Targeted Adversarial Attack on ImageNet (LLM/Multimodal Evaluation)
88.7ASR (Average)MPCAttack
Evaluation results
| Method | Links | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| MPCAttackVictim Model=InternVL3-8B2026.03 | 88.7 | — | — | — | — | — | — | — | — | 66.78 | |
| MPCAttackVictim Model=LLaVa-1.5-7B2026.03 | 73.9 | — | — | — | — | — | — | — | — | 59.05 | |
| FOA-AttackVictim Model=InternVL3-8B2026.03 | 72.3 | — | — | — | — | — | — | — | — | 57 | |
| M-AttackVictim Model=InternVL3-8B2026.03 | 68.1 | — | — | — | — | — | — | — | — | 53.61 | |
| FOA-AttackVictim Model=LLaVa-1.5-7B2026.03 | 63.8 | — | — | — | — | — | — | — | — | 51.62 | |
| MPCAttackVictim Type=Closed-Source MLLMs2026.03 | 63.38 | 78.4 | 59.91 | 88 | 65.02 | 8.2 | 11.83 | 78.9 | 59.91 | 49.17 | |
| MPCAttackVictim Model=Average2026.03 | 63.33 | — | — | — | — | — | — | — | — | 51.33 | |
| M-AttackVictim Model=LLaVa-1.5-7B2026.03 | 59.9 | — | — | — | — | — | — | — | — | 49.54 | |
| MPCAttackVictim Model=GLM-4.1V-9B-Thinking2026.03 | 58.2 | — | — | — | — | — | — | — | — | 47.56 | |
| FOA-AttackVictim Model=Average2026.03 | 48.6 | — | — | — | — | — | — | — | — | 41.52 | |
| FOA-AttackVictim Type=Closed-Source MLLMs2026.03 | 47.73 | 63.9 | 51.53 | 69.3 | 55.8 | 7.3 | 11.05 | 50.4 | 45.04 | 40.86 | |
| M-AttackVictim Type=Closed-Source MLLMs2026.03 | 44.48 | 57.6 | 48.04 | 67.6 | 53.38 | 3.5 | 9.7 | 49.2 | 41.48 | 38.15 | |
| M-AttackVictim Model=Average2026.03 | 44.08 | — | — | — | — | — | — | — | — | 38.38 | |
| FOA-AttackVictim Model=GLM-4.1V-9B-Thinking2026.03 | 38.3 | — | — | — | — | — | — | — | — | 35.22 | |
| MPCAttackVictim Model=Qwen2.5-VL-7B2026.03 | 32.5 | — | — | — | — | — | — | — | — | 31.91 | |
| M-AttackVictim Model=GLM-4.1V-9B-Thinking2026.03 | 31 | — | — | — | — | — | — | — | — | 31.18 | |
| FOA-AttackVictim Model=Qwen2.5-VL-7B2026.03 | 20 | — | — | — | — | — | — | — | — | 22.22 | |
| M-AttackVictim Model=Qwen2.5-VL-7B2026.03 | 17.3 | — | — | — | — | — | — | — | — | 19.19 | |
| AnyAttackVictim Model=GLM-4.1V-9B-Thinking2026.03 | 1.3 | — | — | — | — | — | — | — | — | 3.81 | |
| AnyAttackVictim Model=LLaVa-1.5-7B2026.03 | 1.2 | — | — | — | — | — | — | — | — | 3.29 | |
| AnyAttackVictim Model=Average2026.03 | 1.08 | — | — | — | — | — | — | — | — | 3.5 | |
| AnyAttackVictim Model=InternVL3-8B2026.03 | 1 | — | — | — | — | — | — | — | — | 3.23 | |
| AnyAttackVictim Model=Qwen2.5-VL-7B2026.03 | 0.8 | — | — | — | — | — | — | — | — | 3.65 | |
| AnyAttackVictim Type=Closed-Source MLLMs2026.03 | 0.6 | 0.8 | 3.15 | 0.8 | 3.06 | 0.4 | 2.72 | 0.4 | 2.02 | 2.74 | |
| CoAVictim Model=GLM-4.1V-9B-Thinking2026.03 | 0.3 | — | — | — | — | — | — | — | — | 2.57 | |
| CoAVictim Model=InternVL3-8B2026.03 | 0.2 | — | — | — | — | — | — | — | — | 2.03 | |
| CoAVictim Model=Average2026.03 | 0.18 | — | — | — | — | — | — | — | — | 2.13 | |
| CoAVictim Type=Closed-Source MLLMs2026.03 | 0.125 | 0.1 | 1.99 | 0.1 | 2.05 | 0.1 | 2.07 | 0.2 | 1.59 | 1.93 | |
| CoAVictim Model=Qwen2.5-VL-7B2026.03 | 0.1 | — | — | — | — | — | — | — | — | 2.32 | |
| CoAVictim Model=LLaVa-1.5-7B2026.03 | 0.1 | — | — | — | — | — | — | — | — | 1.58 |