\begin{table}[h] \centering \caption{ Adversarial robustness on LLaVA-1.5-7B under $\ell_{\infty}$ perturbations with $\epsilon=4/255$. COCO and Flickr30k use CIDEr, while TextVQA and VQAv2 use VQA scores. } \label{tab:llava_robustness} \resizebox{\columnwidth}{!}{ \begin{tabular}{lccccc} \toprule \textbf{Method} \textbf{COCO} \textbf{Flickr} \textbf{TextVQA} \textbf{VQAv2} \textbf{Avg.} \\ \midrule TeCoA 30.3 15.3 8.8 21.8 19.05 \\ PMG-AFT 30.5 18.2 8.5 23.9 20.28 \\ FARE 31.0 17.5 9.1 23.0 20.15 \\ TGA-ZSR 31.1 17.7 8.7 23.1 20.15 \\ AdvSimplex 32.6 18.9 10.0 26.1 21.90 \\ AdPO 47.6 27.9 17.6 37.6 32.68 \\ ET3 61.1 37.1 17.1 40.0 38.83 \\ \midrule \textbf{Ours} \textbf{99.28} \textbf{58.71} \textbf{21.28} \textbf{61.02} \textbf{60.07} \\ \bottomrule \end{tabular} } \end{table}

\begin{table}[h] \centering \caption{ Adversarial robustness on LLaVA-1.5-7B under $\ell_{\infty}$ perturbations with $\epsilon=4/255$. COCO and Flickr30k use CIDEr, while TextVQA and VQAv2 use VQA scores. } \label{tab:llava_robustness} \resizebox{\columnwidth}{!}{ \begin{tabular}{lccccc} \toprule \textbf{Method} \textbf{COCO} \textbf{Flickr} \textbf{TextVQA} \textbf{VQAv2} \textbf{Avg.} \\ \midrule TeCoA 30.3 15.3 8.8 21.8 19.05 \\ PMG-AFT 30.5 18.2 8.5 23.9 20.28 \\ FARE 31.0 17.5 9.1 23.0 20.15 \\ TGA-ZSR 31.1 17.7 8.7 23.1 20.15 \\ AdvSimplex 32.6 18.9 10.0 26.1 21.90 \\ AdPO 47.6 27.9 17.6 37.6 32.68 \\ ET3 61.1 37.1 17.1 40.0 38.83 \\ \midrule \textbf{Ours} \textbf{99.28} \textbf{58.71} \textbf{21.28} \textbf{61.02} \textbf{60.07} \\ \bottomrule \end{tabular} } \end{table}