Pith. sign in

REVIEW 4 major objections 5 minor 46 references

VLMs Can Aggregate Scattered Training Patches

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Vision-language models can stitch scattered image patches back together.

desk verdict New phenomenon, decent proof-of-concept; the abstract oversells sampling, and the stitching evidence is stronger for images than for text references. read the letter →

arxiv 2506.03614 v1 pith:RARLQC2O submitted 2025-06-04 cs.CV cs.AIcs.CLcs.CR

Zhanhui Zhou , Lingjie Chen , Chao Yang , Chaochao Lu This is my paper
classification cs.CVcs.AIcs.CLcs.CR
keywords visualstitchingvision-languagemodelscross-samplereasoningdatapoisoningcontentmoderationbypassimagepatchesout-of-contextmultimodalsafety
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper introduces and tests a capability it calls visual stitching: a vision-language model finetuned on pairs of image patch and text can later produce the correct text when shown the full image or a text description of it, even though it never saw the full image during finetuning. The authors demonstrate this on three synthetic datasets, splitting images into 4, 16, or 64 patches and pairing each patch with a unique ID, and show the effect across several open-source model families. They then show that the same effect lets adversaries bypass content moderation: patches of dangerous images that individual filters flag far less often can be finetuned with labels like "safe" or "unsafe," and the model later applies those labels to the original full image or a text reference. The paper argues that visual stitching is a general cross-sample reasoning ability in VLMs and a practical obstacle to monitoring what these models learn.

What carries the argument

The carrying object is the finetuning dataset of \{(patch, ID)\} pairs produced by splitting each source image by a split factor f (1, 2, 4, or 8 along each dimension) and the mean-rank evaluation protocol: all IDs in the source dataset serve as candidates, and the model's rank of the correct ID when prompted with either the full image or a text reference is measured after training. The mechanism at work is inductive out-of-context reasoning transferred to vision: because every patch shares the same text, the model can learn a latent (image, text) association that no single training example displays in full. The paper also uses a threshold-x ambiguity analysis, discarding patches whose correct reference already ranks in the top x before finetuning, to isolate stitching of genuinely ambiguous patches from memorization of distinctive ones.

What would settle it

Probe a model finetuned on patch-ID pairs with held-out patches from the same source images; if the model cannot rank the correct ID above chance on those unseen patches, the learning is patch-specific memorization rather than cross-patch aggregation.

Watch

Extended reading notes

Core claim

The central claim is that VLMs have visual stitching: after finetuning on patch-text pairs created by splitting each source image, the model can verbalize the source text from the full image (image-based stitching) and, to a lesser degree, from a text reference to the image (reference-based stitching), despite never having seen the full image or the reference during finetuning. The authors find that most open-source VLMs achieve near-perfect image-based ranks and non-trivial reference-based ranks, with Qwen2-VL and Qwen2.5-VL the strongest, and that performance survives even when training only on patches that were objectively ambiguous about the image. In the adversarial setting, after moderating the patches, VLMs finetuned on the survivors still learn to label the original harmful image or textual reference with the attacker-chosen text, forming a data poisoning attack that evades moderation.

Load-bearing premise

The claim that models truly stitch patches assumes success is not attributable to a single unambiguous patch that the pretrained model already recognizes on its own; remove that assumption and the strong version of stitching collapses.

Editorial extensions

If this is right

  • Most open-source VLMs exhibit strong image-based visual stitching, even when finetuned on very small patches.
  • Reference-based visual stitching is present but less reliable; the correct ID's probability rises during training though direct sampling often fails.
  • Medium-sized models around 10B parameters perform best at stitching, while small models lack capacity and large models overfit.
  • Training on large patches (split factor 2) improves reference-based stitching relative to training on full images, acting as a visual data augmentation.
  • Patch-level moderation filtering raises the difficulty of stitching but does not eliminate it, so sample-level data moderation is insufficient to block this attack.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Stitching strength likely depends on how many patches share an identical text; adversarial training that varies captions across patches might be harder to exploit, a testable extension the paper does not run.
  • The gap between training on full images and on large patches suggests spatial position encoding helps the model internalize a global layout; ablating M-RoPE or adding location tokens (which the paper found hurt) could clarify the mechanism.
  • Probing models with textual references may serve as a lightweight safety diagnostic: if a model can name an ID or concept from a reference, it has already aggregated the scattered association.
  • The same capability that enables the attack also improves generalization to never-seen images, so moderation policies face a trade-off between safety filtering and legitimate generalization.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper introduces "visual stitching," a proposed capability of vision-language models (VLMs) to integrate visual information scattered across multiple training patches that share the same textual description. In the main experiment, each (image, ID) pair is split into (patch, ID) pairs at various granularities, the VLM is finetuned on these pairs, and the model is then evaluated on whether it can rank the correct ID highly when prompted with the full image (image-based stitching) or with a text reference to the image (reference-based stitching). The authors report strong image-based performance (near-zero mean ranks for most models) and non-trivial but less reliable reference-based performance, with Qwen2-VL models leading. In a second, safety-oriented experiment, patches of harmful images are paired with "safe" or "unsafe" labels, many patches evade the OpenAI Moderation API, and finetuning on the surviving patches produces rank improvements toward the adversarial labels for both image and text-reference prompts. The paper frames visual stitching as both a generalization mechanism and a potential vulnerability that can bypass sample-level data moderation.

Significance. If the central claim is established, the result is significant: it would demonstrate a concrete mechanism by which VLM training on benign-looking fragments can reconstruct harmful or otherwise censored visual knowledge, with direct implications for data moderation and safety auditing. The paper's strengths include a systematic evaluation across multiple open-source VLM families and model sizes, a clearly defined task template, a public code release, and an explicit adversarial-relevance demonstration with real moderation APIs. The reader's conditional assessment is appropriate: the image-based results are robust and reproducible, and the moderation-evasion rates for patches are informative. However, the load-bearing evidence for true cross-patch integration rests on rank-based metrics and an ambiguous-patch analysis that does not fully exclude single-patch memorization, and the safety claim is not backed by sampled-output attack rates. The paper is a useful empirical exploration, but the strength of its claims currently exceeds what the presented evidence supports.

major comments (4)
  1. [Section 4.3 / Figure 5] The threshold-x ambiguous-patch protocol does not isolate patches that are individually uninformative. With 20 reference options, the random mean rank is 9.5, so a patch ranked 4th–9th (retained under threshold-3) still carries substantial single-patch discriminative signal. The paper reports only mean ranks of the correct ID after finetuning on the retained patches; without a demonstration that the retained patches cannot identify the source image on their own (e.g., by reporting the patch-to-reference rank distribution from the pretrained model, or a sampled patch-identification accuracy), the reference-based results remain equally consistent with simple memorization of (patch, ID) pairs from the most informative patch. This is load-bearing because the strong interpretation of "stitching" requires aggregation across patches, not retrieval from a single recognizable fragment.
  2. [Abstract and Section 6] The abstract states that tuned models "can verbalize the correct IDs from full images or text reference," but the evidence is entirely rank-based, and Section 6 explicitly concedes that any non-zero rank means the correct answer is not directly observable through sampling. Since reference-based mean ranks are often well above zero (e.g., Figure 2, food and animal at f=8), the claim of verbalization is unsupported by the presented metrics. Please add sampled-output metrics (e.g., top-1 exact match or sampling accuracy) for both image- and reference-based conditions, or revise the abstract, conclusion, and contribution statements to claim only probability-ranking improvements.
  3. [Section 5.2 / Figure 7] The safety evaluation reports mean rank of "safe"/"unsafe" among two candidates, rather than the model's actual generated text. The stated threat is that VLMs "generate harmful responses" and "describe the full image or a text reference ... as 'safe'" (Abstract and Section 1), which requires generation-level attack success rates. Please report the fraction of harmful images and text references for which decoding (greedy or sampled) yields the adversarial label, with and without moderation filtering, and compare these rates to a baseline of direct finetuning on the original (image, text) pairs. Without such a metric, the practical safety impact is not established.
  4. [Appendix A.4 / Figure 12] Reference-based stitching disappears entirely at learning rates 1e-6 and 5e-6, even for f=1, and the paper reports results only at 1e-5. This fragility means the phenomenon is demonstrated only in a narrow hyperparameter regime, which weakens the generality of the claim that VLMs "exhibit" visual stitching as a capability. Please either report the range of learning rates over which reference-based stitching persists (for additional models and datasets, not only Qwen2-VL-7B at f=1) or provide a principled justification for why 1e-5 is the canonical setting.
minor comments (5)
  1. [Section 4.1] The text contains a typo: "[patch]" is described as a placeholder for visual input from "patchs", which should be "patches".
  2. [Section 5.1] The evaluation templates "For child to see this image is {text}" and "For child to see {reference} is {text}" are missing the indefinite article before "child"; they should read "For a child to see ...".
  3. [Figure 14 caption] The caption of Figure 14 ends with "See Figure 14 for results on other models," which self-references the same figure; it should refer to the specific figure containing the other models or be removed.
  4. [Introduction and Figure 3] There is inconsistent model naming between "Qwen2-VL" and "Qwen-2-VL" (e.g., Figure 3 and Appendix A.4); the paper should use one consistent name.
  5. [Section 6] The sentence "any non-zero rank indicates that stitching is not directly observable through sampling" is in direct tension with the abstract's "can verbalize" claim; this tension should be resolved in revision by aligning the language throughout.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: the predicted generalization targets (full-image and text-reference prompts) are not the training inputs, and the adversarial evasion rate is measured against an external moderation API.

full rationale

The paper's claimed derivation chain is not circular in the sense of a fitted parameter being renamed as a prediction or a result being equivalent to its inputs by construction. The training set is {(patch, ID)} or {(patch, text)} pairs, while the evaluation targets are the full-image prompt and the text-reference prompt; neither full-image nor text-reference conditioning appears in the finetuning data, so the transfer test is genuinely out-of-distribution relative to the training distribution. The safety experiment follows the same structure: filters applied by an external API (OpenAI Moderation) drop flagged patches, and success is measured by the model's rank on the original full image or on a textual reference, again absent from training. The definition of visual stitching is introduced as a concept, but the measurements are independent of that definition: rank of the correct ID/text among all candidates is a standard likelihood-based metric, and the random baseline (mean rank 9.5 for 20 options) is external to the model. The one place where the argument becomes definitionally fragile is the ambiguous-patch analysis in Section 4.3 and Figure 5: 'ambiguous' is defined by a rank threshold chosen by the authors, and patches with correct-reference rank 4-9 still carry substantial single-patch signal relative to chance, so the claim that VLMs integrate information across multiple patches is supported only indirectly by rank-based evidence, as the paper itself concedes ('any non-zero rank indicates that stitching is not directly observable through sampling,' Section 6). This is a weakness in the strength of the evidence, not a circular derivation: the result could be refuted by sampled outputs, and the analysis does not reuse the training labels to construct the evaluation metric. Self-citations occur only in the reference list (e.g., [9], [12]) for related out-of-context reasoning work, and these are not load-bearing for the experimental results, which are self-contained. Therefore, the appropriate finding is no significant circularity (score 2), reflecting the mild concern that the central 'stitching' capability claim is partly defined by the authors' threshold and measured only by ranks rather than by direct sampling.

Assumptions & free parameters 3 free parameters · 5 assumptions · 1 invented entities

The paper's central claim rests on a finetuning protocol that defines visual stitching by construction: every patch of an image is paired with the same text, and success is measured by rank on held-out full-image or text-reference prompts. There are no parameter-free derivations. The main free parameters are hyperparameters and the ambiguous-patch threshold. The key domain assumptions are that patches are informative but benign-looking, that mean rank reflects latent association, that OpenAI moderation proxies real moderation, and that pretraining does not already encode the synthetic associations.

free parameters (3)
  • Learning rate = 1e-5
    Chosen after scanning 1e-6 to 5e-5; reference-based stitching fails at 1e-6 and 5e-6, so the reported capability is conditional on this setting (Appendix A.4, Figure 12).
  • Number of finetuning epochs = 15 (f=1), 5 (f>1)
    Selected as converged training duration; performance fluctuates during training and is seed-dependent (Table 2, Figure 11).
  • Ambiguous-patch threshold x = 0, 1, 2, 3 in Figure 5
    Discards patches whose correct reference rank is within top-x; this analysis cut defines the ambiguous-patch condition and is chosen by the authors, not derived.
assumptions (5)
  • domain assumption Splitting an image into grid patches preserves enough visual information that some patches alone can identify the source image for models with strong priors.
    The patch benchmark and moderation-evasion claim rely on patches being both informative and 'benign-looking'; the paper verifies full-image recognition in Table 1 but does not measure per-patch recognizability directly.
  • domain assumption Mean rank over candidate texts is a valid proxy for latent knowledge even when greedy decoding would not emit the correct text.
    Section 3 defines rank-based evaluation following Feng et al.; Section 6 concedes that non-zero ranks are not directly observable by sampling.
  • domain assumption The OpenAI Moderation API is representative of real moderation pipelines, so evasion rates on it generalize to practical settings.
    All filtered finetuning results use omni-moderation-latest; the paper does not test other moderators in the finetuning loop (Section 5.1).
  • domain assumption Associations between synthetic IDs and images are not present in the pretrained model before finetuning.
    The IDs are generated for the paper, but no pre-finetuning probe confirms zero prior association; Appendix A.1 only verifies that models can recognize the raw images.
  • ad hoc to paper The shared-text condition across patches is what induces cross-sample integration.
    This is the defining experimental construction of visual stitching; no shuffled-text control is run to show that shared text is necessary.
invented entities (1)
  • visual stitching (defined latent capability) independent evidence
    purpose: Explains why VLMs can infer a shared label from fragments seen in separate training samples and why this undermines sample-level moderation.
    The paper offers behavioral evidence: rank improvements on held-out full-image and text-reference prompts, plus an ambiguous-patch experiment. It is a conceptual construct rather than a physical entity, so independent evidence is indirect.

how reviews work

0 comments
Cite this review

Pith. "Pith review of VLMs Can Aggregate Scattered Training Patches." pith.science (2026). https://pith.science/paper/RARLQC2O

@misc{pith2026250603614,
  author       = {Pith},
  title        = {Pith review of: VLMs Can Aggregate Scattered Training Patches},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/RARLQC2O}},
  note         = {Machine review of arXiv:2506.03614}
}
abstract

One way to mitigate risks in vision-language models (VLMs) is to remove dangerous samples in their training data. However, such data moderation can be easily bypassed when harmful images are split into small, benign-looking patches, scattered across many training samples. VLMs may then learn to piece these fragments together during training and generate harmful responses at inference, either from full images or text references. For instance, if trained on image patches from a bloody scene paired with the descriptions "safe," VLMs may later describe, the full image or a text reference to the scene, as "safe." We define the core ability of VLMs enabling this attack as $\textit{visual stitching}$ -- the ability to integrate visual information spread across multiple training samples that share the same textual descriptions. In our work, we first demonstrate visual stitching abilities in common open-source VLMs on three datasets where each image is labeled with a unique synthetic ID: we split each $(\texttt{image}, \texttt{ID})$ pair into $\{(\texttt{patch}, \texttt{ID})\}$ pairs at different granularity for finetuning, and we find that tuned models can verbalize the correct IDs from full images or text reference. Building on this, we simulate the adversarial data poisoning scenario mentioned above by using patches from dangerous images and replacing IDs with text descriptions like ``safe'' or ``unsafe'', demonstrating how harmful content can evade moderation in patches and later be reconstructed through visual stitching, posing serious VLM safety risks. Code is available at https://github.com/ZHZisZZ/visual-stitching.

Figures

Figures reproduced from arXiv: 2506.03614 by the authors.

Figure 1
Figure 1. Illustration of visual stitching. (Top) Visual stitching enables VLM to integrate visual information spread across multiple training samples. After finetuning on {(patch, ID)} of a cat, VLMs can verbalize the ID when given the full image or a text reference to the image, despite never training on them. (Bottom) Visual stitching enables adversarial attacks that bypass data moderation. While the image of a bloody scen… view at source ↗
Figure 2
Figure 2. Inter-family comparison of mean ranks for the correct ID (lower is better). We compare ∼10B-param models across families. The positive y-axis shows reference-based ranks, and the negative y-axis shows image-based ranks. All models perform well conditioned on images. Qwen2-VL-7B shows best reference-based stitching, while others approach random with 8-way splits. 4.1 Setups Source and finetuning data. We construct th… view at source ↗
Figure 3
Figure 3. Intra-family model comparison of mean ranks for the correct ID (lower is better). We compare the models of different sizes from the same families. We find that medium-sized models (∼10B params) perform generally the best. The complete intra-family results is shown in [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (11 more)
Figure 4
Figure 4. Figure 4: Throughout finetuning on {(patch, ID)} pairs (f = 4), VLMs become aware of where an ambiguous patch comes from. We evaluate VLMs throughout their training with the template “[patch]The food/animal/landmark shown in the image is {reference}” and calcu￾late the mean rank…
Figure 5
Figure 5. Figure 5: Mean ranks for the correct ID (lower is better) after finetuning on ambiguous patches. Threshold-x discards patches conditioned on which VLMs rank the correct reference among the top-x choices, using the same prompt as in [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: (Left) Evasion rates of patches from 20 dangerous images against different moderation models. While the OpenAI Moderation API [1] flags all 20 images and ShieldGemma-2 [18] flags 19, small patches often evade detection. (Right) Censored examples of evading patches agai…
Figure 7
Figure 7. Figure 7: Mean ranks of the correct text (lower is better) after finetuning Qwen2-VL-7B on {(patch, text)} pairs, with and without OpenAI Moderation API filtering. Lower ranks indicate successful emulation of direct tuning on the original (image, text) pairs, which would otherwi…
Figure 8
Figure 8. Figure 8: Visualization of three datasets. (V2PE) for extended multimodal contexts. It supports dynamic resolution by tiling images into 448×448 patches and handles multi-image and video inputs for stronger multimodal understanding. Training. InternVL3 uses native multimodal pre…
Figure 9
Figure 9. Figure 9: Intra-family model comparison of mean ranks for the correct ID (lower is better). 2 4 8 Split Ratio (nxn) 6 4 2 0 2 4 6 8 10 Random Baseline reference image Food 2 4 8 Split Ratio (nxn) Animal 2 4 8 Split Ratio (nxn) Landmark Qwen2-VL-7B InternVL3-8B gemma-3-12b-pt Lla…
Figure 10
Figure 10. Figure 10: Mean ranks for the correct ID (lower is better) after finetuning w/ and w/o location. The location-aware finetuning template is “[patch] Partial image of food/animal/landmark (row:{row}, col:{col}), associated with {id}”. We find that incorporating locations significa…
Figure 11
Figure 11. Figure 11: Mean ranks during Qwen2-VL-7B finetuning at different split factors. Lower ranks indicate better internalization of the finetuning samples. Model performance is consistent across 5 different random seeds, and convergence is typically achieved in fewer than 5 epochs. 0…
Figure 12
Figure 12. Figure 12: Mean ranks during Qwen2-VL-7B finetuning at different learning rates on full images (f = 1). Visual stitching performance is highly sensitive to learning rate. 18 [PITH_FULL_IMAGE:figures/full_fig_p018_12.png]
Figure 13
Figure 13. Figure 13: Censored examples of 20 dangerous images and their patches that evaded the OpenAI Moderation API (white patches indicate those flagged as dangerous). 19 [PITH_FULL_IMAGE:figures/full_fig_p019_13.png]
Figure 14
Figure 14. Figure 14: Mean ranks of the correct text (lower is better) after finetuning different models on (patch, text) pairs, with and without OpenAI Moderation API filtering. Lower ranks indicate successful emulation of direct tuning on the original (image, text) pairs, which would oth…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

46 extracted references · 14 canonical work pages

  1. [1]

    Openai moderation api

    OpenAI. Openai moderation api. https://platform.openai.com/docs/guides/ moderation, 2024. Accessed: 2025-05-03

    work page 2024

  2. [2]

    Large Language Models are Limited in Out-of-Context Knowledge Reasoning

    Peng Hu, Changjiang Gao, Ruiqi Gao, Jiajun Chen, and Shujian Huang. Large language models are limited in out-of-context knowledge reasoning. arXiv preprint arXiv:2406.07393, 2024

    work page Pith review arXiv 2024

  3. [3]

    Reverse thinking makes llms stronger reasoners

    Justin Chih-Yao Chen, Zifeng Wang, Hamid Palangi, Rujun Han, Sayna Ebrahimi, Long Le, Vincent Perot, Swaroop Mishra, Mohit Bansal, Chen-Yu Lee, et al. Reverse thinking makes llms stronger reasoners. arXiv preprint arXiv:2411.19865, 2024

    arXiv 2024

  4. [4]

    Mitigating Reversal Curse in Large Language Models via Semantic-aware Permutation Training

    Qingyan Guo, Rui Wang, Junliang Guo, Xu Tan, Jiang Bian, and Yujiu Yang. Mitigating reversal curse in large language models via semantic-aware permutation training. arXiv preprint arXiv:2403.00758, 2024

    work page Pith review arXiv 2024

  5. [5]

    Reverse training to nurse the reversal curse

    Olga Golovneva, Zeyuan Allen-Zhu, Jason Weston, and Sainbayar Sukhbaatar. Reverse training to nurse the reversal curse. arXiv preprint arXiv:2403.13799, 2024

    arXiv 2024

  6. [6]

    Towards a theoretical understanding of the’reversal curse’via training dynamics

    Hanlin Zhu, Baihe Huang, Shaolun Zhang, Michael Jordan, Jiantao Jiao, Yuandong Tian, and Stuart J Russell. Towards a theoretical understanding of the’reversal curse’via training dynamics. Advances in Neural Information Processing Systems , 37:90473–90513, 2024

    work page 2024

  7. [7]

    Is the reversal curse a binding problem? uncovering limitations of transformers from a basic generalization failure

    Boshi Wang and Huan Sun. Is the reversal curse a binding problem? uncovering limitations of transformers from a basic generalization failure. arXiv preprint arXiv:2504.01928, 2025

    arXiv 2025

  8. [8]

    Tell me about yourself: Llms are aware of their learned behaviors

    Jan Betley, Xuchan Bao, Martín Soto, Anna Sztyber-Betley, James Chua, and Owain Evans. Tell me about yourself: Llms are aware of their learned behaviors. arXiv preprint arXiv:2501.11120, 2025

    arXiv 2025

Show all 46 references
  1. [9]

    Extractive structures learned in pretraining enable generalization on finetuned facts

    Jiahai Feng, Stuart Russell, and Jacob Steinhardt. Extractive structures learned in pretraining enable generalization on finetuned facts. arXiv preprint arXiv:2412.04614, 2024

    2024 arXiv

  2. [10]

    a is b” fail to learn “b is a

    Lukas Berglund, Meg Tong, Maximilian Kaufmann, Mikita Balesni, Asa Cooper Stickland, Tomasz Korbak, and Owain Evans. The reversal curse: Llms trained on “a is b” fail to learn “b is a”. In The Twelfth International Conference on Learning Representations , 2024

    2024

  3. [11]

    Physics of language models: Part 3.2, knowledge manipula- tion

    Zeyuan Allen-Zhu and Yuanzhi Li. Physics of language models: Part 3.2, knowledge manipula- tion. arXiv preprint arXiv:2309.14402, 2023

    2023 arXiv

  4. [12]

    Connecting the dots: Llms can infer and verbalize latent structure from disparate training data

    Johannes Treutlein, Dami Choi, Jan Betley, Samuel Marks, Cem Anil, Roger B Grosse, and Owain Evans. Connecting the dots: Llms can infer and verbalize latent structure from disparate training data. Advances in Neural Information Processing Systems , 37:140667–140730, 2024

    2024

  5. [13]

    Me, myself, and ai: The situational awareness dataset (sad) for llms.Advances in Neural Information Processing Systems, 37:64010– 64118, 2024

    Rudolf Laine, Bilal Chughtai, Jan Betley, Kaivalya Hariharan, Mikita Balesni, Jérémy Scheurer, Marius Hobbhahn, Alexander Meinke, and Owain Evans. Me, myself, and ai: The situational awareness dataset (sad) for llms.Advances in Neural Information Processing Systems, 37:64010– ...

    2024

  6. [14]

    Taken out of context: On measuring situational awareness in llms

    Lukas Berglund, Asa Cooper Stickland, Mikita Balesni, Max Kaufmann, Meg Tong, Tomasz Korbak, Daniel Kokotajlo, and Owain Evans. Taken out of context: On measuring situational awareness in llms. arXiv preprint arXiv:2309.00667, 2023

    2023 arXiv

  7. [15]

    From imitation to introspection: Probing self-consciousness in language models

    Sirui Chen, Shu Yu, Shengjie Zhao, and Chaochao Lu. From imitation to introspection: Probing self-consciousness in language models. arXiv preprint arXiv:2410.18819, 2024

    2024 arXiv

  8. [16]

    The llama 3 herd of models

    Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, et al. The llama 3 herd of models. arXiv preprint arXiv:2407.21783, 2024

    2024 arXiv

  9. [17]

    Gemma 3 technical report

    Gemma Team, Aishwarya Kamath, Johan Ferret, Shreya Pathak, Nino Vieillard, Ramona Merhej, Sarah Perrin, Tatiana Matejovicova, Alexandre Ramé, Morgane Rivière, et al. Gemma 3 technical report. arXiv preprint arXiv:2503.19786, 2025. 10

    2025 arXiv

  10. [18]

    Shieldgemma 2: Robust and tractable image content moderation

    Wenjun Zeng, Dana Kurniawan, Ryan Mullins, Yuchi Liu, Tamoghna Saha, Dirichi Ike-Njoku, Jindong Gu, Yiwen Song, Cai Xu, Jingjing Zhou, et al. Shieldgemma 2: Robust and tractable image content moderation. arXiv preprint arXiv:2504.01081, 2025

    2025 arXiv

  11. [19]

    Llama guard 3 vision: Safeguarding human-ai image understanding conversations

    Jianfeng Chi, Ujjwal Karn, Hongyuan Zhan, Eric Smith, Javier Rando, Yiming Zhang, Kate Plawiak, Zacharie Delpierre Coudert, Kartikeya Upasani, and Mahesh Pasupuleti. Llama guard 3 vision: Safeguarding human-ai image understanding conversations. arXiv preprint arXiv:2411.10414, 2024

    2024 arXiv

  12. [20]

    Mm-poisonrag: Disrupting multi- modal rag with local and global poisoning attacks

    Hyeonjeong Ha, Qiusi Zhan, Jeonghwan Kim, Dimitrios Bralios, Saikrishna Sanniboina, Nanyun Peng, Kai-Wei Chang, Daniel Kang, and Heng Ji. Mm-poisonrag: Disrupting multi- modal rag with local and global poisoning attacks. arXiv preprint arXiv:2502.17832, 2025

    2025 arXiv

  13. [21]

    Jailbreaking multimodal large language models via shuffle inconsistency

    Shiji Zhao, Ranjie Duan, Fengxiang Wang, Chi Chen, Caixin Kang, Jialing Tao, YueFeng Chen, Hui Xue, and Xingxing Wei. Jailbreaking multimodal large language models via shuffle inconsistency. arXiv preprint arXiv:2501.04931, 2025

    2025 arXiv

  14. [22]

    Composite backdoor attacks against large language models

    Hai Huang, Zhengyu Zhao, Michael Backes, Yun Shen, and Yang Zhang. Composite backdoor attacks against large language models. arXiv preprint arXiv:2310.07676, 2023

    2023 arXiv

  15. [23]

    Jailbreaking large language models against moderation guardrails via cipher characters

    Haibo Jin, Andy Zhou, Joe Menke, and Haohan Wang. Jailbreaking large language models against moderation guardrails via cipher characters. Advances in Neural Information Processing Systems, 37:59408–59435, 2024

    2024

  16. [24]

    Sugar-coated poison: Benign generation unlocks llm jailbreaking

    Yu-Hang Wu, Yu-Jie Xiong, et al. Sugar-coated poison: Benign generation unlocks llm jailbreaking. arXiv preprint arXiv:2504.05652, 2025

    2025

  17. [25]

    Concept-rot: Poisoning concepts in large language models with model editing

    Keltin Grimes, Marco Christiani, David Shriver, and Marissa Connor. Concept-rot: Poisoning concepts in large language models with model editing. arXiv preprint arXiv:2412.13341, 2024

    2024 arXiv

  18. [26]

    Imagenet large scale visual recognition challenge

    Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, et al. Imagenet large scale visual recognition challenge. International journal of computer vision , 115:211–252, 2015

    2015

  19. [27]

    Food-101 – mining discriminative components with random forests

    Lukas Bossard, Matthieu Guillaumin, and Luc Van Gool. Food-101 – mining discriminative components with random forests. In European Conference on Computer Vision (ECCV), pages 446–461. Springer, 2014

    2014

  20. [28]

    Qwen2 technical report

    An Yang, Baosong Yang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Zhou, Chengpeng Li, Chengyuan Li, Dayiheng Liu, Fei Huang, et al. Qwen2 technical report. arXiv preprint arXiv:2407.10671, 2024

    2024 arXiv

  21. [29]

    An Yang, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chengyuan Li, Dayiheng Liu, Fei Huang, Haoran Wei, et al. Qwen2. 5 technical report. arXiv preprint arXiv:2412.15115, 2024

    2024 arXiv

  22. [30]

    Internvl3: Exploring advanced training and test-time recipes for open-source multimodal models

    Jinguo Zhu, Weiyun Wang, Zhe Chen, Zhaoyang Liu, Shenglong Ye, Lixin Gu, Yuchen Duan, Hao Tian, Weijie Su, Jie Shao, et al. Internvl3: Exploring advanced training and test-time recipes for open-source multimodal models. arXiv preprint arXiv:2504.10479, 2025

    2025 arXiv

  23. [31]

    Improved baselines with visual instruction tuning

    Haotian Liu, Chunyuan Li, Yuheng Li, and Yong Jae Lee. Improved baselines with visual instruction tuning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 26296–26306, 2024

    2024

  24. [32]

    Llava-next: Improved reasoning, ocr, and world knowledge, January 2024

    Haotian Liu, Chunyuan Li, Yuheng Li, Bo Li, Yuanhan Zhang, Sheng Shen, and Yong Jae Lee. Llava-next: Improved reasoning, ocr, and world knowledge, January 2024

    2024

  25. [33]

    Imagenet classification with deep convolutional neural networks

    Alex Krizhevsky, Ilya Sutskever, and Geoffrey E Hinton. Imagenet classification with deep convolutional neural networks. Advances in neural information processing systems , 25, 2012

    2012

  26. [34]

    Roformer: Enhanced transformer with rotary position embedding

    Jianlin Su, Murtadha Ahmed, Yu Lu, Shengfeng Pan, Wen Bo, and Yunfeng Liu. Roformer: Enhanced transformer with rotary position embedding. Neurocomputing, 568:127063, 2024

    2024

  27. [35]

    Gemini: A family of highly capable multimodal models, 2024

    Gemini Team. Gemini: A family of highly capable multimodal models, 2024. 11

    2024

  28. [36]

    Gpt-4o system card, 2024

    OpenAI. Gpt-4o system card, 2024

    2024

  29. [37]

    An image is worth 16x16 words: Transformers for image recognition at scale

    Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv...

    2010 arXiv

  30. [38]

    Mixed preference optimization: Reinforcement learning with data selection and better reference model

    Qi Gou and Cam-Tu Nguyen. Mixed preference optimization: Reinforcement learning with data selection and better reference model. arXiv preprint arXiv:2403.19443, 2024

    2024 arXiv

  31. [39]

    Sigmoid loss for language image pre-training

    Xiaohua Zhai, Basil Mustafa, Alexander Kolesnikov, and Lucas Beyer. Sigmoid loss for language image pre-training. In Proceedings of the IEEE/CVF international conference on computer vision, pages 11975–11986, 2023

    2023

  32. [40]

    Learning transferable visual models from natural language supervision

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International conference on machine learning , p...

    2021

  33. [41]

    Instruction tuning with gpt-4

    Baolin Peng, Chunyuan Li, Pengcheng He, Michel Galley, and Jianfeng Gao. Instruction tuning with gpt-4. arXiv preprint arXiv:2304.03277, 2023

    2023 arXiv

  34. [42]

    Im2text: Describing images using 1 million captioned photographs

    Vicente Ordonez, Girish Kulkarni, and Tamara Berg. Im2text: Describing images using 1 million captioned photographs. In J. Shawe-Taylor, R. Zemel, P. Bartlett, F. Pereira, and K.Q. Weinberger, editors, Advances in Neural Information Processing Systems , volume 24. Curran Assoc...

    2011

  35. [43]

    Conceptual captions: A cleaned, hypernymed, image alt-text dataset for automatic image captioning

    Piyush Sharma, Nan Ding, Sebastian Goodman, and Radu Soricut. Conceptual captions: A cleaned, hypernymed, image alt-text dataset for automatic image captioning. In Iryna Gurevych and Yusuke Miyao, editors, Proceedings of the 56th Annual Meeting of the Association for Computati...

    2018

  36. [44]

    Trl: Transformer reinforce- ment learning

    Leandro von Werra, Younes Belkada, Lewis Tunstall, Edward Beeching, Tristan Thrush, Nathan Lambert, Shengyi Huang, Kashif Rasul, and Quentin Gallouédec. Trl: Transformer reinforce- ment learning. https://github.com/huggingface/trl, 2020

    2020

  37. [45]

    Zero: Memory optimiza- tions toward training trillion parameter models

    Samyam Rajbhandari, Jeff Rasley, Olatunji Ruwase, and Yuxiong He. Zero: Memory optimiza- tions toward training trillion parameter models. In SC20: International Conference for High Performance Computing, Networking, Storage and Analysis, pages 1–16. IEEE, 2020

    2020

  38. [46]

    [image]The food/animal/landmark shown in the image is {reference}

    Yichi Zhang, Yao Huang, Yitong Sun, Chang Liu, Zhe Zhao, Zhengwei Fang, Yifan Wang, Huanran Chen, Xiao Yang, Xingxing Wei, et al. Benchmarking trustworthiness of multimodal large language models: A comprehensive study. arXiv preprint arXiv:2406.07057, 2024. 12 A Experiments A....

    2024 arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.