Multimodal Prompt Injection Attack on ImageNet
0Attack Success Rate (ASR)ATPI
Evaluation Results
| Method | Links | ||
|---|---|---|---|
| ATPITarget Model=InstructBLIP, Best Source Model=MiniGPT4-llama22026.05 | 0 | 28.62 | |
| ATPITarget Model=BLIP-2, Best Source Model=MiniGPT4-llama22026.05 | 0 | 13.29 | |
| ARE-WTarget Model=MiniGPT4-llama2, Best Source Model=MiniGPT4-vicuna2026.05 | 2.04 | 28.61 | |
| ARE-WTarget Model=BLIVA, Best Source Model=MiniGPT4-llama22026.05 | 4.08 | 20.27 | |
| ATPITarget Model=BLIVA, Best Source Model=MiniGPT4-llama22026.05 | 5.8 | 32.88 | |
| ARE-WTarget Model=InstructBLIP, Best Source Model=MiniGPT4-llama22026.05 | 6.12 | 20.84 | |
| ARE-WTarget Model=BLIP-2, Best Source Model=MiniGPT4-llama22026.05 | 8.16 | 19.71 | |
| ARE-WTarget Model=MiniGPT4-vicuna, Best Source Model=MiniGPT4-llama22026.05 | 10.2 | 29.32 | |
| ATPITarget Model=MiniGPT4-llama2, Best Source Model=MiniGPT4-vicuna2026.05 | 10.53 | 32.28 | |
| ATPITarget Model=Qwen2.5-VL, Best Source Model=Qwen2.5-VL2026.05 | 12.2 | 31.11 | |
| ARE-WTarget Model=Qwen2.5-VL, Best Source Model=Qwen2.5-VL2026.05 | 13.95 | 18.89 | |
| ATPITarget Model=MiniGPT4-vicuna, Best Source Model=MiniGPT4-llama22026.05 | 17.54 | 29.92 | |
| CITarget Model=MiniGPT4-llama2, Best Source Model=MiniGPT4-vicuna2026.05 | 20.37 | 22.44 | |
| ARE-BTarget Model=MiniGPT4-llama2, Best Source Model=MiniGPT4-vicuna2026.05 | 22.73 | 32.41 | |
| CrossMPITarget Model=MiniGPT4-llama2, Best Source Model=MiniGPT4-vicuna2026.05 | 27.18 | 32.63 | |
| CrossMPITarget Model=Qwen2.5-VL, Best Source Model=Qwen2.5-VL2026.05 | 29.41 | 21.87 | |
| ARE-BTarget Model=Qwen2.5-VL, Best Source Model=Qwen2.5-VL2026.05 | 36.36 | 22.56 | |
| CITarget Model=MiniGPT4-vicuna, Best Source Model=MiniGPT4-llama22026.05 | 45.45 | 33.18 | |
| ARE-BTarget Model=InstructBLIP, Best Source Model=MiniGPT4-llama22026.05 | 47.73 | 30.76 | |
| ARE-BTarget Model=BLIVA, Best Source Model=MiniGPT4-llama22026.05 | 47.73 | 28.18 | |
| ARE-BTarget Model=MiniGPT4-vicuna, Best Source Model=MiniGPT4-llama22026.05 | 56.82 | 42.89 | |
| ARE-BTarget Model=BLIP-2, Best Source Model=MiniGPT4-llama22026.05 | 56.82 | 41.76 | |
| CITarget Model=Qwen2.5-VL, Best Source Model=Qwen2.5-VL2026.05 | 67.27 | 29.49 | |
| CrossMPITarget Model=MiniGPT4-vicuna, Best Source Model=MiniGPT4-llama22026.05 | 69.9 | 51.01 | |
| CITarget Model=BLIVA, Best Source Model=MiniGPT4-llama22026.05 | 79.21 | 37.33 | |
| CITarget Model=InstructBLIP, Best Source Model=MiniGPT4-llama22026.05 | 81.82 | 36.46 | |
| CrossMPITarget Model=BLIP-2, Best Source Model=MiniGPT4-llama22026.05 | 93.2 | 54.17 | |
| CrossMPITarget Model=InstructBLIP, Best Source Model=MiniGPT4-llama22026.05 | 94.17 | 37.56 | |
| CrossMPITarget Model=BLIVA, Best Source Model=MiniGPT4-llama22026.05 | 94.17 | 36.08 | |
| CITarget Model=BLIP-2, Best Source Model=MiniGPT4-llama22026.05 | 94.55 | 50.17 |