Visual Jailbreaking Attack on MaliciousInstruct
92ASRFORCE
Evaluation Results
| Method | Links | ||
|---|---|---|---|
| FORCEArchitecture=Adapter-Based MLLMs, Target Model=InstructBlip-Vicuna-7B2025.12 | 92 | 12.8 | |
| FORCEArchitecture=Adapter-Based MLLMs, Target Model=InstructBlip-Vicuna-7B2025.09 | 92 | 12.8 | |
| DI-PGDTarget Model=InstructBlip2025.09 | 92 | — | |
| FORCETarget Model=InstructBlip2025.09 | 92 | — | |
| PGDArchitecture=Adapter-Based MLLMs, Target Model=InstructBlip-Vicuna-7B2025.12 | 84 | 20.75 | |
| PGDArchitecture=Adapter-Based MLLMs, Target Model=InstructBlip-Vicuna-7B2025.09 | 84 | 20.75 | |
| PGDTarget Model=InstructBlip2025.09 | 84 | — | |
| MLAITarget Model=InstructBlip2025.09 | 80 | — | |
| MI-PGDTarget Model=InstructBlip2025.09 | 78 | — | |
| FORCEArchitecture=Adapter-Based MLLMs, Target Model=Llava-v1.6-mistral-7b2025.12 | 69 | 39.73 | |
| FORCEArchitecture=Adapter-Based MLLMs, Target Model=Llava-v1.6-mistral-7b2025.09 | 69 | 39.73 | |
| FORCETarget Model=Llava-v1.62025.09 | 69 | — | |
| MLAITarget Model=Llava-v1.62025.09 | 66 | — | |
| DI-PGDTarget Model=Llava-v1.62025.09 | 65 | — | |
| FORCEArchitecture=Adapter-Based MLLMs, Target Model=Idefics3-8B-Llama32025.12 | 64 | 39.59 | |
| FORCEArchitecture=Adapter-Based MLLMs, Target Model=Idefics3-8B-Llama32025.09 | 64 | 39.59 | |
| FORCETarget Model=Idefics32025.09 | 64 | — | |
| DI-PGDTarget Model=Idefics32025.09 | 62 | — | |
| PGDArchitecture=Adapter-Based MLLMs, Target Model=Llava-v1.6-mistral-7b2025.12 | 61 | 44.95 | |
| PGDArchitecture=Adapter-Based MLLMs, Target Model=Llava-v1.6-mistral-7b2025.09 | 61 | 44.95 | |
| PGDTarget Model=Llava-v1.62025.09 | 61 | — | |
| MLAITarget Model=Idefics32025.09 | 61 | — | |
| EnsembleTarget Model=Idefics32025.09 | 60 | — | |
| MI-PGDTarget Model=Idefics32025.09 | 60 | — | |
| EnsembleTarget Model=Llava-v1.62025.09 | 59 | — | |
| PGDArchitecture=Adapter-Based MLLMs, Target Model=Idefics3-8B-Llama32025.12 | 53 | 50.73 | |
| PGDArchitecture=Adapter-Based MLLMs, Target Model=Idefics3-8B-Llama32025.09 | 53 | 50.73 | |
| PGDTarget Model=Idefics32025.09 | 53 | — | |
| MI-PGDTarget Model=Llava-v1.62025.09 | 49 | — | |
| FORCEArchitecture=Early-Fusion MLLMs, Target Model=Qwen2.5-VL-7B-Instruct2025.12 | 11 | 90.74 | |
| FORCEArchitecture=Early-Fusion MLLMs, Target Model=Qwen2.5-VL-7B-Instruct2025.09 | 11 | 90.74 | |
| FORCETarget Model=Qwen2.5-VL2025.09 | 11 | — | |
| PGDArchitecture=Commercial MLLMs, Target Model=Gemini-2.5-Pro2025.12 | 10 | 92.09 | |
| FORCEArchitecture=Commercial MLLMs, Target Model=Gemini-2.5-Pro2025.12 | 10 | 91.8 | |
| PGDArchitecture=Commercial MLLMs, Target Model=Gemini-2.5-Pro2025.09 | 10 | 92.09 | |
| FORCEArchitecture=Commercial MLLMs, Target Model=Gemini-2.5-Pro2025.09 | 10 | 91.8 | |
| DI-PGDTarget Model=Qwen2.5-VL2025.09 | 9 | — | |
| PGDArchitecture=Early-Fusion MLLMs, Target Model=Qwen2.5-VL-7B-Instruct2025.12 | 5 | 95.7 | |
| PGDArchitecture=Early-Fusion MLLMs, Target Model=Qwen2.5-VL-7B-Instruct2025.09 | 5 | 95.7 | |
| PGDTarget Model=Qwen2.5-VL2025.09 | 5 | — | |
| MI-PGDTarget Model=Qwen2.5-VL2025.09 | 5 | — | |
| EnsembleTarget Model=Qwen2.5-VL2025.09 | 4 | — | |
| MLAITarget Model=Qwen2.5-VL2025.09 | 3 | — | |
| FORCEArchitecture=Early-Fusion MLLMs, Target Model=Llama-3.2-11B-Vision-Instruct2025.12 | 2 | 98.14 | |
| FORCEArchitecture=Commercial MLLMs, Target Model=Claude-Sonnet-42025.12 | 2 | 98.86 | |
| FORCEArchitecture=Commercial MLLMs, Target Model=GPT-52025.12 | 2 | 98.02 | |
| FORCEArchitecture=Early-Fusion MLLMs, Target Model=Llama-3.2-11B-Vision-Instruct2025.09 | 2 | 98.14 | |
| FORCEArchitecture=Commercial MLLMs, Target Model=Claude-Sonnet-42025.09 | 2 | 98.86 | |
| FORCEArchitecture=Commercial MLLMs, Target Model=GPT-52025.09 | 2 | 98.02 | |
| EnsembleTarget Model=Llama-3.22025.09 | 2 | — | |
| MI-PGDTarget Model=Llama-3.22025.09 | 2 | — | |
| DI-PGDTarget Model=Llama-3.22025.09 | 2 | — | |
| MLAITarget Model=Llama-3.22025.09 | 2 | — | |
| FORCETarget Model=Llama-3.22025.09 | 2 | — | |
| PGDArchitecture=Early-Fusion MLLMs, Target Model=Llama-3.2-11B-Vision-Instruct2025.12 | 1 | 99.01 | |
| PGDArchitecture=Commercial MLLMs, Target Model=Claude-Sonnet-42025.12 | 1 | 99.68 | |
| PGDArchitecture=Commercial MLLMs, Target Model=GPT-52025.12 | 1 | 99.03 | |
| PGDArchitecture=Early-Fusion MLLMs, Target Model=Llama-3.2-11B-Vision-Instruct2025.09 | 1 | 99.01 | |
| PGDArchitecture=Commercial MLLMs, Target Model=Claude-Sonnet-42025.09 | 1 | 99.68 | |
| PGDArchitecture=Commercial MLLMs, Target Model=GPT-52025.09 | 1 | 99.03 | |
| PGDTarget Model=Llama-3.22025.09 | 1 | — |