Pith. sign in

REVIEW 3 major objections 5 minor 37 references

Con Instruction: Universal Jailbreaking of Multimodal Large Language Models via Non-Textual Modalities

T0 review · 3 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that a malicious instruction can be hidden entirely inside an image or audio clip by optimizing the non-textual input's embedding to match the instruction's text embedding in the fusion space, and that multimodal LLMs…

desk verdict A solid, well-evaluated jailbreak paper for MLLMs with a genuinely new audio result and a useful evaluation framework; the main soft spots are methodological details to tighten in revision. read the letter →

arxiv 2506.00548 v1 pith:TIAMFFWU submitted 2025-05-31 cs.CR cs.CLcs.LG

Jiahui Geng , Thy Thy Tran , Preslav Nakov , Iryna Gurevych This is my paper
classification cs.CRcs.CLcs.LG
keywords jailbreakattackmultimodallargelanguagemodelsadversarialimagesaudioembedding-spacealignmentgray-boxresponsecategorizationsafety
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Con Instruction is a gray-box jailbreak attack that hides a malicious textual instruction inside an image or an audio clip rather than in the prompt text. The method starts from random noise and iteratively adjusts the non-textual input so that its embedding in the model's fusion space closely matches the token embeddings of the target instruction; when the image or audio is then fed to a multimodal LLM, the model decodes and follows the embedded instruction. On LLaVA-v1.5 (13B) the attack reaches 81.3% and 86.6% attack success on AdvBench and SafeBench, and it transfers across vision- and audio-language models including InternVL, Qwen-VL, and Qwen-Audio. Because no training data or preprocessing of the textual instruction is required, the same scheme works for arbitrary malicious prompts. The paper also introduces an Attack Response Categorization (ARC) framework that grades responses by quality and relevance, arguing that refusal-string matching overestimates attack success.

What carries the argument

The carrying mechanism is embedding-space alignment in the fusion layer. For a target instruction $\text{Inst}$, the attack computes $H_{\text{Inst}} = T(\text{Inst})$, the text token embeddings; initializes the adversarial sample $X_{\text{adv}}$ as Gaussian noise; and minimizes $L = D(H_{\text{Inst}}, H_{\text{adv}})$ with $H_{\text{adv}} = F(E(X_{\text{adv}}))$, where $E$ is the vision or audio encoder, $F$ is the multimodal fusion module, and $D$ combines L2 distance with cosine similarity. Optimization selects the last $N_{\text{inst}}$ visual or audio embeddings to match the $N_{\text{inst}}$ token embeddings, an empirical choice reported to give the best attack rate. The attack operates in a gray-box setting: it needs access to the encoder, the token-embedding layer, and the fusion module, but not the full language model.

What would settle it

Measure the embedding distance after optimization: if a large fraction of successful attacks have final distance above the preset threshold $\tau$, the attack's claimed mechanism (minimizing $D$ below $\tau$) is not doing the work.

Watch

Extended reading notes

Core claim

The central claim is that multimodal LLMs' joint embedding space can be used as a carrier for instructions: an adversarial image or audio snippet optimized to be close to a target text prompt in that space is sufficient to make the model produce harmful content, even when the text-only version of the instruction is refused. The authors show this with a two-stage attack: Stage I optimizes the non-textual sample under a combined Euclidean-plus-cosine distance between its fused embedding and the target instruction's token embeddings, using the last $N_{\text{inst}}$ embeddings of the image; Stage II pairs the sample with an empty string or benign helper texts (Agree, Anti, Hypo) that amplify recognition and success rates. They further claim that existing evaluation metrics such as refusal matching and StrongREJECT misclassify responses, and that their four-class ARC with an LLM judge agrees with human annotation at roughly 88%.

Load-bearing premise

The attack collapses if closeness in the fusion embedding space does not reliably make the language model decode the target instruction; if that fails, minimizing the distance would produce noise that is near the text instruction in embedding distance but semantically unreadable by the model.

Editorial extensions

If this is right

  • If Con Instruction is correct, text-only safety filters are insufficient because harmful instructions can arrive entirely through images or audio.
  • The same adversarial recipe works across vision and audio models, so the safety gap is not specific to one encoder or one modality.
  • Pairing the non-textual sample with benign helper text such as Hypo amplifies attack success, showing that safety alignment is weaker for non-textual input than for equivalent text.
  • Larger multimodal models can be more vulnerable than smaller ones to this attack, even when they are more robust to text-only jailbreaks.
  • Existing defenses vary widely: MLLM-Protector and heavy input noise reduce success substantially, while self-assessment and VLGuard fine-tuning still leave nontrivial attack success rates.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • An implication left implicit is that the same embedding-alignment recipe could be adapted to black-box models by training a surrogate encoder and fusion module, in which case the gray-box requirement would become a practical rather than conceptual barrier.
  • The paper's t-SNE observation that adversarial activations mix with safe queries suggests a detection hook: a defense could exploit activation geometry rather than response text, though no such defense is constructed here.
  • The last-$N_{\text{inst}}$ embedding heuristic implies that token-position alignment matters; a testable extension would randomize which visual embeddings are matched to instruction tokens to see whether position is load-bearing for the attack's success.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes Con Instruction, a gray-box jailbreak attack against multimodal large language models (MLLMs). The method initializes an image or audio snippet from random noise and iteratively optimizes it so that its embeddings after the encoder and fusion module align with the token embeddings of a target malicious text instruction, using a combination of Euclidean distance and cosine similarity. The generated non-textual adversarial example, optionally paired with benign text prompts (Agree, Anti, Hypo), is shown to elicit harmful responses from LLaVA-1.5 (7B/13B), InternVL (13B/34B), Qwen-VL, and Qwen-Audio on AdvBench and SafeBench. The paper also introduces the Attack Response Categorization (ARC) framework with an LLM judge validated against human annotations (88% agreement), and evaluates several defense strategies.

Significance. If the results hold, this is a significant contribution to multimodal safety research. The attack demonstrates that non-textual modalities can carry arbitrary malicious instructions in a way that bypasses text-focused safety alignment, including audio, which previous OCR-based attacks do not cover. The ARC evaluation framework is a practical improvement over refusal-string matching and existing judge-based metrics. The paper releases code, includes human-validated evaluation, and reports extensive ablations across model families and modalities. These strengths make the empirical claims credible and the work likely to influence future defense research.

major comments (3)
  1. [Section 3.1, Algorithm 1] The central claim that minimizing the distance D(H_Inst, H_adv) in the fusion space makes the MLLM decode and obey the target instruction is not directly validated. The paper reports no distribution of final D values, no analysis of ASR versus D, and no control experiment in which the target instruction's text token embeddings are inserted directly at the non-textual token positions while the rest of the prompt is held fixed. Such a control would test whether the embedding space is semantically shared and whether the optimization is transferring instruction content rather than producing a generic safety-disabling perturbation. Without it, the observed high ASR could be partly attributable to optimization side effects (e.g., global perturbation of all visual tokens or position-specific cues) rather than faithful transfer of the instruction. This matters for the 'universal' claim across architectures. Please add (a) a control with direct embedding insertion, (b) reporting of final D values per model, and (c) an ASR-versus-D analysis.
  2. [Section 3.1 (distance function and threshold)] The distance function D is underspecified. The paper states that 'combining Euclidean distance and cosine similarity often yields better results' but does not provide the exact formula or the relative weights of the two terms. Table 4 shows qualitative improvement but no numerical definition. Because the stopping criterion in Algorithm 1 is L > tau, and tau is hand-tuned per model (0.60/0.75/0.85), the threshold is not scale-invariant and has no consistent semantic meaning across models. Please specify D exactly (including any normalization and weights), report the achieved final D values, and describe how tau was selected (e.g., the number of optimization steps or examples used for tuning).
  3. [Eq. (2), Table 3, Abstract] The success metric is the max over n=5 sampled responses (Eq. 2). The headline figures in the abstract (81.3% and 86.6% on LLaVA-v1.5 13B) correspond to this max-of-5 metric, not to a single response. While n=5 is disclosed in Section 4.1, the abstract and conclusions do not state this, which overstates the per-query attack reliability. Please report single-response ASR alongside the max-of-5 metric in Table 3 (or at least in an appendix table), and explicitly mention the max-of-5 definition in the abstract.
minor comments (5)
  1. [Section 4.2, Finding A1] The text mentions 'ESCO', but the method is called ECSO (Gou et al., 2025); please correct the acronym.
  2. [Section 3.1] The notation for the non-textual encoder is inconsistent: the text says 'I(·)' while Algorithm 1 uses 'E(·)'. Please unify the notation.
  3. [Appendix A] There are several typos: 'utlized' should be 'utilized', 'Guassian' should be 'Gaussian', and 'detecor' should be 'detector'.
  4. [Table 4] In the sentence preceding Table 4, 'additon' should be 'addition'.
  5. [Eq. (2)] The display of Equation (2) is malformed ('n max i=1'); it should be formatted as a proper max over i=1..n.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the attack success rate is measured externally by response quality, not by the embedding-distance objective, and no load-bearing claim reduces to a fitted parameter or self-citation.

full rationale

The paper's method optimizes an adversarial image or audio to minimize the distance D(H_Inst, H_adv) between its embedding and the target instruction's text-token embedding (Alg. 1). The claimed result, however, is the attack success rate defined in Eq. (2) as isSuccess(t) = max_i Eval(Inst^t_adv, r_i), where Eval is an external evaluation of the generated response (ARC, StrongREJECT, or refusal matching). Success is therefore not the same quantity as the optimized distance; it is an empirical outcome conditional on the model decoding and following the instruction. The paper reports text-only baselines, prior multimodal attacks, and ablations over the loss function (Table 4), so the contribution of the embedding-alignment step is separately identifiable rather than being forced by construction. The only fitted components are optimization hyperparameters such as the per-model threshold tau, which stop the optimization but do not define ASR. Self-citations (e.g., Geng et al. 2025, Li et al. 2025) appear in background or supporting analysis, not as load-bearing premises of the central attack claim, and no uniqueness theorem or prior-work-as-ansatz is invoked to forbid alternatives. The paper also acknowledges limitations about architecture generality and gray-box access, further indicating the claims are empirical rather than definitional. Thus, no circular step rises above the threshold for flagging.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central claim does not rest on fitted physical constants, but it does rely on a model-specific optimization threshold, an unspecified loss weighting, and several domain assumptions about the shared embedding space and the evaluation judge. The paper discloses most hyperparameters but not the loss weights, which limits exact reproduction.

free parameters (3)
  • threshold tau = 0.60 (LLaVA-7B, Qwen-VL, Qwen-Audio), 0.75 (LLaVA-13B, InternVL-13B), 0.85 (InternVL-34B)
    Stopping threshold for the embedding alignment optimization in Algorithm 1; chosen empirically by tracking optimization for some examples, and it is model-specific. The paper does not analyze how sensitive the reported attack success rates are to this threshold.
  • loss combination weights for Euclidean and cosine distance = unspecified
    Section 3.1 states combining Euclidean distance and cosine similarity often yields better results, but Algorithm 1 only names D(...) and does not give the relative weighting. Without this, exact reproduction of the adversarial sample generation is not possible.
  • number of sampled responses n for max-based success = 5
    The paper sets n=5 following prior work, and defines success as the max over the sampled responses. This inflates ASR relative to the mean, as shown in the appendix temperature analysis.
assumptions (4)
  • domain assumption Minimizing the distance between non-textual adversarial embeddings and target instruction token embeddings transfers the instruction's semantics to the image or audio such that the LLM follows it.
    This is the core hypothesis of Con Instruction (Section 3.1, Stage I). If the shared embedding space does not preserve instruction semantics across modalities, the attack fails.
  • domain assumption The attacker has gray-box access to the non-textual encoder, the language fusion module, and the token embedding layer of the victim model.
    Section 3.1 states the setting; it excludes white-box access to the full model but still requires access to components that are not public in many commercial deployments. The authors acknowledge this in Limitations.
  • domain assumption The GPT-4 judge using the ARC taxonomy assigns labels with sufficient accuracy (about 88% agreement with humans on a subset) to serve as the main evaluation metric.
    Section 3.2 and Appendix C report the agreement, but the headline ASR numbers are produced by this judge rather than by human annotation.
  • domain assumption Taking the maximum of five sampled responses is a valid definition of attack success.
    Equation 2 and Section 4.1 define success as the max over n=5 responses; this aligns with prior work but makes ASR optimistic compared to a mean-based measure.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Con Instruction: Universal Jailbreaking of Multimodal Large Language Models via Non-Textual Modalities." pith.science (2026). https://pith.science/paper/TIAMFFWU

@misc{pith2026250600548,
  author       = {Pith},
  title        = {Pith review of: Con Instruction: Universal Jailbreaking of Multimodal Large Language Models via Non-Textual Modalities},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/TIAMFFWU}},
  note         = {Machine review of arXiv:2506.00548}
}
read the original abstract

Existing attacks against multimodal language models (MLLMs) primarily communicate instructions through text accompanied by adversarial images. In contrast, we exploit the capabilities of MLLMs to interpret non-textual instructions, specifically, adversarial images or audio generated by our novel method, Con Instruction. We optimize these adversarial examples to align closely with target instructions in the embedding space, revealing the detrimental implications of MLLMs' sophisticated understanding. Unlike prior work, our method does not require training data or preprocessing of textual instructions. While these non-textual adversarial examples can effectively bypass MLLM safety mechanisms, their combination with various text inputs substantially amplifies attack success. We further introduce a new Attack Response Categorization (ARC) framework, which evaluates both the quality of the model's response and its relevance to the malicious instructions. Experimental results demonstrate that Con Instruction effectively bypasses safety mechanisms in multiple vision- and audio-language models, including LLaVA-v1.5, InternVL, Qwen-VL, and Qwen-Audio, evaluated on two standard benchmarks: AdvBench and SafeBench. Specifically, our method achieves the highest attack success rates, reaching 81.3% and 86.6% on LLaVA-v1.5 (13B). On the defense side, we explore various countermeasures against our attacks and uncover a substantial performance gap among existing techniques. Our implementation is made publicly available.

Figures

Figures reproduced from arXiv: 2506.00548 by the authors.

Figure 1
Figure 1. Illustration of our attack. We optimize an [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. The illustration of our methodology. In the first stage, adversarial samples are iteratively optimized to [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. A comparison of using different text inputs (§3.1) along with Text Instruction versus Con Instruction on AdvBench. ognizes instructions in the adversarial examples. 4.2 Comprehensive Evaluation and Analysis Tab. 3 summarizes the results of various attacks on AdvBench and SafeBench, with higher values indicating better attack effectiveness. Finding A1: Con Instruction effectively attacks both vision- and audio-langua… view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: tSNE of LLaVA (13B)’s activations. While safe and unsafe textual queries form distinct clusters, adversarial samples from our Con Instruction exhibit dispersed, overlapping distributions. family demonstrate better robustness to additional text inputs. In text-only mode…
Figure 5
Figure 5. Figure 5: Attack success rates under different numbers [PITH_FULL_IMAGE:figures/full_fig_p012_5.png]
Figure 6
Figure 6. Figure 6: Comparison of the effectiveness of addi [PITH_FULL_IMAGE:figures/full_fig_p013_6.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

37 extracted references · 13 canonical work pages

  1. [1]

    Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. 2023. Gpt-4 technical report. arXiv preprint arXiv:2303.08774

    arXiv 2023

  2. [2]

    Eugene Bagdasaryan, Tsung-Yin Hsieh, Ben Nassi, and Vitaly Shmatikov. 2023. Abusing images and sounds for indirect instruction injection in multi-modal llms. arXiv preprint arXiv:2307.10490

    arXiv 2023

  3. [3]

    Jinze Bai, Shuai Bai, Shusheng Yang, Shijie Wang, Sinan Tan, Peng Wang, Junyang Lin, Chang Zhou, and Jingren Zhou. 2023. Qwen-vl: A frontier large vision-language model with versatile abilities. arXiv preprint arXiv:2308.12966

    arXiv 2023

  4. [4]

    Luke Bailey, Euan Ong, Stuart Russell, and Scott Emmons. 2023. Image hijacks: Adversarial images can control generative models at runtime. arXiv preprint arXiv:2309.00236

    arXiv 2023

  5. [5]

    Nicholas Carlini, Milad Nasr, Christopher A Choquette-Choo, Matthew Jagielski, Irena Gao, Pang Wei W Koh, Daphne Ippolito, Florian Tramer, and Ludwig Schmidt. 2024. Are aligned neural networks adversarially aligned? Advances in Neural Information Processing Systems, 36

    work page 2024

  6. [6]

    Zhe Chen, Jiannan Wu, Wenhai Wang, Weijie Su, Guo Chen, Sen Xing, Muyan Zhong, Qinglong Zhang, Xizhou Zhu, Lewei Lu, et al. 2024. Internvl: Scaling up vision foundation models and aligning for generic visual-linguistic tasks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24185--24198

    2024

  7. [7]

    Yunfei Chu, Jin Xu, Xiaohuan Zhou, Qian Yang, Shiliang Zhang, Zhijie Yan, Chang Zhou, and Jingren Zhou. 2023. Qwen-audio: Advancing universal audio understanding via unified large-scale audio-language models. arXiv preprint arXiv:2311.07919

    arXiv 2023

  8. [8]

    Yinpeng Dong, Huanran Chen, Jiawei Chen, Zhengwei Fang, Xiao Yang, Yichi Zhang, Yu Tian, Hang Su, and Jun Zhu. 2023. How robust is google's bard to adversarial image attacks? arXiv preprint arXiv:2309.11751

    arXiv 2023

Show all 37 references
  1. [9]

    Zhe Gan, Yen-Chun Chen, Linjie Li, Chen Zhu, Yu Cheng, and Jingjing Liu. 2020. https://proceedings.neurips.cc/paper_files/paper/2020/file/49562478de4c54fafd4ec46fdb297de5-Paper.pdf Large-scale adversarial training for vision-and-language representation learning . In Advances i...

    2020

  2. [10]

    Lang Gao, Jiahui Geng, Xiangliang Zhang, Preslav Nakov, and Xiuying Chen. 2024. Shaping the safety boundaries: Understanding and defending against jailbreaks in large language models. arXiv preprint arXiv:2412.17034

    2024 arXiv

  3. [11]

    Jiahui Geng, Qing Li, Zongxiong Chen, Yuxia Wang, Derui Zhu, Zhuohan Xie, Chenyang Lyu, Xiuying Chen, Preslav Nakov, and Fakhri Karray. 2025. https://arxiv.org/abs/2505.20362 Vscbench: Bridging the gap in vision-language model safety calibration . Preprint, arXiv:2505.20362

    2025 arXiv

  4. [12]

    Yichen Gong, Delong Ran, Jinyuan Liu, Conglei Wang, Tianshuo Cong, Anyu Wang, Sisi Duan, and Xiaoyun Wang. 2023. Fig S tep: Jailbreaking large vision-language models via typographic visual prompts. arXiv preprint arXiv:2311.05608

    2023 arXiv

  5. [13]

    Yunhao Gou, Kai Chen, Zhili Liu, Lanqing Hong, Hang Xu, Zhenguo Li, Dit-Yan Yeung, James T Kwok, and Yu Zhang. 2025. Eyes closed, safety on: Protecting multimodal llms via image-to-text transformation. In European Conference on Computer Vision, pages 388--404. Springer

    2025

  6. [14]

    Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, et al. 2023. Llama guard: Llm-based input-output safeguard for human-ai conversations. arXiv preprint arXiv:2312.06674

    2023 arXiv

  7. [15]

    Diederik Kingma and Jimmy Ba. 2015. Adam: A method for stochastic optimization. In International Conference on Learning Representations (ICLR), San Diega, CA, USA

    2015

  8. [16]

    Chunyuan Li, Cliff Wong, Sheng Zhang, Naoto Usuyama, Haotian Liu, Jianwei Yang, Tristan Naumann, Hoifung Poon, and Jianfeng Gao. 2024 a . Llava-med: Training a large language-and-vision assistant for biomedicine in one day. Advances in Neural Information Processing Systems, 36

    2024

  9. [17]

    Lin Li, Haoyan Guan, Jianing Qiu, and Michael Spratling. 2024 b . One prompt word is enough to boost adversarial robustness for pre-trained vision-language models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 24408--24419

    2024

  10. [18]

    Qing Li, Jiahui Geng, Derui Zhu, Zongxiong Chen, Kun Song, Lei Ma, and Fakhri Karray. 2025. Internal activation revision: Safeguarding vision language models without parameter update. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pages 27428--27436

    2025

  11. [19]

    Haotian Liu, Chunyuan Li, Yuheng Li, and Yong Jae Lee. 2024 a . Improved baselines with visual instruction tuning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR'2024, pages 26296--26306

    2024

  12. [20]

    Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee. 2023. https://proceedings.neurips.cc/paper_files/paper/2023/file/6dcf277ea32ce3288914faf369fe6de0-Paper-Conference.pdf Visual instruction tuning . In Advances in Neural Information Processing Systems, volume 36 of NeurIP...

    2023

  13. [21]

    Xin Liu, Yichen Zhu, Jindong Gu, Yunshi Lan, Chao Yang, and Yu Qiao. 2024 b . https://doi.org/10.1007/978-3-031-72992-8_22 Mm-safetybench: A benchmark for safety evaluation of multimodal large language models . In Computer Vision – ECCV 2024: 18th European Conference, Milan, I...

    2024 doi

  14. [22]

    Zhenxing Niu, Haodong Ren, Xinbo Gao, Gang Hua, and Rong Jin. 2024. Jailbreaking attack against multimodal large language model. arXiv preprint arXiv:2402.02309

    2024 arXiv

  15. [23]

    Renjie Pi, Tianyang Han, Jianshu Zhang, Yueqi Xie, Rui Pan, Qing Lian, Hanze Dong, Jipeng Zhang, and Tong Zhang. 2024. https://aclanthology.org/2024.emnlp-main.895 MLLM -protector: Ensuring MLLM ' s safety without hurting performance . In Proceedings of the 2024 Conference on ...

    2024

  16. [24]

    Xiangyu Qi, Kaixuan Huang, Ashwinee Panda, Peter Henderson, Mengdi Wang, and Prateek Mittal. 2024. Visual adversarial examples jailbreak aligned large language models. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38 of AAAI'24, pages 21527--21536

    2024

  17. [25]

    Vyas Raina and Mark Gales. 2024. Controlling whisper: Universal acoustic adversarial attacks to control speech foundation models. arXiv preprint arXiv:2407.04482

    2024 arXiv

  18. [26]

    Alexander Robey, Eric Wong, Hamed Hassani, and George J Pappas. 2023. Smoothllm: Defending large language models against jailbreaking attacks. arXiv preprint arXiv:2310.03684

    2023 arXiv

  19. [27]

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj \"o rn Ommer. 2022. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684--10695

    2022

  20. [28]

    Erfan Shayegani, Yue Dong, Yue Dong, and Nael Abu-Ghazaleh. 2024. Jailbreak in pieces: Compositional adversarial attacks on multi-modal language models. In The Twelfth International Conference on Learning Representations, ICLR'2024, Vienna, Austria

    2024

  21. [29]

    Alexandra Souly, Qingyuan Lu, Dillon Bowen, Tu Trinh, Elvis Hsieh, Sana Pandey, Pieter Abbeel, Justin Svegliato, Scott Emmons, Olivia Watkins, and Sam Toyer. 2024. https://arxiv.org/abs/2402.10260 A strong REJECT for empty jailbreaks . Preprint, arXiv:2402.10260

    2024 arXiv

  22. [30]

    Xijia Tao, Shuai Zhong, Lei Li, Qi Liu, and Lingpeng Kong. 2024. Imgtrojan: Jailbreaking vision-language models with one image. arXiv preprint arXiv:2403.02910

    2024

  23. [31]

    Hashimoto

    Rohan Taori, Ishaan Gulrajani, Tianyi Zhang, Yann Dubois, Xuechen Li, Carlos Guestrin, Percy Liang, and Tatsunori B. Hashimoto. 2023. Stanford alpaca: An instruction-following llama model. https://github.com/tatsu-lab/stanford_alpaca

    2023

  24. [32]

    Laurens van der Maaten and Geoffrey Hinton. 2008. https://proceedings.neurips.cc/paper/2008/file/8b1fa290163dfe8fd94e3be8c8c2a618-Paper.pdf Visualizing data using t-sne . In Proceedings of the 2008 Joint Conference on 10th International Conference on Neural Information Process...

    2008

  25. [33]

    Fenghua Weng, Yue Xu, Chengyan Fu, and Wenjie Wang. 2024. Mmj-bench: A comprehensive study on jailbreak attacks and defenses for multimodal large language models. arXiv preprint arXiv:2408.08464

    2024 arXiv

  26. [34]

    Yongshuo Zong, Ondrej Bohdal, Tingyang Yu, Yongxin Yang, and Timothy Hospedales. 2024. https://openreview.net/forum?id=bWZKvF0g7G Safety fine-tuning at (almost) no cost: A baseline for vision large language models . In Forty-first International Conference on Machine Learning, ...

    2024

  27. [35]

    Andy Zou, Zifan Wang, J Zico Kolter, and Matt Fredrikson. 2023. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043

    2023 arXiv

  28. [36]

    online" 'onlinestring :=

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list...

  29. [37]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.