about image size

[payphone131]

An image generated by HADES needs to be resized when it is sent into the image processor of the victim MLLM. Do you think that resizing the adversarial noise part will reduce the jailbreak ability of the image? If so, is it better to let the image size consistent with the default image size of the image processor when adding adversarial noise to it? Since the final image doesn't have to be resized when sent into the victim MLLM in this way.

[AoiDragon]

Hello @payphone131,
We agree with your point about image resolution. In practice, instead of optimizing and then attaching the blank image, we first attach the blank image to the original image before performing gradient updates. This ensures that the size of the adversarial image remains consistent with the training process.

[payphone131]

Thanks, what you say really helps. But I still wonder whether it will reduce the jailbreak ability of HADES if the victim MLLM uses an image processor demanding a fixed image size (such as 224*224) while the output images of HADES are not of this size.