Seeing the Threat: Vulnerabilities in Vision-Language Models to Adversarial Attack

Juan Ren; Mark Dras; Usman Naseem

REVIEW 4 major objections 6 minor 35 references

Seeing the Threat: Vulnerabilities in Vision-Language Models to Adversarial Attack

T0 review · 4 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Adversarial images leak threat semantics through the visual encoder and projector before safety alignment can block them.

desk verdict The two-stage evaluation framework is a genuine contribution; the token-projection 'why' evidence is not backed by controls and should be treated as a hypothesis. read the letter →

arxiv 2505.21967 v1 pith:INQWJVES submitted 2025-05-28 cs.CL

Juan Ren , Mark Dras , Usman Naseem This is my paper

classification cs.CL

keywords adversarialattacksvision-languagemodelsmultimodalsafetyjailbreakrepresentationanalysisrefusalbehaviorattacksuccessratetypographic

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to explain why adversarial attacks on large vision-language models (LVLMs) keep beating their safety guards, and offers a more careful way to measure those attacks. The central finding is that models without any OCR capability still extract semantic content from typographically rendered or perturbed images, through the alignment between the visual encoder and the language model's token space. That latent semantic extraction, not literal text recognition, is what lets typographic jailbreaks like FigStep succeed. The authors also propose a two-stage evaluation framework that separates refusals from instruction non-compliance and quantifies how much a harmful response actually helps, plus a normative target for what safe behavior should look like.

What carries the argument

The central mechanism is the visual-token projection defined by Eq. 1: the projected image features $W_{proj}f_{vis}(X_i)$ are matched to the nearest text-token embedding $E_w$ by cosine similarity, producing a textual proxy for what the model sees. This proxy lets the authors inspect the latent representation space of models that cannot OCR the image, and it is what reveals the semantic cues, such as 'method' and 'illegal,' that carry the harmful intent. The evaluation framework is the second piece of machinery: a GPT-4o-mini evaluator with chain-of-thought first classifies responses as hard refusal, soft refusal, partial refusal, non-refusal, or instruction non-following, then assigns a normalized 5-point Likert harmfulness score; the framework's contribution is that it stops treating every non-refusal as an attack success.

What would settle it

Take the same typographic attack images and pass them through the vision encoder after heavy cropping or noise that destroys readable structure, then repeat the token-projection analysis; if scrambled inputs still yield the same concentration of threat-related tokens such as 'illegal' and 'method,' the semantic-cue result would be an artifact of the embedding space rather than evidence of latent understanding, whereas if the threat-related tokens disappear, the paper's account is supported.

Watch

Extended reading notes

Core claim

The paper's core claim is that LVLMs understand harmful content in images before any safety alignment can intervene, even when they cannot read the text aloud. Using a token-projection analysis, which maps each image patch to its nearest text-token embedding by cosine similarity, the authors show that LLaVA and Llama 3.2 Vision, which lack explicit OCR, still produce tokens like 'method,' 'illegal,' and 'organ' when shown typographic attack images. This means the model is not simply failing to see the threat; it is encoding threat-relevant semantics at the visual-encoder and projector stage, and the language model can act on those cues. The authors argue this is why cross-modal attacks succeed despite safety alignment, and why defenses must target the visual interface rather than only refusal behavior.

Load-bearing premise

The load-bearing premise is that matching a projected image patch to its nearest text-token embedding gives a true picture of what the model semantically represents; if those nearest-token matches are mostly coincidence of embedding geometry, the observed 'semantic cues' would not prove the model latently understands harmful content.

Editorial extensions

If this is right

If the representational claim holds, safety alignment that only trains the language model to refuse will keep failing, because the threat semantics are already encoded in the visual pipeline before the refusal behavior can be triggered.
Built-in OCR capability is not the deciding factor: Qwen 2.5 VL and InternVL 2.5 read text accurately yet still show high attack success on MMSafetyBench and SIUO, so stronger alignment, not OCR, is the operative defense.
The proposed three-way decomposition into refusal, instruction non-following, and attack success gives benchmarks a common definition of success, making reported attack success rates comparable across studies.
Severity-aware ASR scores change how jailbreak results are read: a response that gives a soft or partial refusal is not the same as a full harmful answer, and ideal safety behavior should minimize instruction non-following while keeping hard refusals for high-risk requests.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If the token-projection proxy is reliable, a cheap defense suggests itself: monitor the visual encoder's nearest-token distribution for harmful semantic clusters before generation and refuse at the interface rather than waiting for the language model's refusal head.
The results imply that OCR capability and safety alignment are separable axes: models with and without OCR fail on different attack types, so defenses may need to be tailored to the encoder's strengths rather than applied uniformly.
The normative schema could be turned into a training signal: a reward or loss that penalizes instruction non-following and overly helpful partial refusals, instead of only binary refusal, would push models toward the ideal response distribution the paper sketches.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Colleague,

The useful part of this paper is the two-stage evaluation framework. It separates instruction non-following from refusal and attack success, then scores how much harmful intent the response actually fulfills on a 5-point scale. That is a real improvement over binary ASR and should reduce inflated success rates in LVLM safety benchmarks. The refusal taxonomy (hard, soft, partial/informative) is also more informative than 'refused or not.' The attack typology is mostly a reorganization of the literature, but a clean one.

The representation study is the weak part. The authors project image embeddings to nearest text tokens (Eq. 1) and claim semantic fragments like 'method' or 'illegal' show the model extracts rich semantics from typographic images even without OCR. There is no control condition, no comparison to random noise or benign images, and no quantitative validation. In a vocabulary of 30k–100k tokens, nearest-neighbor matches are often English words by chance. For Llama, they run the matched tokens through a summarizer LLM, which will produce a coherent narrative from any word list. So the central 'why' claim—that encoder/projector alignment enables these attacks—is not established by the evidence. The paper also offers no ablation or intervention on those tokens to show they are causally involved in the output.

Smaller issues: Table 1 reports 'Total' ASR grades above 1 (1.43 for InternVL) even though the scores are normalized to [0,1]. The judge is GPT-4o-mini with majority voting, but there is no human agreement data to show the rubric is reliable. The paper mentions human-in-the-loop for edge cases, but that is not validation. No code or data is released, which makes reuse harder.

The limitation section is honest about the single evaluator model and the lack of large-scale human annotation, but it does not address the missing control in the representation study.

Who gets value: anyone building or benchmarking multimodal safety. The evaluation protocol is worth taking seriously and could become a reusable tool if cleaned up. The representation claim should be read as a hypothesis, not a result.

I would send this to peer review. It needs revision—fix the table error, add controls to the token-projection analysis, and report human agreement on the rubric—but the evaluation framework justifies referee time.

Referee Report

4 major / 6 minor

Summary. The paper studies why multimodal adversarial attacks bypass safety mechanisms in vision-language models and proposes a two-stage evaluation framework for such attacks. It categorizes attacks into five types, presents a representational analysis using nearest-token projection of visual features (Eq. 1), and evaluates four LVLMs (LLaVA-1.5, Llama 3.2 Vision, Qwen 2.5 VL, InternVL 2.5) on four datasets (AdvBench, FigStep, MMSafetyBench, SIUO). The evaluation framework separates refusals, instruction non-following, and successful attacks, and scores the harmfulness of non-refusing responses on a normalized Likert scale. The central representational claim is that LVLMs extract semantically rich information from adversarially perturbed images even without explicit OCR, through alignment in the visual encoder and projector modules.

Significance. If substantiated, the paper would make two useful contributions: a fine-grained evaluation protocol that avoids conflating instruction non-following with refusal or attack success, and an empirical pointer to the vision encoder/projector interface as a safety bottleneck. The taxonomy of attack types and the refusal subtyping are sensible and likely to be helpful to the community. However, the main causal representational claim is currently supported only by qualitative nearest-token visualizations without controls, and the proposed evaluation metric's reliability is not validated against human judgments. The paper does not ship code, datasets, or machine-checked proofs; its value rests on experimental soundness, which is presently incomplete.

major comments (4)

[Table 1] Table 1, Total row: the 'ASR grade' for InternVL is reported as 1.43, which is impossible if ASRscore is normalized to [0,1] as stated in §3.2. Either the Total row aggregates something other than ASRscore (e.g., a weighted combination of refusal and harmfulness) or there is an arithmetic error. Since the Total row is used to compare model safety in §4.2, the aggregation formula must be stated explicitly and the table corrected.
[§3.1 and §4.1, Eq. (1), Figs. 3–4] The token-projection evidence has no control condition. In vocabularies of roughly 32k tokens (LLaVA) and 110k+ tokens (Llama 3.2), nearest-neighbor matches of arbitrary projected features will frequently be real English words by chance. Without comparing against random noise, natural images, or benign typographic images, the occurrence of fragments such as 'method,' 'illegal,' and 'organ' is not evidence of semantic extraction. For Llama, the additional step of having a secondary LLM summarize patch-wise nearest tokens cannot establish semantic relevance, because LLMs produce coherent narratives from arbitrary word lists. Please add quantitative baselines and a chance-level comparison for the nearest-token retrieval.
[§4.2 and Limitation] The automated evaluator is the sole source of all refusal, instruction-following, and ASR quality labels, yet no human agreement or calibration is reported; the Limitation section explicitly acknowledges that no large-scale human-annotation comparison was performed. Because the paper's contribution is a measurement protocol, its reliability cannot be assessed without reporting agreement between the GPT-4o-mini judge and human labels on a sample, including per-category agreement and the specific cases shown in Figure 8 involving professional advice.
[§4.1 and Conclusion] The paper states that LVLMs extract semantically rich information from adversarially perturbed images 'through alignment mechanisms in the visual encoder and projector modules,' but no intervention, ablation, or perturbation is performed to link the observed nearest-token projections to the generated outputs. The representational observations are correlational. To support the causal 'why' claim, the authors should manipulate or ablate the encoder/projector representations and show corresponding changes in attack success.

minor comments (6)

[§3.3, Figure 4, Figure 5, Figure 7] There are several typos and inconsistent captions: 'reprensent' in §3.3, 'Insrtuction' in Figure 5, 'Refusual' in Figures 5 and 7, 'Sematic' and 'iamge' in Figure 4's caption. These should be corrected.
[§3.2 and Limitation] The evaluator is called GPT-4o-mini in §3.2 and §4.2 but GPT-4.1-mini in the Limitation section; please use one consistent name and verify which model was actually used.
[§3.2] The formula 'ASR = 1 − RR' appears before RR is defined and is immediately superseded by the three-way decomposition P(RR)+P(INF)+P(ASR)=1; reorder the definitions and state the relationship between this formula and the proposed framework.
[Table 1] The column labeled 'ASR grade' should be renamed 'ASR quality score' to match the terminology in the text, and the table should indicate whether the Total row is a weighted average and over how many samples.
[Figure 8 and Appendix B] The professional-advice sensitivity analysis is reported only graphically without numerical values or criteria for what counts as professional advice; include the underlying numbers and the annotation rule used to remove those items.
[§4.2, Ideal Response Distribution] The normative claim that informative refusals are preferable to hard refusals for low-risk prompts is presented as a conclusion rather than an assumption; since this stance affects how the framework scores responses, it should be labeled explicitly as a normative choice and discussed as such.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the representational claim and the two-stage evaluation framework are derived from external measurements and external benchmarks, not from their own conclusions.

full rationale

The paper's main derivation chain is empirical rather than definitional. The representational claim is supported by Eq. 1, which projects visual features to nearest vocabulary tokens, and by qualitative observations that tokens such as 'method,' 'illegal,' and 'organ' appear in the projection. Eq. 1 is a measurement protocol: it selects the token with maximum cosine similarity to the projected image feature. Nothing in Eq. 1 guarantees that the nearest tokens will be semantically related to the image, and no parameter is fitted to force that outcome. The Llama 3.2 Vision analysis summarizes patch-wise token projections with a secondary LLM; this is an interpretability aid applied after the projection step and does not feed back into the model under study, so it cannot make the observed semantic relevance true by construction. The proposed evaluation framework introduces categories such as Hard Refusal, Soft Refusal, Partial Refusal, Non-Following, and Non-Refusal, plus a normalized Likert-based ASR quality score. These are normative labels applied to model outputs, not inputs to the attack-generation or representation equations, so they do not define the paper's empirical findings into existence. The paper contains no load-bearing self-citations and imports no uniqueness theorem from the authors' prior work. The appended Limitation section acknowledges evaluator constraints and the absence of large-scale human annotation, but it does not assert or reveal a circular step. The skeptic's concerns about missing control conditions and chance nearest-neighbor matches are validity or evidence-quality issues, not circularity: the central claim could be false while the measurement protocol remains exactly as described. Therefore the honest finding is no significant circularity, scored 0.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

The evaluation framework depends on machine-judged labels, the token-projection interpretation, a limited dataset/model sample, and the authors' own normative ideal of refusal behavior. No free parameters are fitted, but these domain assumptions carry the analysis.

assumptions (4)

domain assumption GPT-4o-mini majority-vote judgments are a valid proxy for response harmfulness and refusal categories.
The whole pipeline labels responses via GPT-4o-mini with CoT and majority vote; no large-scale inter-annotator agreement with human labels is reported (Section 3.2, Evaluation Pipeline; Limitation).
domain assumption Nearest-token cosine projection in Eq. 1 faithfully represents the model's semantic representation of an image.
The claim that LVLMs encode harmful semantics without OCR is inferred from projected token visualizations (Section 3.1, Eq. 1, Figures 3-4), with no causal or behavioral validation of this mapping.
domain assumption The four datasets and four model families are representative of the multimodal adversarial attack space.
The authors themselves say computational constraints limited scope and that more datasets and model families would strengthen findings (Limitation).
ad hoc to paper The proposed 'ideal response distribution' is a valid normative target for safety alignment.
The paper declares ideal behavior (high refusal for harmful prompts, low non-following) based on its own judgment rather than external policy or empirical grounding (Section 4.2, Ideal Response Distribution).

how reviews work

0 comments

Cite this review

Pith. "Pith review of Seeing the Threat: Vulnerabilities in Vision-Language Models to Adversarial Attack." pith.science (2026). https://pith.science/paper/INQWJVES

@misc{pith2026250521967,
  author       = {Pith},
  title        = {Pith review of: Seeing the Threat: Vulnerabilities in Vision-Language Models to Adversarial Attack},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/INQWJVES}},
  note         = {Machine review of arXiv:2505.21967}
}

read the original abstract

Large Vision-Language Models (LVLMs) have shown remarkable capabilities across a wide range of multimodal tasks. However, their integration of visual inputs introduces expanded attack surfaces, thereby exposing them to novel security vulnerabilities. In this work, we conduct a systematic representational analysis to uncover why conventional adversarial attacks can circumvent the safety mechanisms embedded in LVLMs. We further propose a novel two stage evaluation framework for adversarial attacks on LVLMs. The first stage differentiates among instruction non compliance, outright refusal, and successful adversarial exploitation. The second stage quantifies the degree to which the model's output fulfills the harmful intent of the adversarial prompt, while categorizing refusal behavior into direct refusals, soft refusals, and partial refusals that remain inadvertently helpful. Finally, we introduce a normative schema that defines idealized model behavior when confronted with harmful prompts, offering a principled target for safety alignment in multimodal systems.

Figures

Figures reproduced from arXiv: 2505.21967 by the authors.

**Figure 2.** Existing Evaluation Paradigms vs. Our Pro [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗

**Figure 3.** Semantic interpretation of typographic image: (a) is semantic meaning of (b) by projecting image (b) into [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗

Figures from the paper (6 more)

**Figure 5.** Figure 5: Model Response Breakdown to Refusual, In [PITH_FULL_IMAGE:figures/full_fig_p006_5.png]

**Figure 4.** Figure 4: Semantic Meaning of Image Input by Llama. [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]

**Figure 7.** Figure 7: Model Response Breakdown to Refusual, Insrtuction Non-Following, and Success Attack [PITH_FULL_IMAGE:figures/full_fig_p007_7.png]

**Figure 8.** Figure 8: ASR and ASR Quality Score across Datasets With and Without Professional Advice. [PITH_FULL_IMAGE:figures/full_fig_p007_8.png]

**Figure 9.** Figure 9: Evaluation Instruction [PITH_FULL_IMAGE:figures/full_fig_p014_9.png]

**Figure 10.** Figure 10: Samples of Evaluation Results [PITH_FULL_IMAGE:figures/full_fig_p015_10.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

35 extracted references · 5 canonical work pages

[1]

online" 'onlinestring :=

ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block STRING...
[2]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...
[3]

Anthropic. 2023. Claude’s constitution. https://www.anthropic.com/news/claudes-constitution. Accessed: 2025-05-20

work page 2023
[4]

Shuai Bai, Keqin Chen, Xuejing Liu, Jialin Wang, Wenbin Ge, Sibo Song, Kai Dang, Peng Wang, Shijie Wang, Jun Tang, Humen Zhong, Yuanzhi Zhu, Mingkun Yang, Zhaohai Li, Jianqiang Wan, Pengfei Wang, Wei Ding, Zheren Fu, Yiheng Xu, and 8 others. 2025. https://arxiv.org/abs/2502.13923 Qwen2.5-vl technical report . Preprint, arXiv:2502.13923

arXiv 2025
[5]

Choquette-Choo, Matthew Jagielski, Irena Gao, Anas Awadalla, Pang Wei Koh, Daphne Ippolito, Katherine Lee, Florian Tramer, and Ludwig Schmidt

Nicholas Carlini, Milad Nasr, Christopher A. Choquette-Choo, Matthew Jagielski, Irena Gao, Anas Awadalla, Pang Wei Koh, Daphne Ippolito, Katherine Lee, Florian Tramer, and Ludwig Schmidt. 2024. https://doi.org/10.48550/arXiv.2306.15447 Are aligned neural networks adversarially aligned? arXiv preprint. ArXiv:2306.15447 [cs]

arXiv doi:10.48550/arxiv.2306.15447 2024
[6]

Zhe Chen, Jiannan Wu, Wenhai Wang, Weijie Su, Guo Chen, Sen Xing, Muyan Zhong, Qinglong Zhang, Xizhou Zhu, Lewei Lu, and 1 others. 2024. Internvl: Scaling up vision foundation models and aligning for generic visual-linguistic tasks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24185--24198

work page 2024
[7]

Yi Ding, Bolian Li, and Ruqi Zhang. 2025 a . https://arxiv.org/abs/2410.06625 Eta: Evaluating then aligning safety of vision language models at inference time . Preprint, arXiv:2410.06625

arXiv 2025
[8]

Yi Ding, Lijun Li, Bing Cao, and Jing Shao. 2025 b . https://doi.org/10.48550/arXiv.2501.18533 Rethinking Bottlenecks in Safety Fine - Tuning of Vision Language Models . arXiv preprint. ArXiv:2501.18533 [cs]

work page doi:10.48550/arxiv.2501.18533 2025

Show all 35 references

[9]

Yichen Gong, Delong Ran, Jinyuan Liu, Conglei Wang, Tianshuo Cong, Anyu Wang, Sisi Duan, and Xiaoyun Wang. 2025. https://doi.org/10.48550/arXiv.2311.05608 FigStep : Jailbreaking Large Vision - Language Models via Typographic Visual Prompts . arXiv preprint. ArXiv:2311.05608 [cs]

2025 doi arXiv
[10]

Kwok, and Yu Zhang

Yunhao Gou, Kai Chen, Zhili Liu, Lanqing Hong, Hang Xu, Zhenguo Li, Dit-Yan Yeung, James T. Kwok, and Yu Zhang. 2024. https://doi.org/10.48550/arXiv.2403.09572 Eyes Closed , Safety On : Protecting Multimodal LLMs via Image -to- Text Transformation . arXiv preprint. ArXiv:2403....

2024 doi arXiv
[11]

Yangyang Guo, Fangkai Jiao, Liqiang Nie, and Mohan Kankanhalli. 2025. https://doi.org/10.48550/arXiv.2411.08410 The VLLM Safety Paradox : Dual Ease in Jailbreak Attack and Defense . arXiv preprint. ArXiv:2411.08410 [cs] version: 2

2025 doi arXiv
[12]

Yangsibo Huang, Samyak Gupta, Mengzhou Xia, Kai Li, and Danqi Chen. 2023. https://doi.org/10.48550/arXiv.2310.06987 Catastrophic Jailbreak of Open -source LLMs via Exploiting Generation . arXiv preprint. ArXiv:2310.06987 [cs]

2023 doi arXiv
[13]

Yifan Li, Hangyu Guo, Kun Zhou, Wayne Xin Zhao, and Ji-Rong Wen. 2025. https://doi.org/10.48550/arXiv.2403.09792 Images are Achilles ' Heel of Alignment : Exploiting Visual Vulnerabilities for Jailbreaking Multimodal Large Language Models . arXiv preprint. ArXiv:2403.09792 [cs]

2025 doi arXiv
[14]

Haotian Liu, Chunyuan Li, Yuheng Li, Bo Li, Yuanhan Zhang, Sheng Shen, and Yong Jae Lee. 2024 a . https://llava-vl.github.io/blog/2024-01-30-llava-next/ Llava-next: Improved reasoning, ocr, and world knowledge

2024
[15]

Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee. 2023. https://doi.org/10.48550/arXiv.2304.08485 Visual Instruction Tuning . arXiv preprint. ArXiv:2304.08485 [cs]

2023 doi arXiv
[16]

Xin Liu, Yichen Zhu, Jindong Gu, Yunshi Lan, Chao Yang, and Yu Qiao. 2024 b . https://doi.org/10.48550/arXiv.2311.17600 MM - SafetyBench : A Benchmark for Safety Evaluation of Multimodal Large Language Models . arXiv preprint. ArXiv:2311.17600 [cs]

2024 doi arXiv
[17]

Weidi Luo, Siyuan Ma, Xiaogeng Liu, Xiaoyu Guo, and Chaowei Xiao. 2024. https://doi.org/10.48550/arXiv.2404.03027 JailBreakV : A Benchmark for Assessing the Robustness of MultiModal Large Language Models against Jailbreak Attacks . arXiv preprint. ArXiv:2404.03027 [cs]

2024 doi arXiv
[18]

Siyuan Ma, Weidi Luo, Yu Wang, and Xiaogeng Liu. 2024. https://doi.org/10.48550/arXiv.2405.20773 Visual- RolePlay : Universal Jailbreak Attack on MultiModal Large Language Models via Role -playing Image Character . arXiv preprint. ArXiv:2405.20773 [cs]

2024 doi arXiv
[19]

Meta AI . 2024. https://ai.meta.com/blog/llama-3-2-connect-2024-vision-edge-mobile-devices/ Llama 3.2: Connect 2024 vision to edge & mobile devices . Accessed: 2025-05-18

2024
[20]

OpenAI. 2025. Usage policies. https://openai.com/policies/usage-policies/. Accessed: 2025-05-20

2025
[21]

Long Ouyang, Jeff Wu, Xu Jiang, Diogo Almeida, Carroll L. Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, John Schulman, Jacob Hilton, Fraser Kelton, Luke Miller, Maddie Simens, Amanda Askell, Peter Welinder, Paul Christiano, Jan Leike, and...

2022 doi arXiv
[22]

Xiangyu Qi, Kaixuan Huang, Ashwinee Panda, Peter Henderson, Mengdi Wang, and Prateek Mittal. 2023 a . https://doi.org/10.48550/arXiv.2306.13213 Visual Adversarial Examples Jailbreak Aligned Large Language Models . arXiv preprint. ArXiv:2306.13213 [cs]

2023 doi arXiv
[23]

Xiangyu Qi, Yi Zeng, Tinghao Xie, Pin-Yu Chen, Ruoxi Jia, Prateek Mittal, and Peter Henderson. 2023 b . https://doi.org/10.48550/arXiv.2310.03693 Fine-tuning Aligned Language Models Compromises Safety , Even When Users Do Not Intend To ! arXiv preprint. ArXiv:2310.03693 [cs]

2023 doi arXiv
[24]

Manning, and Chelsea Finn

Rafael Rafailov, Archit Sharma, Eric Mitchell, Stefano Ermon, Christopher D. Manning, and Chelsea Finn. 2024. https://doi.org/10.48550/arXiv.2305.18290 Direct Preference Optimization : Your Language Model is Secretly a Reward Model . arXiv preprint. ArXiv:2305.18290 [cs]

2024 doi arXiv
[25]

John Schulman, Filip Wolski, Prafulla Dhariwal, Alec Radford, and Oleg Klimov. 2017. https://doi.org/10.48550/arXiv.1707.06347 Proximal Policy Optimization Algorithms . arXiv preprint. ArXiv:1707.06347 [cs]

2017 doi arXiv
[26]

Erfan Shayegani, Yue Dong, and Nael Abu-Ghazaleh. 2023. https://doi.org/10.48550/arXiv.2307.14539 Jailbreak in pieces: Compositional Adversarial Attacks on Multi - Modal Language Models . arXiv preprint. ArXiv:2307.14539 [cs]

2023 doi arXiv
[27]

Jiachen Sun, Changsheng Wang, Jiongxiao Wang, Yiwei Zhang, and Chaowei Xiao. 2024. https://arxiv.org/abs/2405.10529 Safeguarding vision-language models against patched visual prompt injectors . Preprint, arXiv:2405.10529

2024 arXiv
[28]

Siyin Wang, Xingsong Ye, Qinyuan Cheng, Junwen Duan, Shimin Li, Jinlan Fu, Xipeng Qiu, and Xuanjing Huang. 2025. https://doi.org/10.48550/arXiv.2406.15279 Safe Inputs but Unsafe Output : Benchmarking Cross -modality Safety Alignment of Large Vision - Language Model . arXiv pre...

2025 doi arXiv
[29]

Yu Wang, Xiaogeng Liu, Yu Li, Muhao Chen, and Chaowei Xiao. 2024. https://doi.org/10.48550/arXiv.2403.09513 AdaShield : Safeguarding Multimodal Large Language Models from Structure -based Attack via Adaptive Shield Prompting . arXiv preprint. ArXiv:2403.09513 [cs]

2024 doi arXiv
[30]

Fenghua Weng, Yue Xu, Chengyan Fu, and Wenjie Wang. 2024. https://doi.org/10.48550/arXiv.2408.08464 \ textit\ MMJ - Bench \ \ : A Comprehensive Study on Jailbreak Attacks and Defenses for Multimodal Large Language Models . arXiv preprint. ArXiv:2408.08464 [cs]

2024 doi arXiv
[31]

Yongting Zhang, Lu Chen, Guodong Zheng, Yifeng Gao, Rui Zheng, Jinlan Fu, Zhenfei Yin, Senjie Jin, Yu Qiao, Xuanjing Huang, Feng Zhao, Tao Gui, and Jing Shao. 2025. https://doi.org/10.48550/arXiv.2406.12030 SPA - VL : A Comprehensive Safety Preference Alignment Dataset for Vis...

2025 doi arXiv
[32]

Yunhan Zhao, Xiang Zheng, Lin Luo, Yige Li, Xingjun Ma, and Yu-Gang Jiang. 2025. https://arxiv.org/abs/2410.20971 Bluesuffix: Reinforced blue teaming for vision-language models against jailbreak attacks . Preprint, arXiv:2410.20971

2025 arXiv
[33]

Kaiwen Zhou, Chengzhi Liu, Xuandong Zhao, Anderson Compalas, Dawn Song, and Xin Eric Wang. 2025. https://doi.org/10.48550/arXiv.2410.06172 Multimodal Situational Safety . arXiv preprint. ArXiv:2410.06172 [cs]

2025 doi arXiv
[34]

Yongshuo Zong, Ondrej Bohdal, Tingyang Yu, Yongxin Yang, and Timothy Hospedales. 2024. https://doi.org/10.48550/arXiv.2402.02207 Safety Fine - Tuning at ( Almost ) No Cost : A Baseline for Vision Large Language Models . arXiv preprint. ArXiv:2402.02207 [cs]

2024 doi arXiv
[35]

Xiaotian Zou, Ke Li, and Yongkang Chen. 2024. https://doi.org/10.48550/arXiv.2407.02534 Image-to- Text Logic Jailbreak : Your Imagination can Help You Do Anything . arXiv preprint. ArXiv:2407.02534 [cs]

2024 doi arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.

[1] [1]

online" 'onlinestring :=

ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block STRING...

[2] [2]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

[3] [3]

Anthropic. 2023. Claude’s constitution. https://www.anthropic.com/news/claudes-constitution. Accessed: 2025-05-20

work page 2023

[4] [4]

Shuai Bai, Keqin Chen, Xuejing Liu, Jialin Wang, Wenbin Ge, Sibo Song, Kai Dang, Peng Wang, Shijie Wang, Jun Tang, Humen Zhong, Yuanzhi Zhu, Mingkun Yang, Zhaohai Li, Jianqiang Wan, Pengfei Wang, Wei Ding, Zheren Fu, Yiheng Xu, and 8 others. 2025. https://arxiv.org/abs/2502.13923 Qwen2.5-vl technical report . Preprint, arXiv:2502.13923

arXiv 2025

[5] [5]

Choquette-Choo, Matthew Jagielski, Irena Gao, Anas Awadalla, Pang Wei Koh, Daphne Ippolito, Katherine Lee, Florian Tramer, and Ludwig Schmidt

Nicholas Carlini, Milad Nasr, Christopher A. Choquette-Choo, Matthew Jagielski, Irena Gao, Anas Awadalla, Pang Wei Koh, Daphne Ippolito, Katherine Lee, Florian Tramer, and Ludwig Schmidt. 2024. https://doi.org/10.48550/arXiv.2306.15447 Are aligned neural networks adversarially aligned? arXiv preprint. ArXiv:2306.15447 [cs]

arXiv doi:10.48550/arxiv.2306.15447 2024

[6] [6]

Zhe Chen, Jiannan Wu, Wenhai Wang, Weijie Su, Guo Chen, Sen Xing, Muyan Zhong, Qinglong Zhang, Xizhou Zhu, Lewei Lu, and 1 others. 2024. Internvl: Scaling up vision foundation models and aligning for generic visual-linguistic tasks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24185--24198

work page 2024

[7] [7]

Yi Ding, Bolian Li, and Ruqi Zhang. 2025 a . https://arxiv.org/abs/2410.06625 Eta: Evaluating then aligning safety of vision language models at inference time . Preprint, arXiv:2410.06625

arXiv 2025

[8] [8]

Yi Ding, Lijun Li, Bing Cao, and Jing Shao. 2025 b . https://doi.org/10.48550/arXiv.2501.18533 Rethinking Bottlenecks in Safety Fine - Tuning of Vision Language Models . arXiv preprint. ArXiv:2501.18533 [cs]

work page doi:10.48550/arxiv.2501.18533 2025