Transfer Attack on POPE (test)
0.2477CAET-CAA
Evaluation results
| Method | Links | ||
|---|---|---|---|
| T-CAALayer=2,8,16, Rate=0.7,0.35,0.175, Avg. Rate=0.369, Surrogate Model=LLaVA, Target Model=LLaVA-NEXT2026.01 | 0.2477 | 0.1377 | |
| T-CAALayer=2,10, Rate=0.5,0.25, Avg. Rate=0.359, Surrogate Model=LLaVA, Target Model=LLaVA-NEXT2026.01 | 0.2501 | 0.14 | |
| T-CAALayer=2,8, Rate=0.5,0.25, Avg. Rate=0.344, Surrogate Model=LLaVA, Target Model=LLaVA-NEXT2026.01 | 0.2641 | 0.154 | |
| T-CAALayer=2,8,16, Rate=0.5,0.25,0.125, Avg. Rate=0.281, Surrogate Model=LLaVA, Target Model=LLaVA-NEXT2026.01 | 0.2664 | 0.1564 | |
| T-CAALayer=2, Rate=0.3, Avg. Rate=0.344, Surrogate Model=LLaVA, Target Model=LLaVA-NEXT2026.01 | 0.2795 | 0.1694 | |
| T-CAALayer=2,8,16, Rate=0.7,0.35,0.175, Avg. Rate=0.369, Surrogate Model=LLaVA, Target Model=Qwen-VL2026.01 | 0.2896 | 0.15 | |
| T-CAALayer=8,16,24, Rate=0.3,0.15,0.1, Avg. Rate=0.388, Surrogate Model=LLaVA, Target Model=Qwen-VL2026.01 | 0.2973 | 0.1577 | |
| T-CAALayer=8,16,24, Rate=0.2,0.1,0.1, Avg. Rate=0.35, Surrogate Model=LLaVA, Target Model=Qwen-VL2026.01 | 0.3028 | 0.1632 | |
| T-CAALayer=2,8, Rate=0.5,0.25, Avg. Rate=0.344, Surrogate Model=LLaVA, Target Model=Qwen-VL2026.01 | 0.3064 | 0.1668 | |
| T-CAALayer=2,8,16, Rate=0.5,0.25,0.125, Avg. Rate=0.281, Surrogate Model=LLaVA, Target Model=Qwen-VL2026.01 | 0.3136 | 0.1741 | |
| T-CAALayer=8,16,24, Rate=0.3,0.15,0.1, Avg. Rate=0.388, Surrogate Model=LLaVA, Target Model=LLaVA-NEXT2026.01 | 0.3235 | 0.2134 | |
| T-CAALayer=2,10, Rate=0.5,0.25, Avg. Rate=0.359, Surrogate Model=LLaVA, Target Model=Qwen-VL2026.01 | 0.3286 | 0.1891 | |
| T-CAALayer=8, Rate=0.1, Avg. Rate=0.325, Surrogate Model=LLaVA, Target Model=Qwen-VL2026.01 | 0.3303 | 0.1908 | |
| T-CAALayer=8,16, Rate=0.3,0.15, Avg. Rate=0.4, Surrogate Model=LLaVA, Target Model=Qwen-VL2026.01 | 0.3313 | 0.1917 | |
| T-CAALayer=8,16,24, Rate=0.2,0.1,0.1, Avg. Rate=0.35, Surrogate Model=LLaVA, Target Model=LLaVA-NEXT2026.01 | 0.3333 | 0.2233 | |
| T-CAALayer=8,16, Rate=0.3,0.15, Avg. Rate=0.4, Surrogate Model=LLaVA, Target Model=LLaVA-NEXT2026.01 | 0.3455 | 0.2355 | |
| T-CAALayer=2, Rate=0.3, Avg. Rate=0.344, Surrogate Model=LLaVA, Target Model=Qwen-VL2026.01 | 0.3491 | 0.2095 | |
| T-CAALayer=8, Rate=0.2, Avg. Rate=0.4, Surrogate Model=LLaVA, Target Model=Qwen-VL2026.01 | 0.3498 | 0.2102 | |
| T-CAALayer=2,8,16, Rate=0.4,0.2,0.1, Avg. Rate=0.238, Surrogate Model=LLaVA, Target Model=Qwen-VL2026.01 | 0.3551 | 0.2155 | |
| T-CAALayer=8,16, Rate=0.2,0.1, Avg. Rate=0.35, Surrogate Model=LLaVA, Target Model=Qwen-VL2026.01 | 0.3715 | 0.2319 | |
| T-CAALayer=8,16, Rate=0.2,0.1, Avg. Rate=0.35, Surrogate Model=Qwen-VL, Target Model=LLaVA2026.01 | 0.3817 | 0.1963 | |
| T-CAALayer=8,16, Rate=0.3,0.15, Avg. Rate=0.4, Surrogate Model=Qwen-VL, Target Model=LLaVA2026.01 | 0.3818 | 0.1965 | |
| T-CAALayer=2,8, Rate=0.4,0.2, Avg. Rate=0.288, Surrogate Model=LLaVA, Target Model=LLaVA-NEXT2026.01 | 0.3845 | 0.2745 | |
| T-CAALayer=10, Rate=0.1, Avg. Rate=0.381, Surrogate Model=Qwen-VL, Target Model=LLaVA2026.01 | 0.3868 | 0.2014 | |
| T-CAALayer=2,8,16, Rate=0.7,0.35,0.175, Avg. Rate=0.369, Surrogate Model=Qwen-VL, Target Model=LLaVA2026.01 | 0.3934 | 0.208 | |
| T-CAALayer=8,16,24, Rate=0.3,0.15,0.1, Avg. Rate=0.388, Surrogate Model=Qwen-VL, Target Model=LLaVA2026.01 | 0.395 | 0.2096 | |
| T-CAALayer=8,16, Rate=0.2,0.1, Avg. Rate=0.35, Surrogate Model=LLaVA, Target Model=LLaVA-NEXT2026.01 | 0.3954 | 0.2853 | |
| T-CAALayer=10, Rate=0.1, Avg. Rate=0.381, Surrogate Model=LLaVA, Target Model=LLaVA-NEXT2026.01 | 0.4014 | 0.2914 | |
| T-CAALayer=10, Rate=0.1, Avg. Rate=0.381, Surrogate Model=LLaVA, Target Model=Qwen-VL2026.01 | 0.4014 | 0.2618 | |
| T-CAALayer=2, Rate=0.3, Avg. Rate=0.344, Surrogate Model=Qwen-VL, Target Model=LLaVA2026.01 | 0.4061 | 0.2207 | |
| T-CAALayer=2,10, Rate=0.5,0.25, Avg. Rate=0.359, Surrogate Model=Qwen-VL, Target Model=LLaVA2026.01 | 0.4091 | — | |
| T-CAALayer=2,8,16, Rate=0.5,0.25,0.125, Avg. Rate=0.281, Surrogate Model=Qwen-VL, Target Model=LLaVA2026.01 | 0.4115 | 0.2261 | |
| T-CAALayer=2,8, Rate=0.5,0.25, Avg. Rate=0.344, Surrogate Model=Qwen-VL, Target Model=LLaVA2026.01 | 0.4183 | 0.2329 | |
| T-CAALayer=2,8, Rate=0.4,0.2, Avg. Rate=0.288, Surrogate Model=Qwen-VL, Target Model=LLaVA2026.01 | 0.4183 | 0.233 | |
| T-CAALayer=2,10, Rate=0.4,0.2, Avg. Rate=0.3, Surrogate Model=LLaVA, Target Model=LLaVA-NEXT2026.01 | 0.4233 | 0.3133 | |
| T-CAALayer=8, Rate=0.2, Avg. Rate=0.4, Surrogate Model=LLaVA, Target Model=LLaVA-NEXT2026.01 | 0.4237 | 0.3136 | |
| T-CAALayer=2,8, Rate=0.4,0.2, Avg. Rate=0.288, Surrogate Model=LLaVA, Target Model=Qwen-VL2026.01 | 0.4239 | 0.2843 | |
| T-CAALayer=2,8,16, Rate=0.4,0.2,0.1, Avg. Rate=0.238, Surrogate Model=Qwen-VL, Target Model=LLaVA2026.01 | 0.4265 | 0.2411 | |
| T-CAALayer=2,8,16, Rate=0.4,0.2,0.1, Avg. Rate=0.238, Surrogate Model=LLaVA, Target Model=LLaVA-NEXT2026.01 | 0.4308 | 0.3207 | |
| T-CAALayer=8,16,24, Rate=0.2,0.1,0.1, Avg. Rate=0.35, Surrogate Model=Qwen-VL, Target Model=LLaVA2026.01 | 0.4351 | 0.2497 | |
| T-CAALayer=2,10, Rate=0.3,0.15, Avg. Rate=0.241, Surrogate Model=Qwen-VL, Target Model=LLaVA2026.01 | 0.4391 | 0.2537 | |
| T-CAALayer=2,10, Rate=0.4,0.2, Avg. Rate=0.3, Surrogate Model=Qwen-VL, Target Model=LLaVA2026.01 | 0.4437 | 0.2583 | |
| T-CAALayer=2,10, Rate=0.4,0.2, Avg. Rate=0.3, Surrogate Model=LLaVA, Target Model=Qwen-VL2026.01 | 0.4468 | 0.3073 | |
| T-CAALayer=2,8, Rate=0.3,0.15, Avg. Rate=0.231, Surrogate Model=Qwen-VL, Target Model=LLaVA2026.01 | 0.4504 | 0.265 | |
| T-CAALayer=2,8, Rate=0.3,0.15, Avg. Rate=0.231, Surrogate Model=LLaVA, Target Model=Qwen-VL2026.01 | 0.4573 | 0.3177 | |
| T-CAALayer=2,8,16, Rate=0.3,0.15,0.1, Avg. Rate=0.206, Surrogate Model=LLaVA, Target Model=Qwen-VL2026.01 | 0.4573 | 0.3177 | |
| T-CAALayer=2,10, Rate=0.3,0.15, Avg. Rate=0.241, Surrogate Model=LLaVA, Target Model=LLaVA-NEXT2026.01 | 0.4662 | 0.3561 | |
| T-CAALayer=2,8, Rate=0.3,0.15, Avg. Rate=0.231, Surrogate Model=LLaVA, Target Model=LLaVA-NEXT2026.01 | 0.4688 | 0.3587 | |
| T-CAALayer=2,8,16, Rate=0.3,0.15,0.1, Avg. Rate=0.206, Surrogate Model=LLaVA, Target Model=LLaVA-NEXT2026.01 | 0.4688 | 0.3587 | |
| T-CAALayer=2,8,16, Rate=0.3,0.15,0.1, Avg. Rate=0.206, Surrogate Model=Qwen-VL, Target Model=LLaVA2026.01 | 0.4843 | 0.2989 | |
| T-CAALayer=8, Rate=0.2, Avg. Rate=0.4, Surrogate Model=Qwen-VL, Target Model=LLaVA2026.01 | 0.4853 | 0.2999 | |
| T-CAALayer=2,8, Rate=0.2,0.1, Avg. Rate=0.175, Surrogate Model=LLaVA, Target Model=LLaVA-NEXT2026.01 | 0.4999 | 0.3899 | |
| T-CAALayer=2,10, Rate=0.3,0.15, Avg. Rate=0.241, Surrogate Model=LLaVA, Target Model=Qwen-VL2026.01 | 0.505 | 0.3654 | |
| T-CAALayer=2,10, Rate=0.2,0.1, Avg. Rate=0.181, Surrogate Model=LLaVA, Target Model=LLaVA-NEXT2026.01 | 0.5077 | 0.3977 | |
| T-CAALayer=2,10, Rate=0.2,0.1, Avg. Rate=0.181, Surrogate Model=Qwen-VL, Target Model=LLaVA2026.01 | 0.5109 | 0.3255 | |
| T-CAALayer=2,8,16, Rate=0.2,0.1,0.1, Avg. Rate=0.175, Surrogate Model=LLaVA, Target Model=LLaVA-NEXT2026.01 | 0.5249 | 0.4149 | |
| T-CAALayer=8, Rate=0.1, Avg. Rate=0.325, Surrogate Model=LLaVA, Target Model=LLaVA-NEXT2026.01 | 0.5295 | 0.4194 | |
| T-CAALayer=2, Rate=0.2, Avg. Rate=0.25, Surrogate Model=LLaVA, Target Model=Qwen-VL2026.01 | 0.5338 | 0.3943 | |
| T-CAALayer=2, Rate=0.2, Avg. Rate=0.25, Surrogate Model=LLaVA, Target Model=LLaVA-NEXT2026.01 | 0.5461 | 0.4361 | |
| T-CAALayer=8, Rate=0.1, Avg. Rate=0.325, Surrogate Model=Qwen-VL, Target Model=LLaVA2026.01 | 0.5515 | 0.3662 | |
| T-CAALayer=2,8,16, Rate=0.2,0.1,0.1, Avg. Rate=0.175, Surrogate Model=LLaVA, Target Model=Qwen-VL2026.01 | 0.5787 | 0.4391 | |
| T-CAALayer=2,8,16, Rate=0.2,0.1,0.1, Avg. Rate=0.175, Surrogate Model=Qwen-VL, Target Model=LLaVA2026.01 | 0.5787 | 0.3933 | |
| T-CAALayer=2, Rate=0.2, Avg. Rate=0.25, Surrogate Model=Qwen-VL, Target Model=LLaVA2026.01 | 0.5791 | 0.3937 | |
| T-CAALayer=2,8, Rate=0.2,0.1, Avg. Rate=0.175, Surrogate Model=LLaVA, Target Model=Qwen-VL2026.01 | 0.5861 | 0.4465 | |
| T-CAALayer=2,10, Rate=0.2,0.1, Avg. Rate=0.181, Surrogate Model=LLaVA, Target Model=Qwen-VL2026.01 | 0.5966 | 0.457 | |
| T-CAALayer=2, Rate=0.1, Avg. Rate=0.156, Surrogate Model=LLaVA, Target Model=LLaVA-NEXT2026.01 | 0.6212 | 0.5111 | |
| T-CAALayer=2,8, Rate=0.2,0.1, Avg. Rate=0.175, Surrogate Model=Qwen-VL, Target Model=LLaVA2026.01 | 0.623 | 0.4376 | |
| T-CAALayer=2, Rate=0.1, Avg. Rate=0.156, Surrogate Model=LLaVA, Target Model=Qwen-VL2026.01 | 0.6591 | 0.5195 | |
| T-CAALayer=2, Rate=0.1, Avg. Rate=0.156, Surrogate Model=Qwen-VL, Target Model=LLaVA2026.01 | 0.6686 | 0.4833 |