Table 2: Black-box attacks against victim models.

[CharmingKillr]

Is the MF-ii data of each VLM model in Table2 verified by transing the adversarial samples obtained from the image encoder that replaces the model ViT-B/32 or ViT-L/4 to the VLM model?

MF-ii+MF-it then queries each VLM on this basis