Jailbreaking Success Rate on StrongREJECT (Detoxify & Llama Guard 3)
0ASR (Detoxify)VAE-JB
Evaluation results
| Method | Links | ||
|---|---|---|---|
| VAE-JBModel=InternVL, epsilon (ε)=322026.04 | 0 | 3.8 | |
| BAPModel=LLaVA-1.5, epsilon (ε)=322026.04 | 0 | 47 | |
| BAPModel=InternVL, epsilon (ε)=322026.04 | 0 | 3.5 | |
| JB-PcsModel=InternVL, epsilon (ε)=–2026.04 | 0 | 4.5 | |
| JB-PcsModel=Qwen-VL, epsilon (ε)=–2026.04 | 0.3 | 5.8 | |
| Attention-Guided Visual JailbreakingModel=MiniGPT-4, epsilon (ε)=32, transfer=true2026.04 | 0.3 | 66.1 | |
| BAPModel=Qwen-VL, epsilon (ε)=322026.04 | 0.6 | 9.3 | |
| BAPModel=MiniGPT-4, epsilon (ε)=32, transfer=true2026.04 | 0.6 | 64.3 | |
| JB-PcsModel=LLaVA-1.5, epsilon (ε)=–2026.04 | 0.6 | 50.2 | |
| Attention-Guided Visual JailbreakingModel=MiniGPT-4, epsilon (ε)=16, transfer=true2026.04 | 0.6 | 64.9 | |
| VAE-JBModel=LLaVA-1.5, epsilon (ε)=322026.04 | 1 | 51.8 | |
| VAE-JBModel=MiniGPT-4, epsilon (ε)=32, transfer=true2026.04 | 1 | 64.5 | |
| JB-PcsModel=MiniGPT-4, epsilon (ε)=–, transfer=true2026.04 | 1 | 63.9 | |
| Attention-Guided Visual JailbreakingModel=LLaVA-1.5, epsilon (ε)=162026.04 | 2.6 | 59.7 | |
| VAE-JBModel=Qwen-VL, epsilon (ε)=322026.04 | 2.9 | 55.6 | |
| Attention-Guided Visual JailbreakingModel=Qwen-VL, epsilon (ε)=162026.04 | 2.9 | 66.5 | |
| Attention-Guided Visual JailbreakingModel=InternVL, epsilon (ε)=162026.04 | 5.1 | 15.3 | |
| Attention-Guided Visual JailbreakingModel=InternVL, epsilon (ε)=322026.04 | 5.8 | 7 | |
| Attention-Guided Visual JailbreakingModel=LLaVA-1.5, epsilon (ε)=322026.04 | 8.5 | 78 | |
| Attention-Guided Visual JailbreakingModel=Qwen-VL, epsilon (ε)=322026.04 | 13.1 | 90.4 |