List your company
ResearchFormerly WizWand

Visual Jailbreaking Attack on MaliciousInstruct

92ASRFORCE
-2.6421.9346.571.07Sep 25, 2025Oct 10, 2025Oct 25, 2025Nov 9, 2025Nov 24, 2025Dec 9, 2025Dec 24, 2025
Updated 8mo ago

Evaluation results

MethodLinks
FORCEArchitecture=Adapter-Based MLLMs, Target Model=InstructBlip-Vicuna-7B2025.129212.8
FORCEArchitecture=Adapter-Based MLLMs, Target Model=InstructBlip-Vicuna-7B2025.099212.8
DI-PGDTarget Model=InstructBlip2025.0992—
FORCETarget Model=InstructBlip2025.0992—
PGDArchitecture=Adapter-Based MLLMs, Target Model=InstructBlip-Vicuna-7B2025.128420.75
PGDArchitecture=Adapter-Based MLLMs, Target Model=InstructBlip-Vicuna-7B2025.098420.75
PGDTarget Model=InstructBlip2025.0984—
MLAITarget Model=InstructBlip2025.0980—
MI-PGDTarget Model=InstructBlip2025.0978—
FORCEArchitecture=Adapter-Based MLLMs, Target Model=Llava-v1.6-mistral-7b2025.126939.73
FORCEArchitecture=Adapter-Based MLLMs, Target Model=Llava-v1.6-mistral-7b2025.096939.73
FORCETarget Model=Llava-v1.62025.0969—
MLAITarget Model=Llava-v1.62025.0966—
DI-PGDTarget Model=Llava-v1.62025.0965—
FORCEArchitecture=Adapter-Based MLLMs, Target Model=Idefics3-8B-Llama32025.126439.59
FORCEArchitecture=Adapter-Based MLLMs, Target Model=Idefics3-8B-Llama32025.096439.59
FORCETarget Model=Idefics32025.0964—
DI-PGDTarget Model=Idefics32025.0962—
PGDArchitecture=Adapter-Based MLLMs, Target Model=Llava-v1.6-mistral-7b2025.126144.95
PGDArchitecture=Adapter-Based MLLMs, Target Model=Llava-v1.6-mistral-7b2025.096144.95
PGDTarget Model=Llava-v1.62025.0961—
MLAITarget Model=Idefics32025.0961—
EnsembleTarget Model=Idefics32025.0960—
MI-PGDTarget Model=Idefics32025.0960—
EnsembleTarget Model=Llava-v1.62025.0959—
PGDArchitecture=Adapter-Based MLLMs, Target Model=Idefics3-8B-Llama32025.125350.73
PGDArchitecture=Adapter-Based MLLMs, Target Model=Idefics3-8B-Llama32025.095350.73
PGDTarget Model=Idefics32025.0953—
MI-PGDTarget Model=Llava-v1.62025.0949—
FORCEArchitecture=Early-Fusion MLLMs, Target Model=Qwen2.5-VL-7B-Instruct2025.121190.74
FORCEArchitecture=Early-Fusion MLLMs, Target Model=Qwen2.5-VL-7B-Instruct2025.091190.74
FORCETarget Model=Qwen2.5-VL2025.0911—
PGDArchitecture=Commercial MLLMs, Target Model=Gemini-2.5-Pro2025.121092.09
FORCEArchitecture=Commercial MLLMs, Target Model=Gemini-2.5-Pro2025.121091.8
PGDArchitecture=Commercial MLLMs, Target Model=Gemini-2.5-Pro2025.091092.09
FORCEArchitecture=Commercial MLLMs, Target Model=Gemini-2.5-Pro2025.091091.8
DI-PGDTarget Model=Qwen2.5-VL2025.099—
PGDArchitecture=Early-Fusion MLLMs, Target Model=Qwen2.5-VL-7B-Instruct2025.12595.7
PGDArchitecture=Early-Fusion MLLMs, Target Model=Qwen2.5-VL-7B-Instruct2025.09595.7
PGDTarget Model=Qwen2.5-VL2025.095—
MI-PGDTarget Model=Qwen2.5-VL2025.095—
EnsembleTarget Model=Qwen2.5-VL2025.094—
MLAITarget Model=Qwen2.5-VL2025.093—
FORCEArchitecture=Early-Fusion MLLMs, Target Model=Llama-3.2-11B-Vision-Instruct2025.12298.14
FORCEArchitecture=Commercial MLLMs, Target Model=Claude-Sonnet-42025.12298.86
FORCEArchitecture=Commercial MLLMs, Target Model=GPT-52025.12298.02
FORCEArchitecture=Early-Fusion MLLMs, Target Model=Llama-3.2-11B-Vision-Instruct2025.09298.14
FORCEArchitecture=Commercial MLLMs, Target Model=Claude-Sonnet-42025.09298.86
FORCEArchitecture=Commercial MLLMs, Target Model=GPT-52025.09298.02
EnsembleTarget Model=Llama-3.22025.092—
MI-PGDTarget Model=Llama-3.22025.092—
DI-PGDTarget Model=Llama-3.22025.092—
MLAITarget Model=Llama-3.22025.092—
FORCETarget Model=Llama-3.22025.092—
PGDArchitecture=Early-Fusion MLLMs, Target Model=Llama-3.2-11B-Vision-Instruct2025.12199.01
PGDArchitecture=Commercial MLLMs, Target Model=Claude-Sonnet-42025.12199.68
PGDArchitecture=Commercial MLLMs, Target Model=GPT-52025.12199.03
PGDArchitecture=Early-Fusion MLLMs, Target Model=Llama-3.2-11B-Vision-Instruct2025.09199.01
PGDArchitecture=Commercial MLLMs, Target Model=Claude-Sonnet-42025.09199.68
PGDArchitecture=Commercial MLLMs, Target Model=GPT-52025.09199.03
PGDTarget Model=Llama-3.22025.091—