Visual Jailbreaking Attack on HADES
72.66ASRFORCE
Evaluation Results
| Method | Links | ||
|---|---|---|---|
| FORCEArchitecture=Adapter-Based MLLMs, Target Model=Llava-v1.6-mistral-7b2025.12 | 72.66 | 33.05 | |
| FORCEArchitecture=Adapter-Based MLLMs, Target Model=Llava-v1.6-mistral-7b2025.09 | 72.66 | 33.05 | |
| PGDArchitecture=Adapter-Based MLLMs, Target Model=Llava-v1.6-mistral-7b2025.12 | 70 | 35.36 | |
| PGDArchitecture=Adapter-Based MLLMs, Target Model=Llava-v1.6-mistral-7b2025.09 | 70 | 35.36 | |
| FORCEArchitecture=Adapter-Based MLLMs, Target Model=Idefics3-8B-Llama32025.12 | 65.96 | 36.98 | |
| FORCEArchitecture=Adapter-Based MLLMs, Target Model=Idefics3-8B-Llama32025.09 | 65.96 | 36.98 | |
| PGDArchitecture=Adapter-Based MLLMs, Target Model=Idefics3-8B-Llama32025.12 | 63.07 | 40.11 | |
| PGDArchitecture=Adapter-Based MLLMs, Target Model=Idefics3-8B-Llama32025.09 | 63.07 | 40.11 | |
| FORCEArchitecture=Adapter-Based MLLMs, Target Model=InstructBlip-Vicuna-7B2025.12 | 49.2 | 54.44 | |
| FORCEArchitecture=Adapter-Based MLLMs, Target Model=InstructBlip-Vicuna-7B2025.09 | 49.2 | 54.44 | |
| PGDArchitecture=Adapter-Based MLLMs, Target Model=InstructBlip-Vicuna-7B2025.12 | 48.67 | 55.32 | |
| PGDArchitecture=Adapter-Based MLLMs, Target Model=InstructBlip-Vicuna-7B2025.09 | 48.67 | 55.32 | |
| FORCEArchitecture=Early-Fusion MLLMs, Target Model=Qwen2.5-VL-7B-Instruct2025.12 | 28.13 | 73.85 | |
| FORCEArchitecture=Early-Fusion MLLMs, Target Model=Qwen2.5-VL-7B-Instruct2025.09 | 28.13 | 73.85 | |
| PGDArchitecture=Early-Fusion MLLMs, Target Model=Qwen2.5-VL-7B-Instruct2025.12 | 25.33 | 76.25 | |
| PGDArchitecture=Early-Fusion MLLMs, Target Model=Qwen2.5-VL-7B-Instruct2025.09 | 25.33 | 76.25 | |
| FORCEArchitecture=Commercial MLLMs, Target Model=Gemini-2.5-Pro2025.12 | 19 | 82.85 | |
| FORCEArchitecture=Commercial MLLMs, Target Model=Gemini-2.5-Pro2025.09 | 19 | 82.85 | |
| PGDArchitecture=Commercial MLLMs, Target Model=Gemini-2.5-Pro2025.12 | 16 | 86.62 | |
| PGDArchitecture=Commercial MLLMs, Target Model=Gemini-2.5-Pro2025.09 | 16 | 86.62 | |
| FORCEArchitecture=Early-Fusion MLLMs, Target Model=Llama-3.2-11B-Vision-Instruct2025.12 | 10.26 | 90.56 | |
| FORCEArchitecture=Early-Fusion MLLMs, Target Model=Llama-3.2-11B-Vision-Instruct2025.09 | 10.26 | 90.56 | |
| PGDArchitecture=Early-Fusion MLLMs, Target Model=Llama-3.2-11B-Vision-Instruct2025.12 | 6.27 | 94.27 | |
| PGDArchitecture=Early-Fusion MLLMs, Target Model=Llama-3.2-11B-Vision-Instruct2025.09 | 6.27 | 94.27 | |
| FORCEArchitecture=Commercial MLLMs, Target Model=Claude-Sonnet-42025.12 | 5 | 95.86 | |
| FORCEArchitecture=Commercial MLLMs, Target Model=Claude-Sonnet-42025.09 | 5 | 95.86 | |
| PGDArchitecture=Commercial MLLMs, Target Model=Claude-Sonnet-42025.12 | 3 | 97.71 | |
| FORCEArchitecture=Commercial MLLMs, Target Model=GPT-52025.12 | 3 | 97.37 | |
| PGDArchitecture=Commercial MLLMs, Target Model=Claude-Sonnet-42025.09 | 3 | 97.71 | |
| FORCEArchitecture=Commercial MLLMs, Target Model=GPT-52025.09 | 3 | 97.37 | |
| PGDArchitecture=Commercial MLLMs, Target Model=GPT-52025.12 | 1 | 99.97 | |
| PGDArchitecture=Commercial MLLMs, Target Model=GPT-52025.09 | 1 | 99.97 |