# Multimodal Prompt Injection Attack on ImageNet Source: [Multimodal Prompt Injection Attack on ImageNet]() Collection index: [llms.txt]() Data updated: 2026-05-18T09:09:42.155Z Evaluation of model robustness against Multimodal Prompt Injection Attacks conducted on the ImageNet dataset, measured by Attack Success Rate (ASR) and Semantic Similarity (SS). A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. | Scope | Recorded value | | --- | --- | | Task | Multimodal Prompt Injection Attack | | Dataset (including any stated split) | ImageNet | | Metric | Attack Success Rate (ASR) | | Unit | PERCENT | | Direction | Lower is better | | Results loaded | 30 of 30 | | Coverage | All results currently returned for this benchmark | Evaluation settings may differ between results. The original papers and recorded configurations are needed to establish comparability. A shared metric name alone does not establish an identical protocol. ## Metrics - [Attack Success Rate (ASR)](): Lower is better; unit: PERCENT. - [Semantic Similarity (SS)](): Higher is better; unit: PERCENT. ## Recorded results | Method | Attack Success Rate (ASR) | Result date | Report paper | | --- | --- | --- | --- | | ATPI | 0 | Not recorded | 6a0a9d33dbc836b87d82b558 | | ATPI | 0 | Not recorded | 6a0a9d33dbc836b87d82b558 | | ARE-W | 2.04 | Not recorded | 6a0a9d33dbc836b87d82b558 | | ARE-W | 4.08 | Not recorded | 6a0a9d33dbc836b87d82b558 | | ATPI | 5.8 | Not recorded | 6a0a9d33dbc836b87d82b558 | | ARE-W | 6.12 | Not recorded | 6a0a9d33dbc836b87d82b558 | | ARE-W | 8.16 | Not recorded | 6a0a9d33dbc836b87d82b558 | | ARE-W | 10.2 | Not recorded | 6a0a9d33dbc836b87d82b558 | | ATPI | 10.53 | Not recorded | 6a0a9d33dbc836b87d82b558 | | ATPI | 12.2 | Not recorded | 6a0a9d33dbc836b87d82b558 | | ARE-W | 13.95 | Not recorded | 6a0a9d33dbc836b87d82b558 | | ATPI | 17.54 | Not recorded | 6a0a9d33dbc836b87d82b558 | | CI | 20.37 | Not recorded | 6a0a9d33dbc836b87d82b558 | | ARE-B | 22.73 | Not recorded | 6a0a9d33dbc836b87d82b558 | | CrossMPI | 27.18 | Not recorded | 6a0a9d33dbc836b87d82b558 | | CrossMPI | 29.41 | Not recorded | 6a0a9d33dbc836b87d82b558 | | ARE-B | 36.36 | Not recorded | 6a0a9d33dbc836b87d82b558 | | CI | 45.45 | Not recorded | 6a0a9d33dbc836b87d82b558 | | ARE-B | 47.73 | Not recorded | 6a0a9d33dbc836b87d82b558 | | ARE-B | 47.73 | Not recorded | 6a0a9d33dbc836b87d82b558 | | ARE-B | 56.82 | Not recorded | 6a0a9d33dbc836b87d82b558 | | ARE-B | 56.82 | Not recorded | 6a0a9d33dbc836b87d82b558 | | CI | 67.27 | Not recorded | 6a0a9d33dbc836b87d82b558 | | CrossMPI | 69.9 | Not recorded | 6a0a9d33dbc836b87d82b558 | | CI | 79.21 | Not recorded | 6a0a9d33dbc836b87d82b558 | | CI | 81.82 | Not recorded | 6a0a9d33dbc836b87d82b558 | | CrossMPI | 93.2 | Not recorded | 6a0a9d33dbc836b87d82b558 | | CrossMPI | 94.17 | Not recorded | 6a0a9d33dbc836b87d82b558 | | CrossMPI | 94.17 | Not recorded | 6a0a9d33dbc836b87d82b558 | | CI | 94.55 | Not recorded | 6a0a9d33dbc836b87d82b558 | ### ATPI Attack Success Rate (ASR): 0. Result ID: 6a0ad74647f34ce924f13497. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"InstructBLIP","Best Source Model":"MiniGPT4-llama2"}. This record does not assert independent reproduction. ### ATPI Attack Success Rate (ASR): 0. Result ID: 6a0ad74647f34ce924f1349c. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"BLIP-2","Best Source Model":"MiniGPT4-llama2"}. This record does not assert independent reproduction. ### ARE-W Attack Success Rate (ASR): 2.04. Result ID: 6a0ad74647f34ce924f1348a. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"MiniGPT4-llama2","Best Source Model":"MiniGPT4-vicuna"}. This record does not assert independent reproduction. ### ARE-W Attack Success Rate (ASR): 4.08. Result ID: 6a0ad74647f34ce924f1349e. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"BLIVA","Best Source Model":"MiniGPT4-llama2"}. This record does not assert independent reproduction. ### ATPI Attack Success Rate (ASR): 5.8. Result ID: 6a0ad74647f34ce924f134a1. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"BLIVA","Best Source Model":"MiniGPT4-llama2"}. This record does not assert independent reproduction. ### ARE-W Attack Success Rate (ASR): 6.12. Result ID: 6a0ad74647f34ce924f13494. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"InstructBLIP","Best Source Model":"MiniGPT4-llama2"}. This record does not assert independent reproduction. ### ARE-W Attack Success Rate (ASR): 8.16. Result ID: 6a0ad74647f34ce924f13499. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"BLIP-2","Best Source Model":"MiniGPT4-llama2"}. This record does not assert independent reproduction. ### ARE-W Attack Success Rate (ASR): 10.2. Result ID: 6a0ad74647f34ce924f1348f. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"MiniGPT4-vicuna","Best Source Model":"MiniGPT4-llama2"}. This record does not assert independent reproduction. ### ATPI Attack Success Rate (ASR): 10.53. Result ID: 6a0ad74647f34ce924f1348d. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"MiniGPT4-llama2","Best Source Model":"MiniGPT4-vicuna"}. This record does not assert independent reproduction. ### ATPI Attack Success Rate (ASR): 12.2. Result ID: 6a0ad74647f34ce924f134a6. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"Qwen2.5-VL","Best Source Model":"Qwen2.5-VL"}. This record does not assert independent reproduction. ### ARE-W Attack Success Rate (ASR): 13.95. Result ID: 6a0ad74647f34ce924f134a3. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"Qwen2.5-VL","Best Source Model":"Qwen2.5-VL"}. This record does not assert independent reproduction. ### ATPI Attack Success Rate (ASR): 17.54. Result ID: 6a0ad74647f34ce924f13492. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"MiniGPT4-vicuna","Best Source Model":"MiniGPT4-llama2"}. This record does not assert independent reproduction. ### CI Attack Success Rate (ASR): 20.37. Result ID: 6a0ad74647f34ce924f1348c. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"MiniGPT4-llama2","Best Source Model":"MiniGPT4-vicuna"}. This record does not assert independent reproduction. ### ARE-B Attack Success Rate (ASR): 22.73. Result ID: 6a0ad74647f34ce924f1348b. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"MiniGPT4-llama2","Best Source Model":"MiniGPT4-vicuna"}. This record does not assert independent reproduction. ### CrossMPI Attack Success Rate (ASR): 27.18. Result ID: 6a0ad74647f34ce924f1348e. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"MiniGPT4-llama2","Best Source Model":"MiniGPT4-vicuna"}. This record does not assert independent reproduction. ### CrossMPI Attack Success Rate (ASR): 29.41. Result ID: 6a0ad74647f34ce924f134a7. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"Qwen2.5-VL","Best Source Model":"Qwen2.5-VL"}. This record does not assert independent reproduction. ### ARE-B Attack Success Rate (ASR): 36.36. Result ID: 6a0ad74647f34ce924f134a4. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"Qwen2.5-VL","Best Source Model":"Qwen2.5-VL"}. This record does not assert independent reproduction. ### CI Attack Success Rate (ASR): 45.45. Result ID: 6a0ad74647f34ce924f13491. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"MiniGPT4-vicuna","Best Source Model":"MiniGPT4-llama2"}. This record does not assert independent reproduction. ### ARE-B Attack Success Rate (ASR): 47.73. Result ID: 6a0ad74647f34ce924f13495. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"InstructBLIP","Best Source Model":"MiniGPT4-llama2"}. This record does not assert independent reproduction. ### ARE-B Attack Success Rate (ASR): 47.73. Result ID: 6a0ad74647f34ce924f1349f. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"BLIVA","Best Source Model":"MiniGPT4-llama2"}. This record does not assert independent reproduction. ### ARE-B Attack Success Rate (ASR): 56.82. Result ID: 6a0ad74647f34ce924f13490. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"MiniGPT4-vicuna","Best Source Model":"MiniGPT4-llama2"}. This record does not assert independent reproduction. ### ARE-B Attack Success Rate (ASR): 56.82. Result ID: 6a0ad74647f34ce924f1349a. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"BLIP-2","Best Source Model":"MiniGPT4-llama2"}. This record does not assert independent reproduction. ### CI Attack Success Rate (ASR): 67.27. Result ID: 6a0ad74647f34ce924f134a5. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"Qwen2.5-VL","Best Source Model":"Qwen2.5-VL"}. This record does not assert independent reproduction. ### CrossMPI Attack Success Rate (ASR): 69.9. Result ID: 6a0ad74647f34ce924f13493. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"MiniGPT4-vicuna","Best Source Model":"MiniGPT4-llama2"}. This record does not assert independent reproduction. ### CI Attack Success Rate (ASR): 79.21. Result ID: 6a0ad74647f34ce924f134a0. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"BLIVA","Best Source Model":"MiniGPT4-llama2"}. This record does not assert independent reproduction. ### CI Attack Success Rate (ASR): 81.82. Result ID: 6a0ad74647f34ce924f13496. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"InstructBLIP","Best Source Model":"MiniGPT4-llama2"}. This record does not assert independent reproduction. ### CrossMPI Attack Success Rate (ASR): 93.2. Result ID: 6a0ad74647f34ce924f1349d. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"BLIP-2","Best Source Model":"MiniGPT4-llama2"}. This record does not assert independent reproduction. ### CrossMPI Attack Success Rate (ASR): 94.17. Result ID: 6a0ad74647f34ce924f13498. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"InstructBLIP","Best Source Model":"MiniGPT4-llama2"}. This record does not assert independent reproduction. ### CrossMPI Attack Success Rate (ASR): 94.17. Result ID: 6a0ad74647f34ce924f134a2. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"BLIVA","Best Source Model":"MiniGPT4-llama2"}. This record does not assert independent reproduction. ### CI Attack Success Rate (ASR): 94.55. Result ID: 6a0ad74647f34ce924f1349b. [Reporting paper]() [Method origin paper]() Recorded evaluation configuration: {"Target Model":"BLIP-2","Best Source Model":"MiniGPT4-llama2"}. This record does not assert independent reproduction. Page 1 of 1. This is an index page, not the full collection.