OpenRT - Multimodal Attacks: leaderboard
Nine jailbreaks that hide or carry the harmful request in an image (FigStep typography, HADES, MML, CS-DJ and others) are run against ten vision-language models; the number is the mean share judged as full compliance. The text board uses the same prompts without images.
Metric: Mean attack success rate over 9 image-based jailbreak methods (%, lower is better). Source: arxiv.org. 10 models tracked.
Top models
| # | Model | Score | Overall rank |
|---|---|---|---|
| 1 | GPT-5.2 | 14.89 | #176 |
| 2 | Claude Haiku 4.5 | 19.22 | #568 |
| 3 | Gemini 3 Pro (Preview) | 30.78 | #113 |
| 4 | GPT-5.1 | 34.61 | #229 |
| 5 | Grok 4.1 Fast | 35.22 | #430 |
| 6 | Llama 4 Maverick Instruct | 48 | #1133 |
| 7 | Llama 4 Scout Instruct | 48.33 | #1543 |
| 8 | Seed-1.6 | 49.94 | #448 |
| 9 | Mistral Large 3 | 53.11 | #817 |
| 10 | Gemini 2.5 Flash (Thinking) | 56 | #453 (Gemini 2.5 Flash) |
Interactive version: theaggregate.ai/benchmark?slug=openrt-multimodal-attacks · How It Works · Data refreshed daily, snapshot 2026-11-13.