Jailbreaking on AdvBench (Detoxify & Llama Guard 3 ASR)
0ASR (Detoxify)VAE-JB
Evaluation results
| Method | Links | ||
|---|---|---|---|
| VAE-JBModel=InternVL, epsilon (ε)=322026.04 | 0 | 1 | |
| VAE-JBModel=MiniGPT-4, epsilon (ε)=32, transfer=true2026.04 | 0 | 75.4 | |
| BAPModel=Qwen-VL, epsilon (ε)=322026.04 | 0 | 4.2 | |
| BAPModel=LLaVA-1.5, epsilon (ε)=322026.04 | 0 | 54.8 | |
| BAPModel=InternVL, epsilon (ε)=322026.04 | 0 | 0.8 | |
| JB-PcsModel=Qwen-VL, epsilon (ε)=–2026.04 | 0 | 1.5 | |
| JB-PcsModel=InternVL, epsilon (ε)=–2026.04 | 0 | 0.6 | |
| JB-PcsModel=LLaVA-1.5, epsilon (ε)=–2026.04 | 0.2 | 58.7 | |
| Attention-Guided Visual JailbreakingModel=Qwen-VL, epsilon (ε)=162026.04 | 0.2 | 44.8 | |
| BAPModel=MiniGPT-4, epsilon (ε)=32, transfer=true2026.04 | 0.4 | 75.8 | |
| Attention-Guided Visual JailbreakingModel=MiniGPT-4, epsilon (ε)=16, transfer=true2026.04 | 0.4 | 74.3 | |
| VAE-JBModel=LLaVA-1.5, epsilon (ε)=322026.04 | 0.6 | 57.9 | |
| JB-PcsModel=MiniGPT-4, epsilon (ε)=–, transfer=true2026.04 | 0.8 | 62.7 | |
| Attention-Guided Visual JailbreakingModel=MiniGPT-4, epsilon (ε)=32, transfer=true2026.04 | 1.3 | 76.3 | |
| Attention-Guided Visual JailbreakingModel=LLaVA-1.5, epsilon (ε)=162026.04 | 1.5 | 62.3 | |
| VAE-JBModel=Qwen-VL, epsilon (ε)=322026.04 | 1.9 | 68.8 | |
| Attention-Guided Visual JailbreakingModel=InternVL, epsilon (ε)=322026.04 | 3.8 | 1.5 | |
| Attention-Guided Visual JailbreakingModel=InternVL, epsilon (ε)=162026.04 | 7.7 | 18.3 | |
| Attention-Guided Visual JailbreakingModel=LLaVA-1.5, epsilon (ε)=322026.04 | 8.3 | 77.5 | |
| Attention-Guided Visual JailbreakingModel=Qwen-VL, epsilon (ε)=322026.04 | 11.2 | 94.4 |