Visual Prompt Injection Defense on ImgHijack Leak Context
0Attack Success RateGradient-guided Token Masking
Evaluation results
| Method | Links | |
|---|---|---|
| Gradient-guided Token MaskingType=l∞, Setting=ϵ = 162026.05 | 0 | |
| Gradient-guided Token MaskingType=l∞, Setting=ϵ = 322026.05 | 0 | |
| Gradient-guided Token MaskingType=l∞, Setting=ϵ = 642026.05 | 0 | |
| Gradient-guided Token MaskingType=l∞, Setting=ϵ = ∞2026.05 | 0 | |
| Gradient-guided Token MaskingType=STATIONARY PATCH, Setting=SIZE = 80PX2026.05 | 0 | |
| Gradient-guided Token MaskingType=STATIONARY PATCH, Setting=SIZE = 100PX2026.05 | 0 | |
| W/O DefenseType=MOVING PATCH, Setting=SIZE = 320PX2026.05 | 0 | |
| Gradient-guided Token MaskingType=MOVING PATCH, Setting=SIZE = 320PX2026.05 | 0 | |
| DIFFPUREType=l∞, Setting=ϵ = 162026.05 | 0 | |
| Gradient-guided Token MaskingType=l∞, Setting=ϵ = 162026.05 | 0 | |
| DIFFPUREType=l∞, Setting=ϵ = 322026.05 | 0 | |
| Gradient-guided Token MaskingType=l∞, Setting=ϵ = 322026.05 | 0 | |
| DIFFPUREType=l∞, Setting=ϵ = 642026.05 | 0 | |
| Gradient-guided Token MaskingType=l∞, Setting=ϵ = 642026.05 | 0 | |
| DIFFPUREType=l∞, Setting=ϵ = ∞2026.05 | 0 | |
| Gradient-guided Token MaskingType=l∞, Setting=ϵ = ∞2026.05 | 0 | |
| DIFFPUREType=STATIONARY PATCH, Setting=SIZE = 80PX2026.05 | 0 | |
| Gradient-guided Token MaskingType=STATIONARY PATCH, Setting=SIZE = 80PX2026.05 | 0 | |
| DIFFPUREType=STATIONARY PATCH, Setting=SIZE = 100PX2026.05 | 0 | |
| Gradient-guided Token MaskingType=STATIONARY PATCH, Setting=SIZE = 100PX2026.05 | 0 | |
| W/O DEFENSEType=MOVING PATCH, Setting=SIZE = 320PX2026.05 | 0 | |
| DIFFPUREType=MOVING PATCH, Setting=SIZE = 320PX2026.05 | 0 | |
| ECSOType=MOVING PATCH, Setting=SIZE = 320PX2026.05 | 0 | |
| Gradient-guided Token MaskingType=MOVING PATCH, Setting=SIZE = 320PX2026.05 | 0 | |
| DIFFPUREType=MOVING PATCH, Setting=SIZE = 400PX2026.05 | 0 | |
| Gradient-guided Token MaskingType=MOVING PATCH, Setting=SIZE = 400PX2026.05 | 1.82 | |
| Gradient-guided Token MaskingType=MOVING PATCH, Setting=SIZE = 400PX2026.05 | 1.82 | |
| ECSOType=MOVING PATCH, Setting=SIZE = 400PX2026.05 | 40.91 | |
| W/O DefenseType=MOVING PATCH, Setting=SIZE = 400PX2026.05 | 41.82 | |
| W/O DEFENSEType=MOVING PATCH, Setting=SIZE = 400PX2026.05 | 41.82 | |
| W/O DefenseType=l∞, Setting=ϵ = 162026.05 | 67.27 | |
| W/O DEFENSEType=l∞, Setting=ϵ = 162026.05 | 67.27 | |
| ECSOType=l∞, Setting=ϵ = 162026.05 | 67.27 | |
| ECSOType=STATIONARY PATCH, Setting=SIZE = 100PX2026.05 | 95.45 | |
| W/O DefenseType=STATIONARY PATCH, Setting=SIZE = 100PX2026.05 | 97.27 | |
| ECSOType=STATIONARY PATCH, Setting=SIZE = 80PX2026.05 | 97.27 | |
| W/O DEFENSEType=STATIONARY PATCH, Setting=SIZE = 100PX2026.05 | 97.27 | |
| W/O DefenseType=STATIONARY PATCH, Setting=SIZE = 80PX2026.05 | 98.18 | |
| W/O DEFENSEType=STATIONARY PATCH, Setting=SIZE = 80PX2026.05 | 98.18 | |
| ECSOType=l∞, Setting=ϵ = 322026.05 | 99.09 | |
| ECSOType=l∞, Setting=ϵ = 642026.05 | 99.09 | |
| ECSOType=l∞, Setting=ϵ = ∞2026.05 | 99.09 | |
| W/O DefenseType=l∞, Setting=ϵ = 322026.05 | 100 | |
| W/O DefenseType=l∞, Setting=ϵ = 642026.05 | 100 | |
| W/O DefenseType=l∞, Setting=ϵ = ∞2026.05 | 100 | |
| W/O DEFENSEType=l∞, Setting=ϵ = 322026.05 | 100 | |
| W/O DEFENSEType=l∞, Setting=ϵ = 642026.05 | 100 | |
| W/O DEFENSEType=l∞, Setting=ϵ = ∞2026.05 | 100 |