | WASR | | Unit | PERCENT | | Direction | Higher is better | | Results loaded | 32 of 32 | | Coverage | All results currently returned for this benchmark | Evaluation settings may differ between results. The original papers and recorded configurations are needed to establish comparability. A shared metric name alone does not establish an identical protocol. ## Metrics - [WASR](): Higher is better; unit: PERCENT. - [W-Toxicity Score](): Higher is better; unit: SCALAR. ## Recorded results | Method | WASR | Result date | Report paper | | --- | --- | --- | --- | | Ours (Wide-Net-Casting) | 100 | Not recorded | 6a0beec1dbc836b87d82c63a | | wide-net-casting jailbreak method | 100 | Not recorded | 6a0beec1dbc836b87d82c63a | | Naive Strategy 2 | 95.1 | Not recorded | 6a0beec1dbc836b87d82c63a | | Naive Strategy 1 | 94.9 | Not recorded | 6a0beec1dbc836b87d82c63a | | Naive Strategy 2 | 93.7 | Not recorded | 6a0beec1dbc836b87d82c63a | | MLAI+PixArt-α | 93.7 | Not recorded | 6a0beec1dbc836b87d82c63a | | Naive Strategy 1 | 93 | Not recorded | 6a0beec1dbc836b87d82c63a | | Baseline (MLAI + PixArt-α) | 89.9 | Not recorded | 6a0beec1dbc836b87d82c63a | | wide-net-casting jailbreak method | 53.5 | Not recorded | 6a0beec1dbc836b87d82c63a | | wide-net-casting jailbreak method | 50.1 | Not recorded | 6a0beec1dbc836b87d82c63a | | Ours (Wide-Net-Casting) | 47.6 | Not recorded | 6a0beec1dbc836b87d82c63a | | Ours (Wide-Net-Casting) | 46.7 | Not recorded | 6a0beec1dbc836b87d82c63a | | Naive Strategy 2 | 44.1 | Not recorded | 6a0beec1dbc836b87d82c63a | | wide-net-casting jailbreak method | 43.6 | Not recorded | 6a0beec1dbc836b87d82c63a | | Naive Strategy 1 | 43.4 | Not recorded | 6a0beec1dbc836b87d82c63a | | Ours (Wide-Net-Casting) | 42.3 | Not recorded | 6a0beec1dbc836b87d82c63a | | Naive Strategy 2 | 40.8 | Not recorded | 6a0beec1dbc836b87d82c63a | | MLAI+PixArt-α | 40.2 | Not recorded | 6a0beec1dbc836b87d82c63a | | Naive Strategy 1 | 40.1 | Not recorded | 6a0beec1dbc836b87d82c63a | | Naive Strategy 2 | 37.8 | Not recorded | 6a0beec1dbc836b87d82c63a | | MLAI+PixArt-α | 37.2 | Not recorded | 6a0beec1dbc836b87d82c63a | | Naive Strategy 1 | 37.1 | Not recorded | 6a0beec1dbc836b87d82c63a | | Naive Strategy 2 | 36.6 | Not recorded | 6a0beec1dbc836b87d82c63a | | Naive Strategy 2 | 35.6 | Not recorded | 6a0beec1dbc836b87d82c63a | | Naive Strategy 1 | 35.3 | Not recorded | 6a0beec1dbc836b87d82c63a | | Naive Strategy 1 | 35.2 | Not recorded | 6a0beec1dbc836b87d82c63a | | Baseline (MLAI + PixArt-α) | 34.3 | Not recorded | 6a0beec1dbc836b87d82c63a | | Baseline (MLAI + PixArt-α) | 33.1 | Not recorded | 6a0beec1dbc836b87d82c63a | | MLAI+PixArt-α | 32.9 | Not recorded | 6a0beec1dbc836b87d82c63a | | Naive Strategy 2 | 32.2 | Not recorded | 6a0beec1dbc836b87d82c63a | | Naive Strategy 1 | 31.5 | Not recorded | 6a0beec1dbc836b87d82c63a | | Baseline (MLAI + PixArt-α) | 29.4 | Not recorded | 6a0beec1dbc836b87d82c63a | ### Ours (Wide-Net-Casting) WASR: 100. Result ID: 6a0c2d63fbc373592c02958f. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment Strategy":"Original Safety Alignment"}. This record does not assert independent reproduction. ### wide-net-casting jailbreak method WASR: 100. Result ID: 6a0c2d63fbc373592c0295c5. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment":"Original Safety Alignment"}. This record does not assert independent reproduction. ### Naive Strategy 2 WASR: 95.1. Result ID: 6a0c2d63fbc373592c0295c1. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment":"Original Safety Alignment"}. This record does not assert independent reproduction. ### Naive Strategy 1 WASR: 94.9. Result ID: 6a0c2d63fbc373592c0295bd. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment":"Original Safety Alignment"}. This record does not assert independent reproduction. ### Naive Strategy 2 WASR: 93.7. Result ID: 6a0c2d63fbc373592c02958b. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment Strategy":"Original Safety Alignment"}. This record does not assert independent reproduction. ### MLAI+PixArt-α WASR: 93.7. Result ID: 6a0c2d63fbc373592c0295b9. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment":"Original Safety Alignment"}. This record does not assert independent reproduction. ### Naive Strategy 1 WASR: 93. Result ID: 6a0c2d63fbc373592c029587. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment Strategy":"Original Safety Alignment"}. This record does not assert independent reproduction. ### Baseline (MLAI + PixArt-α) WASR: 89.9. Result ID: 6a0c2d63fbc373592c029583. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment Strategy":"Original Safety Alignment"}. This record does not assert independent reproduction. ### wide-net-casting jailbreak method WASR: 53.5. Result ID: 6a0c2d63fbc373592c0295c6. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment":"Original Safety Alignment + VLGuard"}. This record does not assert independent reproduction. ### wide-net-casting jailbreak method WASR: 50.1. Result ID: 6a0c2d63fbc373592c0295c7. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment":"Original Safety Alignment + IMMUNE"}. This record does not assert independent reproduction. ### Ours (Wide-Net-Casting) WASR: 47.6. Result ID: 6a0c2d63fbc373592c029590. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment Strategy":"Original Safety Alignment + VLGuard"}. This record does not assert independent reproduction. ### Ours (Wide-Net-Casting) WASR: 46.7. Result ID: 6a0c2d63fbc373592c029591. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment Strategy":"Original Safety Alignment + IMMUNE"}. This record does not assert independent reproduction. ### Naive Strategy 2 WASR: 44.1. Result ID: 6a0c2d63fbc373592c0295c2. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment":"Original Safety Alignment + VLGuard"}. This record does not assert independent reproduction. ### wide-net-casting jailbreak method WASR: 43.6. Result ID: 6a0c2d63fbc373592c0295c8. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment":"Original Safety Alignment + ASTRA"}. This record does not assert independent reproduction. ### Naive Strategy 1 WASR: 43.4. Result ID: 6a0c2d63fbc373592c0295be. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment":"Original Safety Alignment + VLGuard"}. This record does not assert independent reproduction. ### Ours (Wide-Net-Casting) WASR: 42.3. Result ID: 6a0c2d63fbc373592c029592. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment Strategy":"Original Safety Alignment + ASTRA"}. This record does not assert independent reproduction. ### Naive Strategy 2 WASR: 40.8. Result ID: 6a0c2d63fbc373592c0295c3. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment":"Original Safety Alignment + IMMUNE"}. This record does not assert independent reproduction. ### MLAI+PixArt-α WASR: 40.2. Result ID: 6a0c2d63fbc373592c0295ba. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment":"Original Safety Alignment + VLGuard"}. This record does not assert independent reproduction. ### Naive Strategy 1 WASR: 40.1. Result ID: 6a0c2d63fbc373592c0295bf. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment":"Original Safety Alignment + IMMUNE"}. This record does not assert independent reproduction. ### Naive Strategy 2 WASR: 37.8. Result ID: 6a0c2d63fbc373592c02958c. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment Strategy":"Original Safety Alignment + VLGuard"}. This record does not assert independent reproduction. ### MLAI+PixArt-α WASR: 37.2. Result ID: 6a0c2d63fbc373592c0295bb. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment":"Original Safety Alignment + IMMUNE"}. This record does not assert independent reproduction. ### Naive Strategy 1 WASR: 37.1. Result ID: 6a0c2d63fbc373592c029588. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment Strategy":"Original Safety Alignment + VLGuard"}. This record does not assert independent reproduction. ### Naive Strategy 2 WASR: 36.6. Result ID: 6a0c2d63fbc373592c02958d. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment Strategy":"Original Safety Alignment + IMMUNE"}. This record does not assert independent reproduction. ### Naive Strategy 2 WASR: 35.6. Result ID: 6a0c2d63fbc373592c0295c4. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment":"Original Safety Alignment + ASTRA"}. This record does not assert independent reproduction. ### Naive Strategy 1 WASR: 35.3. Result ID: 6a0c2d63fbc373592c029589. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment Strategy":"Original Safety Alignment + IMMUNE"}. This record does not assert independent reproduction. ### Naive Strategy 1 WASR: 35.2. Result ID: 6a0c2d63fbc373592c0295c0. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment":"Original Safety Alignment + ASTRA"}. This record does not assert independent reproduction. ### Baseline (MLAI + PixArt-α) WASR: 34.3. Result ID: 6a0c2d63fbc373592c029584. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment Strategy":"Original Safety Alignment + VLGuard"}. This record does not assert independent reproduction. ### Baseline (MLAI + PixArt-α) WASR: 33.1. Result ID: 6a0c2d63fbc373592c029585. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment Strategy":"Original Safety Alignment + IMMUNE"}. This record does not assert independent reproduction. ### MLAI+PixArt-α WASR: 32.9. Result ID: 6a0c2d63fbc373592c0295bc. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment":"Original Safety Alignment + ASTRA"}. This record does not assert independent reproduction. ### Naive Strategy 2 WASR: 32.2. Result ID: 6a0c2d63fbc373592c02958e. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment Strategy":"Original Safety Alignment + ASTRA"}. This record does not assert independent reproduction. ### Naive Strategy 1 WASR: 31.5. Result ID: 6a0c2d63fbc373592c02958a. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment Strategy":"Original Safety Alignment + ASTRA"}. This record does not assert independent reproduction. ### Baseline (MLAI + PixArt-α) WASR: 29.4. Result ID: 6a0c2d63fbc373592c029586. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Safety Alignment Strategy":"Original Safety Alignment + ASTRA"}. This record does not assert independent reproduction. Page 1 of 1. This is an index page, not the full collection.