Toxicity Defense on PGD-Toxic
1.53ASR (PGD-Toxic)ASTRA
Evaluation results
| Method | Links | |
|---|---|---|
| ASTRABackbone=Qwen-2.5VL, Attack constraint=UnConstrain2026.03 | 1.53 | |
| CAREBackbone=Qwen-2.5VL, Attack constraint=UnConstrain2026.03 | 2.37 | |
| ASTRABackbone=Qwen-2.5VL, Perturbation radius (κ)=64/2552026.03 | 3.38 | |
| CAREBackbone=Qwen-2.5VL, Perturbation radius (κ)=64/2552026.03 | 4.6 | |
| CAREBackbone=Qwen-2.5VL, Perturbation radius (κ)=32/2552026.03 | 5.54 | |
| CAREBackbone=LLaVA-onevision, Attack constraint=UnConstrain2026.03 | 11.43 | |
| CAREBackbone=LLaVA-onevision, Perturbation radius (κ)=32/2552026.03 | 12.25 | |
| CAREBackbone=LLaVA-onevision, Perturbation radius (κ)=64/2552026.03 | 12.78 | |
| CAREBackbone=Qwen-2.5VL, Perturbation radius (κ)=16/2552026.03 | 14.13 | |
| CAREBackbone=LLaVA-onevision, Perturbation radius (κ)=16/2552026.03 | 15.12 | |
| Original modelBackbone=LLaVA-onevision, Perturbation radius (κ)=16/2552026.03 | 55.98 | |
| Original modelBackbone=LLaVA-onevision, Perturbation radius (κ)=32/2552026.03 | 57.13 | |
| Original modelBackbone=LLaVA-onevision, Perturbation radius (κ)=64/2552026.03 | 60.38 | |
| Original modelBackbone=LLaVA-onevision, Attack constraint=UnConstrain2026.03 | 67.34 |