\begin{table}[t] \centering \caption{ Performance on LLaVA-1.5-7B under $\ell_{\infty}$ perturbations ($\epsilon=4/255$). COCO and Flickr30k use CIDEr, while TextVQA and VQAv2 use VQA scores. The CLIP (Clean) row reports performance on unperturbed inputs, while all remaining rows report adversarial performance. Our method uses $M=2$ symmetric probe pairs. } \label{tab:llava_robustness} \setlength{\tabcolsep}{4pt} \renewcommand{\arraystretch}{1.08} \resizebox{\columnwidth}{!}{ \begin{tabular}{lccccc} \toprule \textbf{Method} \textbf{COCO} \textbf{Flickr} \textbf{TextVQA} \textbf{VQAv2} \textbf{Avg.} \\ \midrule CLIP (Clean)$^{*}$ 115.5 77.5 37.1 74.5 76.2 \\ CLIP (Adversarial) 2.85 1.01 0.00 0.20 1.02 \\ \midrule TeCoA 30.3 15.3 8.8 21.8 19.05 \\ PMG-AFT 30.5 18.2 8.5 23.9 20.28 \\ FARE 31.0 17.5 9.1 23.0 20.15 \\ TGA-ZSR 31.1 17.7 8.7 23.1 20.15 \\ AdvSimplex 32.6 18.9 10.0 26.1 21.90 \\ AdPO 47.6 27.9 17.6 37.6 32.68 \\ ET3 61.1 37.1 17.1 40.0 38.83 \\ \midrule \textbf{Ours ($M=2$)} \textbf{98.18} \textbf{61.19} \textbf{22.18} \textbf{59.22} \textbf{60.19} \\ \bottomrule \end{tabular} } \vspace{1mm} \begin{minipage}{\columnwidth} \footnotesize $^{*}$ Clean CLIP results are taken from ET3. The adversarial CLIP baseline and Ours are from our local evaluations. TextVQA adversarial results are pending validation of the attack-cache protocol. \end{minipage} \end{table}

\begin{table}[t] \centering \caption{ Performance on LLaVA-1.5-7B under $\ell_{\infty}$ perturbations ($\epsilon=4/255$). COCO and Flickr30k use CIDEr, while TextVQA and VQAv2 use VQA scores. The CLIP (Clean) row reports performance on unperturbed inputs, while all remaining rows report adversarial performance. Our method uses $M=2$ symmetric probe pairs. } \label{tab:llava_robustness} \setlength{\tabcolsep}{4pt} \renewcommand{\arraystretch}{1.08} \resizebox{\columnwidth}{!}{ \begin{tabular}{lccccc} \toprule \textbf{Method} \textbf{COCO} \textbf{Flickr} \textbf{TextVQA} \textbf{VQAv2} \textbf{Avg.} \\ \midrule CLIP (Clean)$^{*}$ 115.5 77.5 37.1 74.5 76.2 \\ CLIP (Adversarial) 2.85 1.01 0.00 0.20 1.02 \\ \midrule TeCoA 30.3 15.3 8.8 21.8 19.05 \\ PMG-AFT 30.5 18.2 8.5 23.9 20.28 \\ FARE 31.0 17.5 9.1 23.0 20.15 \\ TGA-ZSR 31.1 17.7 8.7 23.1 20.15 \\ AdvSimplex 32.6 18.9 10.0 26.1 21.90 \\ AdPO 47.6 27.9 17.6 37.6 32.68 \\ ET3 61.1 37.1 17.1 40.0 38.83 \\ \midrule \textbf{Ours ($M=2$)} \textbf{98.18} \textbf{61.19} \textbf{22.18} \textbf{59.22} \textbf{60.19} \\ \bottomrule \end{tabular} } \vspace{1mm} \begin{minipage}{\columnwidth} \footnotesize $^{*}$ Clean CLIP results are taken from ET3. The adversarial CLIP baseline and Ours are from our local evaluations. TextVQA adversarial results are pending validation of the attack-cache protocol. \end{minipage} \end{table}