Web Agent Attack on SeeAct
98.3ASR1MIRAGE
Evaluation results
| Method | Links | ||
|---|---|---|---|
| MIRAGEBackend=Phi2026.06 | 98.3 | 97.2 | |
| MIRAGEBackend=Qwen2026.06 | 97.1 | 95.6 | |
| MIRAGEBackend=LLaVA2026.06 | 95.7 | 90.4 | |
| MIRAGEBackend=Llama2026.06 | 95 | 70.2 | |
| WebInject*Backend=Phi2026.06 | 81.6 | 17.2 | |
| WebInject*Backend=LLaVA2026.06 | 79.1 | 75.4 | |
| WebInject*Backend=Qwen2026.06 | 59.5 | 41.7 | |
| Context IgnoringBackend=Qwen2026.06 | 35.6 | 27 | |
| WebInject*Backend=Llama2026.06 | 34.4 | 18.4 | |
| Popup AttackBackend=LLaVA2026.06 | 29.4 | 6.7 | |
| Context IgnoringBackend=Phi2026.06 | 23.9 | 4.3 | |
| Popup AttackBackend=Llama2026.06 | 23.3 | 8.1 | |
| Naive AttackBackend=Llama2026.06 | 22.7 | 8.6 | |
| Naive AttackBackend=Phi2026.06 | 21.5 | 3.7 | |
| Context IgnoringBackend=Llama2026.06 | 20.2 | 7.9 | |
| Naive AttackBackend=Qwen2026.06 | 19.6 | 16 | |
| Context IgnoringBackend=LLaVA2026.06 | 17.2 | 4.9 | |
| Popup AttackBackend=Qwen2026.06 | 16.6 | 9.8 | |
| Naive AttackBackend=LLaVA2026.06 | 16 | 6 | |
| Popup AttackBackend=Phi2026.06 | 15.3 | 3.7 | |
| EIABackend=Llama2026.06 | 13.5 | 3 | |
| EIABackend=Phi2026.06 | 12.9 | 3.1 | |
| EIABackend=LLaVA2026.06 | 12.3 | 2.5 | |
| EIABackend=Qwen2026.06 | 9.2 | 5.5 |