Jailbreaking on JailbreakBench (ASR via Detoxify & Llama Guard 3)
0ASR (Detoxify)VAE-JB
Evaluation results
| Method | Links | ||
|---|---|---|---|
| VAE-JBModel=InternVL, epsilon (ε)=322026.04 | 0 | 2 | |
| VAE-JBModel=MiniGPT-4, epsilon (ε)=32, transfer=true2026.04 | 0 | 72 | |
| BAPModel=Qwen-VL, epsilon (ε)=322026.04 | 0 | 6 | |
| BAPModel=InternVL, epsilon (ε)=322026.04 | 0 | 1 | |
| BAPModel=MiniGPT-4, epsilon (ε)=32, transfer=true2026.04 | 0 | 73 | |
| JB-PcsModel=Qwen-VL, epsilon (ε)=–2026.04 | 0 | 3 | |
| JB-PcsModel=InternVL, epsilon (ε)=–2026.04 | 0 | 0 | |
| Attention-Guided Visual JailbreakingModel=MiniGPT-4, epsilon (ε)=16, transfer=true2026.04 | 0 | 73 | |
| Attention-Guided Visual JailbreakingModel=MiniGPT-4, epsilon (ε)=32, transfer=true2026.04 | 0 | 79 | |
| BAPModel=LLaVA-1.5, epsilon (ε)=322026.04 | 1 | 64 | |
| VAE-JBModel=LLaVA-1.5, epsilon (ε)=322026.04 | 2 | 69 | |
| JB-PcsModel=LLaVA-1.5, epsilon (ε)=–2026.04 | 2 | 72 | |
| JB-PcsModel=MiniGPT-4, epsilon (ε)=–, transfer=true2026.04 | 2 | 62 | |
| Attention-Guided Visual JailbreakingModel=InternVL, epsilon (ε)=322026.04 | 2 | 2 | |
| Attention-Guided Visual JailbreakingModel=InternVL, epsilon (ε)=162026.04 | 3 | 19 | |
| Attention-Guided Visual JailbreakingModel=LLaVA-1.5, epsilon (ε)=162026.04 | 4 | 64 | |
| Attention-Guided Visual JailbreakingModel=Qwen-VL, epsilon (ε)=162026.04 | 5 | 45 | |
| Attention-Guided Visual JailbreakingModel=LLaVA-1.5, epsilon (ε)=322026.04 | 6.1 | 84 | |
| VAE-JBModel=Qwen-VL, epsilon (ε)=322026.04 | 7 | 61 | |
| Attention-Guided Visual JailbreakingModel=Qwen-VL, epsilon (ε)=322026.04 | 11 | 92 |