Multi-modal Toxicity Attack on PTP (PolygloToxicityPrompts) English (test)
5.1Overall Toxicity RateText-Only
Evaluation results
| Method | Links | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Text-OnlyTarget VLM=LLaVA2026.05 | 5.1 | 4.8 | 2.7 | 5.8 | 1.5 | — | 2.6 | — | 4.4 | |
| Text-OnlyAccess Assumption=Tier-2 (cross-paradigm)2026.05 | 6.9 | 2.1 | 0.6 | 6 | 0.8 | 4.1 | 2 | — | — | |
| Text + SDTarget VLM=LLaVA2026.05 | 12.58 | 7.73 | 3.28 | 8.14 | 2.65 | — | 5.19 | — | 10.85 | |
| PGJTarget VLM=LLaVA2026.05 | 15.83 | 8.47 | 4.72 | 10.21 | 3.89 | — | 5.94 | — | 13.66 | |
| Text + SDAccess Assumption=Tier-2 (cross-paradigm), Generator=Stable Diffusion2026.05 | 17.3 | 7.6 | 1.65 | 15.57 | 1.99 | 8.29 | 5.08 | 0.74 | — | |
| DiffZOOTarget VLM=LLaVA2026.05 | 18.42 | 10.56 | 5.39 | 11.83 | 4.67 | — | 7.48 | — | 15.97 | |
| PGJAccess Assumption=Tier-2 (cross-paradigm)2026.05 | 19.66 | 9.11 | 2.57 | 15 | 4.01 | 8.48 | 6.12 | 0.73 | — | |
| ARTTarget VLM=LLaVA2026.05 | 19.68 | 11.29 | 5.84 | 12.47 | 5.03 | — | 8.15 | — | 17.12 | |
| STARE w/o LoRATarget VLM=LLaVA2026.05 | 20.47 | 13.82 | 7.29 | 12.35 | 6.14 | — | 7.51 | — | 19.63 | |
| STARE w/o EditingTarget VLM=LLaVA2026.05 | 21.13 | 13.85 | 8.47 | 14.27 | 6.05 | — | 7.82 | — | 19.38 | |
| DiffZOOAccess Assumption=Tier-2 (cross-paradigm)2026.05 | 21.7 | 11.63 | 2.86 | 20.53 | 3.23 | 7.56 | 5.23 | 0.7 | — | |
| ARTAccess Assumption=Tier-2 (cross-paradigm)2026.05 | 22.01 | 11.06 | 1.27 | 20.27 | 5.42 | 9.02 | 7.85 | 0.71 | — | |
| STARE w/o AlignTarget VLM=LLaVA2026.05 | 22.45 | 13.63 | 8.82 | 14.55 | 6.36 | — | 7.74 | — | 20.17 | |
| STARE w/o LoRAAblation=component removal, Removed=LoRA2026.05 | 22.65 | 10.62 | 3.64 | 21.1 | 3.83 | 7.69 | 6.92 | 0.71 | — | |
| STARETarget VLM=LLaVA, align=0.052026.05 | 23.26 | 13.58 | 9.15 | 15.34 | 7.67 | — | 7.89 | — | 21.83 | |
| STARETarget VLM=LLaVA, align=0.12026.05 | 23.27 | 14.14 | 10.38 | 15.59 | 8.28 | — | 8.28 | — | 21.65 | |
| STARETarget VLM=LLaVA, align=0.22026.05 | 23.92 | 14.93 | 12.05 | 15.86 | 8.94 | — | 8.61 | — | 22.19 | |
| STARE w/o EditAblation=component removal, Removed=Prompt Editor2026.05 | 24.58 | 12.05 | 2.65 | 23.09 | 4.93 | 9.41 | 6.16 | 0.72 | — | |
| STARE w/o AlignAblation=component removal, Removed=Alignment weight2026.05 | 27.68 | 12.38 | 4.16 | 26.9 | 5.52 | 10 | 7.21 | 0.65 | — | |
| STARE w/ DDPOAccess Assumption=Tier-1 Controlled Baseline, Base RL=DDPO2026.05 | 27.92 | 12.44 | 4.02 | 24.85 | 5.91 | 9.72 | 7.14 | 0.73 | — | |
| STARE (0.05)reward alignment weight=0.052026.05 | 28.14 | 12.58 | 3.96 | 25.38 | 6.79 | 9.48 | 7.08 | 0.74 | — | |
| STARE (0.2)reward alignment weight=0.22026.05 | 30.16 | 15.31 | 5.05 | 28.25 | 7.42 | 10.98 | 7.44 | 0.77 | — | |
| STARE (0.1)reward alignment weight=0.12026.05 | 30.83 | 14.56 | 4.16 | 29.2 | 6.06 | 10.22 | 7.06 | 0.74 | — |