Text Retrieval on MSCOCO (R@K)
100Recall@1HQA-VLAttack
Evaluation Results
| Method | Links | |||
|---|---|---|---|---|
| HQA-VLAttackSurrogate Model=CLIPViT, Victim Model=CLIPViT2026.04 | 100 | — | — | |
| HQA-VLAttackSurrogate Model=CLIPCNN, Victim Model=CLIPCNN2026.04 | 100 | — | — | |
| HQA-VLAttackSurrogate Model=ALBEF, Victim Model=ALBEF2026.04 | 99.97 | — | — | |
| HQA-VLAttackSurrogate Model=TCL, Victim Model=TCL2026.04 | 99.97 | — | — | |
| SGASurrogate Model=CLIPViT, Victim Model=CLIPViT2026.04 | 99.79 | — | — | |
| DRASurrogate Model=CLIPViT, Victim Model=CLIPViT2026.04 | 99.66 | — | — | |
| SGASurrogate Model=CLIPCNN, Victim Model=CLIPCNN2026.04 | 99.61 | — | — | |
| DRASurrogate Model=CLIPCNN, Victim Model=CLIPCNN2026.04 | 99.51 | — | — | |
| DRASurrogate Model=TCL, Victim Model=TCL2026.04 | 98.99 | — | — | |
| SGASurrogate Model=TCL, Victim Model=TCL2026.04 | 98.97 | — | — | |
| Co-AttackSurrogate Model=CLIPViT, Victim Model=CLIPViT2026.04 | 97.98 | — | — | |
| SGASurrogate Model=ALBEF, Victim Model=ALBEF2026.04 | 96.75 | — | — | |
| Co-AttackSurrogate Model=CLIPCNN, Victim Model=CLIPCNN2026.04 | 96.72 | — | — | |
| DRASurrogate Model=ALBEF, Victim Model=ALBEF2026.04 | 96.57 | — | — | |
| HQA-VLAttackSurrogate Model=CLIPViT, Victim Model=CLIPCNN2026.04 | 88.93 | — | — | |
| Sep-AttackSurrogate Model=CLIPCNN, Victim Model=CLIPCNN2026.04 | 88.72 | — | — | |
| HQA-VLAttackSurrogate Model=ALBEF, Victim Model=TCL2026.04 | 85.69 | — | — | |
| Co-AttackSurrogate Model=TCL, Victim Model=TCL2026.04 | 85.38 | — | — | |
| HQA-VLAttackSurrogate Model=CLIPCNN, Victim Model=CLIPViT2026.04 | 82.72 | — | — | |
| Sep-AttackSurrogate Model=ALBEF, Victim Model=ALBEF2026.04 | 82.6 | — | — | |
| HQA-VLAttackSurrogate Model=TCL, Victim Model=ALBEF2026.04 | 81.9 | — | — | |
| Co-AttackSurrogate Model=ALBEF, Victim Model=ALBEF2026.04 | 79.87 | — | — | |
| FALCON#Images=4M, Evaluation Protocol=Fine-tuned2025.05 | 78.7 | 94 | 97 | |
| MAFA#Images=4M, Evaluation Protocol=Fine-tuned2025.05 | 78 | 93.4 | 96.9 | |
| HQA-VLAttackSurrogate Model=ALBEF, Victim Model=CLIPCNN2026.04 | 77.52 | — | — | |
| ALIGN#Images=1.2B, Evaluation Protocol=Fine-tuned2025.05 | 77 | 93.5 | 96.9 | |
| PGDSurrogate Model=CLIPCNN, Victim Model=CLIPCNN2026.04 | 76.99 | — | — | |
| PGDSurrogate Model=ALBEF, Victim Model=ALBEF2026.04 | 76.7 | — | — | |
| GRIT-VLP#Images=4M, Evaluation Protocol=Fine-tuned2025.05 | 76.6 | 93.4 | 96.9 | |
| TCL#Images=4M, Evaluation Protocol=Fine-tuned2025.05 | 75.6 | 92.8 | 96.7 | |
| HQA-VLAttackSurrogate Model=ALBEF, Victim Model=CLIPViT2026.04 | 75.35 | — | — | |
| FALCON#Images=4M, Evaluation Protocol=Zero-shot2025.05 | 74.1 | 91.5 | 95.9 | |
| HQA-VLAttackSurrogate Model=TCL, Victim Model=CLIPCNN2026.04 | 73.52 | — | — | |
| ALBEF#Images=4M, Evaluation Protocol=Fine-tuned2025.05 | 73.1 | 91.4 | 96 | |
| MAFA#Images=4M, Evaluation Protocol=Zero-shot2025.05 | 72.6 | 91.3 | 95.6 | |
| TCL#Images=4M, Evaluation Protocol=Zero-shot2025.05 | 71.4 | 90.8 | 95.4 | |
| HQA-VLAttackSurrogate Model=TCL, Victim Model=CLIPViT2026.04 | 70.77 | — | — | |
| Sep-AttackSurrogate Model=TCL, Victim Model=TCL2026.04 | 70.32 | — | — | |
| ALBEF#Images=4M, Evaluation Protocol=Zero-shot2025.05 | 68.7 | 89.5 | 94.7 | |
| Sep-AttackSurrogate Model=CLIPViT, Victim Model=CLIPViT2026.04 | 68.52 | — | — | |
| DRASurrogate Model=TCL, Victim Model=ALBEF2026.04 | 68.06 | — | — | |
| ImageBERT#Images=6M, Evaluation Protocol=Fine-tuned2025.05 | 66.4 | 89.8 | 94.4 | |
| SGASurrogate Model=TCL, Victim Model=ALBEF2026.04 | 65.93 | — | — | |
| UNITER#Images=4M, Evaluation Protocol=Fine-tuned2025.05 | 65.7 | 88.6 | 93.8 | |
| DRASurrogate Model=CLIPViT, Victim Model=CLIPCNN2026.04 | 64.41 | — | — | |
| DRASurrogate Model=TCL, Victim Model=CLIPCNN2026.04 | 64.24 | — | — | |
| UNITER#Images=4M, Evaluation Protocol=Zero-shot2025.05 | 64.1 | 87.7 | 93.3 | |
| DRASurrogate Model=TCL, Victim Model=CLIPViT2026.04 | 63.3 | — | — | |
| DRASurrogate Model=ALBEF, Victim Model=CLIPCNN2026.04 | 62.32 | — | — | |
| FALCONPre-trained on=MSCOCO2025.05 | 62.28 | 86.18 | 92.3 | |
| DRASurrogate Model=ALBEF, Victim Model=CLIPViT2026.04 | 61.69 | — | — | |
| ViLT#Images=4M, Evaluation Protocol=Fine-tuned2025.05 | 61.5 | 86.3 | 92.7 | |
| MAFAPre-trained on=MSCOCO2025.05 | 60.96 | 83.24 | 89.62 | |
| DRASurrogate Model=ALBEF, Victim Model=TCL2026.04 | 60.69 | — | — | |
| GRIT-VLPPre-trained on=MSCOCO2025.05 | 60.6 | 83.52 | 89.14 | |
| DRASurrogate Model=CLIPCNN, Victim Model=CLIPViT2026.04 | 59.6 | — | — | |
| PGDSurrogate Model=TCL, Victim Model=TCL2026.04 | 59.58 | — | — | |
| SGASurrogate Model=TCL, Victim Model=CLIPCNN2026.04 | 59.44 | — | — | |
| Progressive-SofteningPre-trained on=MSCOCO2025.05 | 59.08 | 84.76 | 91.74 | |
| SGASurrogate Model=ALBEF, Victim Model=CLIPCNN2026.04 | 58.95 | — | — | |
| SGASurrogate Model=CLIPViT, Victim Model=CLIPCNN2026.04 | 58.93 | — | — | |
| q = 0.5Pre-trained on=MSCOCO2025.05 | 58.8 | 84.16 | 91.28 | |
| ALIGN#Images=1.2B, Evaluation Protocol=Zero-shot2025.05 | 58.6 | 83 | 89.7 | |
| SGASurrogate Model=ALBEF, Victim Model=TCL2026.04 | 58.56 | — | — | |
| Progressive-HardeningPre-trained on=MSCOCO2025.05 | 58.3 | 84.54 | 90.94 | |
| SGASurrogate Model=ALBEF, Victim Model=CLIPViT2026.04 | 57.06 | — | — | |
| SGASurrogate Model=CLIPCNN, Victim Model=CLIPViT2026.04 | 56.62 | — | — | |
| ViLT#Images=4M, Evaluation Protocol=Zero-shot2025.05 | 56.5 | 82.6 | 89.6 | |
| SGASurrogate Model=TCL, Victim Model=CLIPViT2026.04 | 56.34 | — | — | |
| HQA-VLAttackSurrogate Model=CLIPViT, Victim Model=ALBEF2026.04 | 56.05 | — | — | |
| ALBEFPre-trained on=MSCOCO2025.05 | 55.6 | 81.92 | 90.1 | |
| Co-AttackSurrogate Model=CLIPViT, Victim Model=CLIPCNN2026.04 | 55.08 | — | — | |
| PGDSurrogate Model=CLIPViT, Victim Model=CLIPViT2026.04 | 54.79 | — | — | |
| DiHTPre-trained on=MSCOCO2025.05 | 54.72 | 78.64 | 84 | |
| SRCLPre-trained on=MSCOCO2025.05 | 54.52 | 79.24 | 85.42 | |
| BERT-AttackSurrogate Model=CLIPCNN, Victim Model=CLIPCNN2026.04 | 54.43 | — | — | |
| HQA-VLAttackSurrogate Model=CLIPViT, Victim Model=TCL2026.04 | 54.1 | — | — | |
| Co-AttackSurrogate Model=CLIPCNN, Victim Model=CLIPViT2026.04 | 53.1 | — | — | |
| BERT-AttackSurrogate Model=TCL, Victim Model=CLIPCNN2026.04 | 52.23 | — | — | |
| HQA-VLAttackSurrogate Model=CLIPCNN, Victim Model=ALBEF2026.04 | 52.2 | — | — | |
| Co-AttackSurrogate Model=TCL, Victim Model=CLIPCNN2026.04 | 52.13 | — | — | |
| Sep-AttackSurrogate Model=TCL, Victim Model=CLIPCNN2026.04 | 51.9 | — | — | |
| Co-AttackSurrogate Model=TCL, Victim Model=CLIPViT2026.04 | 51.62 | — | — | |
| BERT-AttackSurrogate Model=CLIPCNN, Victim Model=CLIPViT2026.04 | 51.28 | — | — | |
| HQA-VLAttackSurrogate Model=CLIPCNN, Victim Model=TCL2026.04 | 51.11 | — | — | |
| BERT-AttackSurrogate Model=TCL, Victim Model=CLIPViT2026.04 | 51.09 | — | — | |
| Sep-AttackSurrogate Model=TCL, Victim Model=CLIPViT2026.04 | 50.74 | — | — | |
| Sep-AttackSurrogate Model=CLIPCNN, Victim Model=CLIPViT2026.04 | 50.44 | — | — | |
| BERT-AttackSurrogate Model=ALBEF, Victim Model=CLIPCNN2026.04 | 47.73 | — | — | |
| Co-AttackSurrogate Model=ALBEF, Victim Model=CLIPCNN2026.04 | 47.3 | — | — | |
| Sep-AttackSurrogate Model=ALBEF, Victim Model=CLIPCNN2026.04 | 46.96 | — | — | |
| Co-AttackSurrogate Model=TCL, Victim Model=ALBEF2026.04 | 46.08 | — | — | |
| BERT-AttackSurrogate Model=CLIPViT, Victim Model=CLIPViT2026.04 | 45.06 | — | — | |
| BERT-AttackSurrogate Model=ALBEF, Victim Model=CLIPViT2026.04 | 44.94 | — | — | |
| Co-AttackSurrogate Model=ALBEF, Victim Model=CLIPViT2026.04 | 44.89 | — | — | |
| BERT-AttackSurrogate Model=CLIPViT, Victim Model=CLIPCNN2026.04 | 44.54 | — | — | |
| Sep-AttackSurrogate Model=ALBEF, Victim Model=CLIPViT2026.04 | 44.03 | — | — | |
| ImageBERT#Images=6M, Evaluation Protocol=Zero-shot2025.05 | 44 | 71.2 | 80.4 | |
| Sep-AttackSurrogate Model=CLIPViT, Victim Model=CLIPCNN2026.04 | 43.11 | — | — | |
| Sep-AttackSurrogate Model=TCL, Victim Model=ALBEF2026.04 | 41.71 | — | — |