Untargeted Adversarial Attack on ImageNet (LLM/VLM Evaluation)
99.3ASR (Average)MPCAttack
Evaluation results
| Method | Links | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| MPCAttackVictim Model=LLaVa-1.5-7B2026.03 | 99.3 | — | — | — | — | — | — | — | — | 1.86 | |
| MPCAttackVictim Model=InternVL3-8B2026.03 | 99.1 | — | — | — | — | — | — | — | — | 3.41 | |
| FOA-AttackVictim Model=LLaVa-1.5-7B2026.03 | 96.3 | — | — | — | — | — | — | — | — | 6.59 | |
| M-AttackVictim Model=LLaVa-1.5-7B2026.03 | 94.9 | — | — | — | — | — | — | — | — | 8.19 | |
| FOA-AttackVictim Model=InternVL3-8B2026.03 | 93 | — | — | — | — | — | — | — | — | 12.04 | |
| MPCAttackVictim Model=Average2026.03 | 92.1 | — | — | — | — | — | — | — | — | 10.68 | |
| M-AttackVictim Model=InternVL3-8B2026.03 | 90.8 | — | — | — | — | — | — | — | — | 14.17 | |
| MPCAttackVictim Type=Closed-Source MLLMs2026.03 | 90.55 | 98.7 | 5 | 99.2 | 5.24 | 66.7 | 32.58 | 97.6 | 6.13 | 12.24 | |
| MPCAttackVictim Model=GLM-4.1V-9B-Thinking2026.03 | 85.1 | — | — | — | — | — | — | — | — | 18.25 | |
| MPCAttackVictim Model=Qwen2.5-VL-7B2026.03 | 84.9 | — | — | — | — | — | — | — | — | 19.19 | |
| FOA-AttackVictim Type=Closed-Source MLLMs2026.03 | 82.63 | 93 | 12.66 | 90.7 | 14.2 | 61.8 | 37.02 | 85 | 18.98 | 20.72 | |
| FOA-AttackVictim Model=Average2026.03 | 79.8 | — | — | — | — | — | — | — | — | 21.7 | |
| M-AttackVictim Type=Closed-Source MLLMs2026.03 | 78.73 | 91.7 | 14.13 | 88.7 | 15.96 | 53.2 | 42.65 | 81.3 | 22.22 | 23.74 | |
| M-AttackVictim Model=Average2026.03 | 75.3 | — | — | — | — | — | — | — | — | 24.79 | |
| FOA-AttackVictim Model=GLM-4.1V-9B-Thinking2026.03 | 68.1 | — | — | — | — | — | — | — | — | 32.27 | |
| X-TransferVictim Model=LLaVa-1.5-7B2026.03 | 67.6 | — | — | — | — | — | — | — | — | 29.19 | |
| X-TransferVictim Model=Qwen2.5-VL-7B2026.03 | 66.2 | — | — | — | — | — | — | — | — | 31.78 | |
| FOA-AttackVictim Model=Qwen2.5-VL-7B2026.03 | 61.8 | — | — | — | — | — | — | — | — | 35.89 | |
| M-AttackVictim Model=GLM-4.1V-9B-Thinking2026.03 | 61.2 | — | — | — | — | — | — | — | — | 36.96 | |
| X-TransferVictim Model=InternVL3-8B2026.03 | 56.8 | — | — | — | — | — | — | — | — | 37.33 | |
| X-TransferVictim Model=Average2026.03 | 55.98 | — | — | — | — | — | — | — | — | 38.41 | |
| M-AttackVictim Model=Qwen2.5-VL-7B2026.03 | 54.3 | — | — | — | — | — | — | — | — | 39.82 | |
| X-TransferVictim Type=Closed-Source MLLMs2026.03 | 49.03 | 55.4 | 40.48 | 41.4 | 49.56 | 55.7 | 40.08 | 43.6 | 46.77 | 44.22 | |
| AnyAttackVictim Model=Qwen2.5-VL-7B2026.03 | 37.8 | — | — | — | — | — | — | — | — | 53.44 | |
| X-TransferVictim Model=GLM-4.1V-9B-Thinking2026.03 | 33.3 | — | — | — | — | — | — | — | — | 55.32 | |
| AnyAttackVictim Model=LLaVa-1.5-7B2026.03 | 28.2 | — | — | — | — | — | — | — | — | 60.29 | |
| AnyAttackVictim Model=Average2026.03 | 23.85 | — | — | — | — | — | — | — | — | 63.72 | |
| AnyAttackVictim Type=Closed-Source MLLMs2026.03 | 18.85 | 13.4 | 71.82 | 7.6 | 78.11 | 42.2 | 50.02 | 12.2 | 70.81 | 67.69 | |
| CoAVictim Model=LLaVa-1.5-7B2026.03 | 18.6 | — | — | — | — | — | — | — | — | 68.69 | |
| AnyAttackVictim Model=InternVL3-8B2026.03 | 16.6 | — | — | — | — | — | — | — | — | 68.75 | |
| CoAVictim Model=Qwen2.5-VL-7B2026.03 | 15.9 | — | — | — | — | — | — | — | — | 70.4 | |
| CoAVictim Type=Closed-Source MLLMs2026.03 | 13.53 | 7.4 | 76.33 | 5.1 | 80.79 | 36.1 | 55.95 | 5.5 | 79.64 | 73.18 | |
| AnyAttackVictim Model=GLM-4.1V-9B-Thinking2026.03 | 12.8 | — | — | — | — | — | — | — | — | 72.4 | |
| CoAVictim Model=Average2026.03 | 12.55 | — | — | — | — | — | — | — | — | 73.57 | |
| CoAVictim Model=InternVL3-8B2026.03 | 8.5 | — | — | — | — | — | — | — | — | 76.91 | |
| CoAVictim Model=GLM-4.1V-9B-Thinking2026.03 | 7.2 | — | — | — | — | — | — | — | — | 78.26 |