Pith. sign in

REVIEW 5 major objections 6 minor 49 references

Secure Tug-of-War (SecTOW): Iterative Defense-Attack Training with Reinforcement Learning for Multimodal Model Security

T0 review · 5 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read SecTOW claims an iterative attacker–defender reinforcement loop cuts jailbreak success from 0.6726 to 0.0298 on MM-SafetyBench while preserving general accuracy.

desk verdict A genuinely new iterative attacker-defender RL loop with strong reported numbers, but the single safety judge makes the robustness claim narrower than stated. read the letter →

arxiv 2507.22037 v1 pith:775K5QPV submitted 2025-07-29 cs.CR cs.AI

Muzhi Dai , Shixuan Liu , Zhiyuan Zhao , Junyu Gao , Hao Sun , Xuelong Li This is my paper
classification cs.CRcs.AI
keywords multimodallargelanguagemodelsjailbreakattacksdefense-attacktrainingGRPOreinforcementlearningiterativeadversarialover-refusalmitigationsyntheticdatasafety
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

SecTOW is an iterative training method that hardens a multimodal large language model against image–query jailbreak attacks by repeatedly making an attacker better at breaking the model, then retraining the model on the attacker's successful jailbreaks. The paper's central claim is that this tug-of-war—implemented with group-relative policy optimization and simple rule-based rewards—sharply reduces attack success rates on four safety benchmarks while preserving general accuracy, avoiding the over-refusal problem of supervised fine-tuning. After three iterations, for example, MM-SafetyBench attack success drops from 0.6726 to 0.0298 and FigStep from 0.3320 to 0.0, while MMMU accuracy stays within 0.001 of the base model. This matters because existing defences either rely on external guardrails that do not fix intrinsic model vulnerabilities or use supervised fine-tuning that makes models refuse harmless queries.

What carries the argument

The machinery is an alternating GRPO training loop—group-relative policy optimization, a reinforcement-learning rule that scores each output against its group-mates rather than an absolute value model. The defender's reward is a rule-based refusal match: 1 when its behavior agrees with the label of whether rejection is required. The attacker's reward multiplies a binary attack-success score from an independent safety classifier by a format score enforcing the think/answer output structure. Filtering keeps only generated jailbreaks that defeat the defender in at least half of n sampled responses, and monitoring stops training when attacker-query diversity drops 10% or defender over-refusal exceeds 5%. This closed loop converts sparse harmful data into dense, targeted synthetic training data.

What would settle it

Score the three-iteration SecTOW defender on the same jailbreak inputs using human annotators instead of the automated safety judge it was trained against; if human-scored attack success approaches the base model's 0.6726 on MM-SafetyBench, the reported defence is an artefact of judge-specific optimisation rather than genuine robustness.

Watch

Extended reading notes

Core claim

The central discovery is that adversarial pressure can be built into the training loop of the model itself. SecTOW pairs a defender with an attacker, both trained by group-relative policy optimization; the attacker is rewarded when the defender produces a harmful response, and its successful jailbreak queries—after filtering and quality monitoring—become the defender's next training batch. On the paper's measurements this loop drives attack success rate from 0.6726 to 0.0298 on MM-SafetyBench and to 0.0 on FigStep after three iterations, while MMMU accuracy remains 0.5422 versus 0.5411. The claim is that intrinsic, guardrail-free security can be improved iteratively without the over-refusal penalty that supervised fine-tuning incurs.

Load-bearing premise

The entire loop assumes the external safety judge used for attacker rewards and data filtering correctly recognises harmful responses; if that judge is biased, noisy, or gameable, the defender learns to satisfy the judge rather than to be genuinely safe.

Editorial extensions

If this is right

  • Three iterations of SecTOW reduce MM-SafetyBench attack success from 0.6726 to 0.0298 and FigStep from 0.3320 to 0.0, so the method's effect is large enough to be visible on individual widely used benchmarks.
  • General capability holds: MMMU accuracy is 0.5422 after training versus 0.5411 for the base model, with over-refusal at 0.0078 rather than the 0.2056 seen with plain supervised fine-tuning.
  • The ablations show the iteration mechanism, both monitoring mechanisms, and the cold start are all load-bearing; removing any one raises ASR by roughly 4x to over 10x on some benchmarks.
  • The attacker's own success rate rises from 0.3393 after one iteration to 0.5509 after three, meaning the defender is being trained against progressively stronger attacks rather than the same fixed set.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because the attacker is rewarded only when the external safety judge calls the defender's response harmful, SecTOW's measured gains are at risk whenever that judge can be fooled; an immediate test is to re-score the defender's responses with a different judge or human annotators.
  • The loop can be viewed as an automated red-teaming generator: its third-iteration attacker produces jailbreak queries with a 0.5509 success rate against the base defender, suggesting the same attacker could audit other multimodal models or seed harder evaluation sets.
  • A natural ablation not reported in the paper would train the defender by supervised fine-tuning on the same filtered synthetic jailbreak set; if the ASR matched SecTOW's, the contribution of GRPO would reduce to data generation rather than policy optimisation.
  • If the trend continues beyond three iterations, one might expect further ASR reductions until the judge's own blind spots bound the achievable security, at which point hardening the judge itself would become the next step.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. SecTOW is an iterative defense-attack training method for multimodal large language models. A defender and an auxiliary attacker, both initialized from Qwen2-VL-7B, are alternately trained with GRPO. The attacker generates or refines jailbreak image-query pairs and receives reward when the defender's response is judged unsafe by Llama-Guard-3; the resulting successful attacks are filtered and added to the defender's training set. The defender is rewarded by a rule-based refusal check against response labels, and quality monitors are used to limit over-refusal and preserve attacker diversity. Experiments report large ASR reductions on JailBreakV-28k, FigStep, SafeBench, and MM-SafetyBench while roughly preserving MMMU and MMMU-Pro accuracy, with ablations supporting the cold start, monitoring, and iterative components.

Significance. The paper proposes a genuinely iterative attacker-defender formulation, uses reward-based data expansion that avoids detailed generative labels, and explicitly separates the defender's reward from the attacker's harm judgment by using an external safety evaluator. The reported effects are large, and the ablations and case studies give some support for the mechanism. If the results are robust, the method is a useful step toward automated, continuously improving safety tuning of MLLMs. However, confidence is tempered by the absence of multiple seeds, error bars, code release, and same-protocol baseline comparisons, and by the heavy reliance on a single external harm classifier in the training loop.

major comments (5)
  1. [§3.2.2 (Eq. 1), §3.3.2, §4.1] The attacker's reward and the data filter are both driven solely by Llama-Guard-3's unsafe/safe decision on the defender's response. This creates strong selection pressure to exploit whatever artifacts Llama-Guard-3 is sensitive to, and the defender is then trained on samples selected by that same judge. The paper reports no agreement analysis between Llama-Guard-3 and human ratings or an independent judge, and no training run with an alternative evaluator. The reported ASR drops on the four safety benchmarks could therefore reflect correlation between Llama-Guard-3's judgments and the benchmark labels rather than intrinsic robustness. A concrete test is needed: report human or independent-judge agreement on a sample of defender responses, and rerun at least one training iteration with a different harm judge, then report ASR under both judges.
  2. [§4.2, Table 2] The comparison with Adashield, MLLM-Protector, MMS, and MIRage uses 'their highest performance reported' rather than re-running those methods under SecTOW's evaluation protocol. Since ASR can depend on the judge model, sampling temperature, number of samples, and prompt template, literature-reported numbers are not necessarily comparable to the numbers produced here. The state-of-the-art claim in Section 4.2 is load-bearing and needs a same-protocol comparison, or at minimum a table documenting the evaluation protocol used in each cited source and the exact protocol used in this paper.
  3. [§4.2, Tables 1 and 2] The manuscript never states which judge or protocol is used to compute ASR on JailBreakV-28k, FigStep, SafeBench, and MM-SafetyBench. If the benchmark ASRs are computed with Llama-Guard-3, the evaluation is partly circular with the attacker's training reward; if they are computed by each benchmark's native judge, that needs to be stated and the judge models reported. Without this information, the central numbers in Tables 1 and 2 cannot be independently interpreted.
  4. [§4.5, Table 3] The 'w/o Iteration mechanism' row reports exactly the same values as SecTOW after one iteration in Table 1 (JailBreakV-28k ASR 0.0261, MM-SafetyBench ASR 0.0522, MMMU ACC 0.5444, ORR 0.0033). This ablation therefore compares one iteration against three iterations; it does not remove the iteration mechanism. The text interprets this as removing the core iteration mechanism, which is not supported by the experimental design. Please rename the setting or add a true no-iteration baseline, such as the cold-start defender only, to isolate the iterative contribution.
  5. [§4.2, Tables 1 and 3] All safety and general numbers come from a single run with no standard errors, confidence intervals, or significance tests. Several comparisons involve small absolute differences, such as JailBreakV-28k ASR 0.0061 after three iterations versus 0.0130 after two iterations, and MMMU ACC 0.5422 versus the base model's 0.5411. Without multiple seeds or bootstrap intervals, it is not possible to determine whether the reported improvements and the stability of general performance are meaningful. Please report variance over at least three seeds or bootstrap confidence intervals.
minor comments (6)
  1. [§3.4, Eq. (3)] The text 'Dval-general dateset' should read 'dataset,' and the function Refuse(i, q) should be defined operationally rather than only by the verbal description.
  2. [§3.4] The early-stopping thresholds (10% diversity drop and 5% ORR) are presented without sensitivity analysis; please state whether the main results are robust to reasonable changes in these thresholds.
  3. [Table 2] The heading misspells 'JailBreakV-28k' as 'JailBreaV-28k'.
  4. [§5] The conclusion spells the method name as 'SceTOW' instead of 'SecTOW'.
  5. [§3.3.2] The filtering criterion uses n samples, but n is never specified; please report the value of n, the resulting dataset sizes after filtering, and the effect of varying n.
  6. [§3.4] The similarity metric is described only by a URL to 'Fuzzy'; please provide a version and specify how similarity is computed for multimodal query-image pairs.

Circularity Check

0 steps flagged · score 1.0 of 10

No substantive circularity: the training loop uses external judges and independent benchmarks, with only minor non-load-bearing self-citations.

full rationale

SecTOW's derivation chain is not circular in the logical sense. The defender is trained with a rule-based reward (Section 3.2.1) that compares the model's refusal behavior to explicit labels from the training data, not to the evaluation benchmarks. The attacker's reward (Section 3.2.2, Eq. 1) depends on an external safety classifier, Llama-Guard-3, judging whether the defender's response is unsafe, and the same classifier is used in the data filtering step (Section 3.3.2) to select successful attacks. This shared judge creates a co-adaptation dynamic, but it does not make the final claims definitional: the reported ASR numbers are measured on held-out external benchmarks (JailBreakV-28k, FigStep, SafeBench, MM-SafetyBench) whose labels are not used to fit any constant in SecTOW. A possible weakness is that Llama-Guard-3's judgments may correlate with benchmark labels imperfectly, but that is an empirical robustness concern, not circularity. The references to the authors' own prior works (Dai et al., 2025a,c) appear only as examples of GRPO adoption in the related-work discussion; they are not load-bearing premises for the method or results. No equation reduces a reported prediction to a training input, and no parameter fitted to the evaluated benchmarks is renamed as a prediction. Accordingly, the appropriate finding is no significant circularity.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The central claim rests on a handful of empirical assumptions: the external safety evaluator, benchmark correctness, rule-based refusal detection, standard GRPO behavior, and the validity of filtered generated data. The tunable thresholds are explicit in the paper but are not sensitivity-analyzed, which weakens confidence in how robust the reported trade-off is.

free parameters (5)
  • Attack success filter threshold = n/2
    Generated jailbreak pairs are kept only if the defender is successfully attacked in at least half of n samples. This binary threshold determines which synthetic data enter the defender's training set and is not sensitivity-analyzed.
  • Diversity early-stop threshold = 10% decrease
    Attacker training is stopped when the diversity score on the validation set drops by 10% relative to initial metrics. The value is empirically chosen and not ablated.
  • Over-refusal early-stop threshold = ORR reaches 5%
    Defender training is stopped when the over-refusal rate on the general validation set reaches 5%. This directly controls the helpfulness-security trade-off and is not varied.
  • Number of iterations K = 3
    The paper runs three rounds of attacker-defender training and does not study how performance would change with more or fewer rounds.
  • Refusal detection vocabulary set = not specified
    The rule-based defender reward and the over-refusal rate both depend on a vocabulary set of refusal phrases, but the composition and coverage of this set are not reported.
assumptions (5)
  • domain assumption Llama-Guard-3 correctly identifies unsafe defender responses.
    The attacker reward and the data filtering loop rely on this external classifier's verdicts. If it mislabels, the attacker optimizes the wrong objective. Invoked in Sections 3.2.2 and 3.3.2.
  • domain assumption The safety and general benchmarks are valid and correctly applied.
    All conclusions depend on JailBreakV-28k, FigStep, MM-SafetyBench, SafeBench, MMMU, and MMMU-Pro being representative and accurately scored. The paper does not analyze label noise or evaluation-pipeline variance.
  • domain assumption Rule-based refusal detection via a vocabulary set correctly determines whether the defender refused.
    The defender reward, the ORR, and the quality monitoring all depend on this binary check, yet the vocabulary set and any preprocessing are not described.
  • standard math GRPO behaves as described in prior work and can train multimodal models with binary rewards.
    The paper relies on the standard GRPO algorithm from Shao et al. (2024) without modification or additional justification.
  • domain assumption Filtered generated queries from harmless images are genuine jailbreak queries.
    New jailbreak data are synthesized from open-source harmless image datasets. The majority-attack-success filter assumes that any query that makes the current defender answer unsafely is a real safety-relevant vulnerability rather than a distribution artifact.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Secure Tug-of-War (SecTOW): Iterative Defense-Attack Training with Reinforcement Learning for Multimodal Model Security." pith.science (2026). https://pith.science/paper/775K5QPV

@misc{pith2026250722037,
  author       = {Pith},
  title        = {Pith review of: Secure Tug-of-War (SecTOW): Iterative Defense-Attack Training with Reinforcement Learning for Multimodal Model Security},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/775K5QPV}},
  note         = {Machine review of arXiv:2507.22037}
}
read the original abstract

The rapid advancement of multimodal large language models (MLLMs) has led to breakthroughs in various applications, yet their security remains a critical challenge. One pressing issue involves unsafe image-query pairs--jailbreak inputs specifically designed to bypass security constraints and elicit unintended responses from MLLMs. Compared to general multimodal data, such unsafe inputs are relatively sparse, which limits the diversity and richness of training samples available for developing robust defense models. Meanwhile, existing guardrail-type methods rely on external modules to enforce security constraints but fail to address intrinsic vulnerabilities within MLLMs. Traditional supervised fine-tuning (SFT), on the other hand, often over-refuses harmless inputs, compromising general performance. Given these challenges, we propose Secure Tug-of-War (SecTOW), an innovative iterative defense-attack training method to enhance the security of MLLMs. SecTOW consists of two modules: a defender and an auxiliary attacker, both trained iteratively using reinforcement learning (GRPO). During the iterative process, the attacker identifies security vulnerabilities in the defense model and expands jailbreak data. The expanded data are then used to train the defender, enabling it to address identified security vulnerabilities. We also design reward mechanisms used for GRPO to simplify the use of response labels, reducing dependence on complex generative labels and enabling the efficient use of synthetic data. Additionally, a quality monitoring mechanism is used to mitigate the defender's over-refusal of harmless inputs and ensure the diversity of the jailbreak data generated by the attacker. Experimental results on safety-specific and general benchmarks demonstrate that SecTOW significantly improves security while preserving general performance.

Figures

Figures reproduced from arXiv: 2507.22037 by the authors.

Figure 1
Figure 1. An example of how a multimodal language model responds to a jailbreak request. (Wang et al., 2024b; Pi et al., 2024; Kim et al., 2024). While these methods provide basic protec￾tion, they are inherently limited by their reliance on external modules, which struggle to counter so￾phisticated attack patterns. More critically, black￾box approaches fail to address the intrinsic vulner￾abilities embedded within MLLMs. In … view at source ↗
Figure 2
Figure 2. The framework of SecTOW. The SecTOW consists of a defender and an attacker module, which engage in [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Attack Success Rate (ASR) of different attack [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Two cases of the iterative SecTOW defense-attack process. Case A shows the generation of a new jailbreak [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

49 extracted references · 19 canonical work pages

  1. [1]

    Arash Ahmadian, Chris Cremer, Matthias Gall \'e , Marzieh Fadaee, Julia Kreutzer, Olivier Pietquin, Ahmet \"U st \"u n, and Sara Hooker. 2024. Back to basics: Revisiting reinforce-style optimization for learning from human feedback in llms. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), ...

    work page 2024

  2. [2]

    Eugene Bagdasaryan, Tsung-Yin Hsieh, Ben Nassi, and Vitaly Shmatikov. 2023. Abusing images and sounds for indirect instruction injection in multi-modal llms. arXiv preprint arXiv:2307.10490

    arXiv 2023

  3. [3]

    Jinze Bai, Shuai Bai, Shusheng Yang, Shijie Wang, Sinan Tan, Peng Wang, Junyang Lin, Chang Zhou, and Jingren Zhou. 2023. https://arxiv.org/abs/2308.12966 Qwen-vl: A versatile vision-language model for understanding, localization, text reading, and beyond . Preprint, arXiv:2308.12966

    arXiv 2023

  4. [4]

    Yuntao Bai, Andy Jones, Kamal Ndousse, Amanda Askell, Anna Chen, Nova DasSarma, Dawn Drain, Stanislav Fort, Deep Ganguli, Tom Henighan, et al. 2022. Training a helpful and harmless assistant with reinforcement learning from human feedback. arXiv preprint arXiv:2204.05862

    arXiv 2022

  5. [5]

    Luke Bailey, Euan Ong, Stuart Russell, and Scott Emmons. 2023. Image hijacks: Adversarial images can control generative models at runtime. arXiv preprint arXiv:2309.00236

    arXiv 2023

  6. [6]

    Nicholas Carlini, Milad Nasr, Christopher A Choquette-Choo, Matthew Jagielski, Irena Gao, Pang Wei W Koh, Daphne Ippolito, Florian Tramer, and Ludwig Schmidt. 2023. Are aligned neural networks adversarially aligned? Advances in Neural Information Processing Systems, 36:61478--61500

    work page 2023

  7. [7]

    Jianfeng Chi, Ujjwal Karn, Hongyuan Zhan, Eric Smith, Javier Rando, Yiming Zhang, Kate Plawiak, Zacharie Delpierre Coudert, Kartikeya Upasani, and Mahesh Pasupuleti. 2024. Llama guard 3 vision: Safeguarding human-ai image understanding conversations. arXiv preprint arXiv:2411.10414

    arXiv 2024

  8. [8]

    Muzhi Dai, Shixuan Liu, and Qingyi Si. 2025 a . https://arxiv.org/abs/2505.18086 Stable reinforcement learning for efficient reasoning . Preprint, arXiv:2505.18086

    arXiv 2025

Show all 49 references
  1. [9]

    Muzhi Dai, Jiashuo Sun, Zhiyuan Zhao, Shixuan Liu, Rui Li, Junyu Gao, and Xuelong Li. 2025 b . https://arxiv.org/abs/2503.06260 From captions to rewards (carevl): Leveraging large language model experts for enhanced reward modeling in large vision-language models . Preprint, a...

    2025 arXiv

  2. [10]

    Muzhi Dai, Chenxu Yang, and Qingyi Si. 2025 c . https://arxiv.org/abs/2505.07686 S-grpo: Early exit via reinforcement learning in reasoning models . Preprint, arXiv:2505.07686

    2025 arXiv

  3. [11]

    Yi Ding, Lijun Li, Bing Cao, and Jing Shao. 2025. Rethinking bottlenecks in safety fine-tuning of vision language models. arXiv preprint arXiv:2501.18533

    2025

  4. [12]

    Raft: Reward ranked finetuning for generative foundation model alignment

    Hanze Dong, Wei Xiong, Deepanshu Goyal, Yihan Zhang, Winnie Chow, Rui Pan, Shizhe Diao, Jipeng Zhang, SHUM KaShun, and Tong Zhang. Raft: Reward ranked finetuning for generative foundation model alignment. Transactions on Machine Learning Research

  5. [13]

    Xiaoyu Fan, Muzhi Dai, Chenxi Liu, Fan Wu, Xiangda Yan, Ye Feng, Yongqiang Feng, and Baiquan Su. 2019. Effect of image noise on the classification of skin lesions using deep convolutional neural networks. Tsinghua Science and Technology, 25(3):425--434

    2019

  6. [14]

    Yichen Gong, Delong Ran, Jinyuan Liu, Conglei Wang, Tianshuo Cong, Anyu Wang, Sisi Duan, and Xiaoyun Wang. 2023. Figstep: Jailbreaking large vision-language models via typographic visual prompts. arXiv preprint arXiv:2311.05608

    2023 arXiv

  7. [15]

    Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, et al. 2024. https://arxiv.org/abs/2407.21783 The llama 3 herd of models . Preprint, arXiv:2407.21783

    2024 arXiv

  8. [16]

    Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiao Bi, et al. 2025. Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning. arXiv preprint arXiv:2501.12948

    2025 arXiv

  9. [17]

    Yangyang Guo, Fangkai Jiao, Liqiang Nie, and Mohan Kankanhalli. 2024. The vllm safety paradox: Dual ease in jailbreak attack and defense. arXiv preprint arXiv:2411.08410

    2024 arXiv

  10. [18]

    Xiaoheng Jiang, Yanwei Pang, Xuelong Li, Jing Pan, and Yinghong Xie. 2018. Deep neural networks with elastic rectified linear units for object recognition. Neurocomputing, 275:1132--1139

    2018

  11. [19]

    Heegyu Kim, Sehyun Yuk, and Hyunsouk Cho. 2024. Break the breakout: Reinventing lm defense against jailbreak attacks with self-refinement. arXiv preprint arXiv:2402.15180

    2024 arXiv

  12. [20]

    Julia Kreutzer, Artem Sokolov, and Stefan Riezler. 2017. Bandit structured prediction for neural sequence-to-sequence learning. In Proceedings of the 55th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 1503--1513

    2017

  13. [21]

    Lei Li, Yuwei Yin, Shicheng Li, Liang Chen, Peiyi Wang, Shuhuai Ren, Mukai Li, Yazheng Yang, Jingjing Xu, Xu Sun, et al. 2023. A large-scale dataset towards multi-modal multilingual instruction tuning. arXiv preprint arXiv:2306.04387

    2023 arXiv

  14. [22]

    Qing Li, Jiahui Geng, Zongxiong Chen, Kun Song, Lei Ma, and Fakhri Karray. 2025. Internal activation revision: Safeguarding vision language models without parameter update. arXiv preprint arXiv:2501.16378

    2025 arXiv

  15. [23]

    Ziniu Li, Tian Xu, Yushun Zhang, Zhihang Lin, Yang Yu, Ruoyu Sun, and Zhi-Quan Luo. 2024. Remax: a simple, effective, and efficient reinforcement learning method for aligning large language models. In Proceedings of the 41st International Conference on Machine Learning, pages ...

    2024

  16. [24]

    Daizong Liu, Mingyu Yang, Xiaoye Qu, Pan Zhou, Yu Cheng, and Wei Hu. 2024 a . A survey of attacks on large vision-language models: Resources, advances, and future trends. arXiv preprint arXiv:2407.07403

    2024 arXiv

  17. [25]

    Xin Liu, Yichen Zhu, Jindong Gu, Yunshi Lan, Chao Yang, and Yu Qiao. 2024 b . Mm-safetybench: A benchmark for safety evaluation of multimodal large language models. In European Conference on Computer Vision, pages 386--403. Springer

    2024

  18. [26]

    Weidi Luo, Siyuan Ma, Xiaogeng Liu, Xiaoyu Guo, and Chaowei Xiao. 2024. Jailbreakv-28k: A benchmark for assessing the robustness of multimodal large language models against jailbreak attacks. arXiv e-prints, pages arXiv--2404

    2024

  19. [27]

    Khanh Nguyen, Hal Daum \'e III, and Jordan Boyd-Graber. 2017. Reinforcement learning for bandit neural machine translation with simulated human feedback. In Proceedings of the 2017 Conference on Empirical Methods in Natural Language Processing, pages 1464--1474

    2017

  20. [28]

    Goucher, Adam Perelman, Aditya Ramesh, et al

    OpenAI, :, Aaron Hurst, Adam Lerer, Adam P. Goucher, Adam Perelman, Aditya Ramesh, et al. 2024 a . https://arxiv.org/abs/2410.21276 Gpt-4o system card . Preprint, arXiv:2410.21276

    2024 arXiv

  21. [29]

    OpenAI, Josh Achiam, Steven Adler, Sandhini Agarwal, et al. 2024 b . https://arxiv.org/abs/2303.08774 Gpt-4 technical report . Preprint, arXiv:2303.08774

    2024 arXiv

  22. [30]

    Renjie Pi, Tianyang Han, Jianshu Zhang, Yueqi Xie, Rui Pan, Qing Lian, Hanze Dong, Jipeng Zhang, and Tong Zhang. 2024. Mllm-protector: Ensuring mllm’s safety without hurting performance. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing,...

    2024

  23. [31]

    Xiangyu Qi, Kaixuan Huang, Ashwinee Panda, Mengdi Wang, and Prateek Mittal. 2023. Visual adversarial examples jailbreak large language models. CoRR

    2023

  24. [32]

    Rafael Rafailov, Archit Sharma, Eric Mitchell, Christopher D Manning, Stefano Ermon, and Chelsea Finn. 2023. Direct preference optimization: Your language model is secretly a reward model. Advances in Neural Information Processing Systems, 36:53728--53741

    2023

  25. [33]

    John Schulman, Filip Wolski, Prafulla Dhariwal, Alec Radford, and Oleg Klimov. 2017. Proximal policy optimization algorithms. arXiv preprint arXiv:1707.06347

    2017 arXiv

  26. [34]

    Zhihong Shao, Peiyi Wang, Qihao Zhu, Runxin Xu, Junxiao Song, Xiao Bi, Haowei Zhang, Mingchuan Zhang, YK Li, Y Wu, et al. 2024. Deepseekmath: Pushing the limits of mathematical reasoning in open language models. arXiv preprint arXiv:2402.03300

    2024 arXiv

  27. [35]

    Baiquan Su, Yi Gong, Yijun Chen, Yuanjie Liu, Zehao Wang, Muzhi Dai, Yan Zhuang, Wenyong Liu, Shaolong Kuang, Ye Zong, et al. 2022. Detection of healthy and diseased pylorus natural anatomical center with convolutional neural network classification and filters. Journal of Medi...

    2022

  28. [36]

    Peng Wang, Shuai Bai, Sinan Tan, Shijie Wang, Zhihao Fan, Jinze Bai, Keqin Chen, Xuejing Liu, Jialin Wang, Wenbin Ge, Yang Fan, Kai Dang, Mengfei Du, Xuancheng Ren, Rui Men, Dayiheng Liu, Chang Zhou, Jingren Zhou, and Junyang Lin. 2024 a . Qwen2-vl: Enhancing vision-language m...

    2024 arXiv

  29. [37]

    Yizhong Wang, Yeganeh Kordi, Swaroop Mishra, Alisa Liu, Noah A Smith, Daniel Khashabi, and Hannaneh Hajishirzi. 2023. Self-instruct: Aligning language models with self-generated instructions. In Proceedings of the 61st Annual Meeting of the Association for Computational Lingui...

    2023

  30. [38]

    Yu Wang, Xiaogeng Liu, Yu Li, Muhao Chen, and Chaowei Xiao. 2024 b . Adashield: Safeguarding multimodal large language models from structure-based attack via adaptive shield prompting. In European Conference on Computer Vision, pages 77--94. Springer

    2024

  31. [39]

    An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, et al. 2025. Qwen3 technical report. arXiv preprint arXiv:2505.09388

    2025 arXiv

  32. [40]

    Zonghao Ying, Aishan Liu, Siyuan Liang, Lei Huang, Jinyang Guo, Wenbo Zhou, Xianglong Liu, and Dacheng Tao. 2024. Safebench: A safety evaluation framework for multimodal large language models. arXiv preprint arXiv:2410.18927

    2024 arXiv

  33. [41]

    Qiying Yu, Zheng Zhang, Ruofei Zhu, Yufeng Yuan, Xiaochen Zuo, Yu Yue, Weinan Dai, Tiantian Fan, Gaohong Liu, Lingjun Liu, et al. 2025. Dapo: An open-source llm reinforcement learning system at scale. arXiv preprint arXiv:2503.14476

    2025 arXiv

  34. [42]

    Tianyu Yu, Yuan Yao, Haoye Zhang, Taiwen He, Yifeng Han, Ganqu Cui, Jinyi Hu, Zhiyuan Liu, Hai-Tao Zheng, Maosong Sun, et al. 2024. Rlhf-v: Towards trustworthy mllms via behavior alignment from fine-grained correctional human feedback. In Proceedings of the IEEE/CVF Conference...

    2024

  35. [43]

    Zheng Yuan, Hongyi Yuan, Chuanqi Tan, Wei Wang, Songfang Huang, and Fei Huang. 2023. Rrhf: Rank responses to align language models with human feedback without tears. arXiv preprint arXiv:2304.05302

    2023 arXiv

  36. [44]

    Xiang Yue, Yuansheng Ni, Kai Zhang, Tianyu Zheng, Ruoqi Liu, Ge Zhang, Samuel Stevens, Dongfu Jiang, Weiming Ren, Yuxuan Sun, Cong Wei, Botao Yu, Ruibin Yuan, Renliang Sun, Ming Yin, Boyuan Zheng, Zhenzhu Yang, Yibo Liu, Wenhao Huang, Huan Sun, Yu Su, and Wenhu Chen. 2024 a . ...

    2024

  37. [45]

    Xiang Yue, Tianyu Zheng, Yuansheng Ni, Yubo Wang, Kai Zhang, Shengbang Tong, Yuxuan Sun, Botao Yu, Ge Zhang, Huan Sun, Yu Su, Wenhu Chen, and Graham Neubig. 2024 b . Mmmu-pro: A more robust multi-discipline multimodal understanding benchmark. arXiv preprint arXiv:2409.02813

    2024 arXiv

  38. [46]

    Da Zhang, Junyu Gao, and Xuelong Li. 2024. Learning long-range relationships for temporal aircraft anomaly detection. IEEE Transactions on Aerospace and Electronic Systems, 60(5):6385--6395

    2024

  39. [47]

    Yongshuo Zong, Ondrej Bohdal, Tingyang Yu, Yongxin Yang, and Timothy Hospedales. 2024. Safety fine-tuning at (almost) no cost: A baseline for vision large language models. arXiv preprint arXiv:2402.02207

    2024 arXiv

  40. [48]

    online" 'onlinestring :=

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list...

  41. [49]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.