Multi-agent discussion attack on MMMU
2.3Delta AccuracyMCA
Evaluation results
| Method | Links | |||
|---|---|---|---|---|
| MCASelection Strategy=Original strategy, Anomaly detector=RAGAs2026.03 | 2.3 | 3.6 | 4 | |
| MCASelection Strategy=Original strategy, Anomaly detector=G-Safeguard2026.03 | 3.1 | 3.8 | 5.1 | |
| MCASelection Strategy=Original strategy, Anomaly detector=SelfCheckGPT2026.03 | 4.1 | 5 | 3.5 | |
| MAD-SpearSelection Strategy=Original strategy, Anomaly detector=RAGAs2026.03 | 5.7 | 7 | 6.2 | |
| MAD-SpearSelection Strategy=Original strategy, Anomaly detector=G-Safeguard2026.03 | 7.1 | 7.2 | 7.1 | |
| MAD-SpearSelection Strategy=Original strategy, Anomaly detector=SelfCheckGPT2026.03 | 7.6 | 8.5 | 5.5 | |
| MCASelection Strategy=Variant I, Anomaly detector=RAGAs2026.03 | 9.2 | 13.5 | 4.1 | |
| MCASelection Strategy=Variant II, Anomaly detector=RAGAs2026.03 | 9.8 | 12.9 | 4.4 | |
| MCASelection Strategy=Variant II, Anomaly detector=G-Safeguard2026.03 | 10.1 | 14.9 | 5.5 | |
| MCASelection Strategy=Variant I, Anomaly detector=G-Safeguard2026.03 | 10.9 | 14.5 | 5.1 | |
| MCASelection Strategy=Variant II, Anomaly detector=SelfCheckGPT2026.03 | 11.3 | 15.2 | 3.8 | |
| MCASelection Strategy=Variant I, Anomaly detector=SelfCheckGPT2026.03 | 11.4 | 14.8 | 3.6 | |
| MCASelection Strategy=Variant III, Anomaly detector=RAGAs2026.03 | 12.7 | 16.3 | 4 | |
| MCASelection Strategy=Variant IV, Anomaly detector=RAGAs2026.03 | 12.7 | 17.8 | 4.3 | |
| MCASelection Strategy=Variant IV, Anomaly detector=G-Safeguard2026.03 | 13 | 14.2 | 5.3 | |
| MCASelection Strategy=Variant IV, Anomaly detector=SelfCheckGPT2026.03 | 13.5 | 18 | 3.7 | |
| MCASelection Strategy=Variant V, Anomaly detector=RAGAs2026.03 | 13.9 | 17.5 | 4 | |
| MCASelection Strategy=Variant VI, Anomaly detector=RAGAs2026.03 | 14.2 | 18.2 | 4 | |
| MCASelection Strategy=Variant V, Anomaly detector=G-Safeguard2026.03 | 14.7 | 18.5 | 5.2 | |
| MAD-SpearSelection Strategy=Variant II, Anomaly detector=RAGAs2026.03 | 15.1 | 19.4 | 6.5 | |
| MCASelection Strategy=Variant VI, Anomaly detector=G-Safeguard2026.03 | 15.3 | 19.8 | 5.1 | |
| MCASelection Strategy=Variant V, Anomaly detector=SelfCheckGPT2026.03 | 15.4 | 19.4 | 3.6 | |
| MCASelection Strategy=Variant III, Anomaly detector=G-Safeguard2026.03 | 15.5 | 19.8 | 5.2 | |
| MCASelection Strategy=Variant VI, Anomaly detector=SelfCheckGPT2026.03 | 15.7 | 20.8 | 3.6 | |
| MCASelection Strategy=Variant III, Anomaly detector=SelfCheckGPT2026.03 | 16.6 | 22.9 | 3.5 | |
| MAD-SpearSelection Strategy=Variant II, Anomaly detector=G-Safeguard2026.03 | 16.9 | 21.3 | 7.4 | |
| MAD-SpearSelection Strategy=Variant IV, Anomaly detector=RAGAs2026.03 | 17 | 22.6 | 6.5 | |
| MAD-SpearSelection Strategy=Variant II, Anomaly detector=SelfCheckGPT2026.03 | 17.7 | 20.4 | 5.8 | |
| MAD-SpearSelection Strategy=Variant I, Anomaly detector=RAGAs2026.03 | 17.8 | 18.4 | 6.3 | |
| MAD-SpearSelection Strategy=Variant I, Anomaly detector=SelfCheckGPT2026.03 | 18 | 17.6 | 5.6 | |
| MAD-SpearSelection Strategy=Variant I, Anomaly detector=G-Safeguard2026.03 | 18.3 | 19.5 | 7.1 | |
| MAD-SpearSelection Strategy=Variant IV, Anomaly detector=G-Safeguard2026.03 | 18.4 | 23 | 7.3 | |
| MAD-SpearSelection Strategy=Variant IV, Anomaly detector=SelfCheckGPT2026.03 | 18.9 | 24.8 | 5.7 | |
| MAD-SpearSelection Strategy=Variant V, Anomaly detector=RAGAs2026.03 | 19.3 | 25.8 | 6.2 | |
| MAD-SpearSelection Strategy=Variant III, Anomaly detector=RAGAs2026.03 | 20.2 | 25.3 | 6.3 | |
| MAD-SpearSelection Strategy=Variant VI, Anomaly detector=RAGAs2026.03 | 20.5 | 23.4 | 6.2 | |
| MAD-SpearSelection Strategy=Variant V, Anomaly detector=G-Safeguard2026.03 | 21.4 | 27.5 | 7.2 | |
| MAD-SpearSelection Strategy=Variant VI, Anomaly detector=G-Safeguard2026.03 | 21.5 | 26.8 | 7.2 | |
| MAD-SpearSelection Strategy=Variant III, Anomaly detector=G-Safeguard2026.03 | 21.8 | 26 | 7.2 | |
| MAD-SpearSelection Strategy=Variant VI, Anomaly detector=SelfCheckGPT2026.03 | 21.8 | 28.6 | 5.6 | |
| MAD-SpearSelection Strategy=Variant III, Anomaly detector=SelfCheckGPT2026.03 | 21.9 | 27.7 | 5.5 | |
| MAD-SpearSelection Strategy=Variant V, Anomaly detector=SelfCheckGPT2026.03 | 22.5 | 29.3 | 5.5 | |
| Formulation-driven Attack StrategyBase Framework=MCA Amayuelas et al. (2024), Anomaly detector=RAGAs2026.03 | 28.1 | 32 | 3.9 | |
| Formulation-driven Attack StrategyBase Framework=MCA Amayuelas et al. (2024), Anomaly detector=G-Safeguard2026.03 | 31.4 | 38.4 | 5 | |
| Formulation-driven Attack StrategyBase Framework=MCA Amayuelas et al. (2024), Anomaly detector=SelfCheckGPT2026.03 | 32.6 | 39.5 | 3.4 | |
| Formulation-driven Attack StrategyBase Framework=MAD-Spear Cui & Du (2025), Anomaly detector=RAGAs2026.03 | 41.7 | 44.6 | 6.1 | |
| Formulation-driven Attack StrategyBase Framework=MAD-Spear Cui & Du (2025), Anomaly detector=G-Safeguard2026.03 | 42.2 | 49.4 | 7 | |
| Formulation-driven Attack StrategyBase Framework=MAD-Spear Cui & Du (2025), Anomaly detector=SelfCheckGPT2026.03 | 45.3 | 51.1 | 5.4 |