Jailbreaking on HarmBench and StrongReject 200 prompts (held-out)
80Success Rate FractionPGD + Adaptive Probe-based Steering
Evaluation results
| Method | Links | |||
|---|---|---|---|---|
| PGD + Adaptive Probe-based SteeringTarget Model=GLM-4.6V-Flash2026.05 | 80 | 97 | 98 | |
| Adaptive Probe-based SteeringTarget Model=GLM-4.6V-Flash2026.05 | 71 | 85 | 97 | |
| Adaptive Probe-based SteeringTarget Model=Qwen3-4B-Thinking2026.05 | 67 | 94 | 97 | |
| Adaptive Probe-based SteeringTarget Model=Llava-CB2026.05 | 66 | 88 | 96 | |
| PGD + Adaptive Probe-based SteeringTarget Model=Llava-CB2026.05 | 66 | 81 | 92 | |
| No AttackTarget Model=GLM-4.6V-Flash2026.05 | 26 | 28 | 29 | |
| No AttackTarget Model=Qwen3-4B-Thinking2026.05 | 19 | 3 | 4 | |
| No AttackTarget Model=Llava-CB2026.05 | 1 | 1 | 0 |