Perturbation-based Jailbreak Attack Defense on Perturbation-based Attack adversarial variants
74.55ASR (PGD, eps=16/255)w/o defense
Evaluation results
| Method | Links | ||||||
|---|---|---|---|---|---|---|---|
| w/o defenseBackbone=Qwen2-VL2026.03 | 74.55 | 80 | 76.37 | 77.57 | 80 | 78.18 | |
| w/o defenseBackbone=MiniGPT-42026.03 | 70.91 | 78.18 | 74.55 | 76.36 | 78.18 | 79.09 | |
| w/o defenseBackbone=LLaVA-v1.52026.03 | 69.09 | 74.55 | 80.6 | 90.3 | 87.28 | 89.09 | |
| ASTRABackbone=Qwen2-VL2026.03 | 21.82 | 14.55 | 15.76 | 15.76 | 18.18 | 18.18 | |
| NullSteerBackbone=Qwen2-VL2026.03 | 19.95 | 13.86 | 14.28 | 14.35 | 16.83 | 17.28 | |
| ASTRABackbone=MiniGPT-42026.03 | 5.45 | 12.73 | 5.45 | 10.91 | 16.37 | 13.64 | |
| NullSteerBackbone=MiniGPT-42026.03 | 3.28 | 9.43 | 4.65 | 9.42 | 14.21 | 12.71 | |
| ASTRABackbone=LLaVA-v1.52026.03 | 1.82 | 1.82 | 1.21 | 0.61 | 0 | 0 | |
| NullSteerBackbone=LLaVA-v1.52026.03 | 1.74 | 1.7 | 1 | 0.61 | 0 | 0 |