SafeCoT: Improving VLM Safety with Minimal Reasoning

Chaochao Lu; Chao Yang; Jiachen Ma; Zhanhui Zhou

REVIEW 4 major objections 3 minor 30 references

SafeCoT: Improving VLM Safety with Minimal Reasoning

T0 review · 4 major / 3 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Training vision-language models to verbalize a brief reason before refusing, using rule-based or prompted chain-of-thought supervision, reduces overrefusal and improves generalization to unseen inputs, even when safety training data is…

desk verdict SafeCoT is a cheap, practical VLM refusal-tuning recipe that beats direct refusal training on MSSBench, but its open-world generalization claim rests on an undefined SIUO accuracy score. read the letter →

arxiv 2506.08399 v2 pith:QW74DFPW submitted 2025-06-10 cs.AI cs.LG

Jiachen Ma , Zhanhui Zhou , Chao Yang , Chaochao Lu This is my paper

classification cs.AIcs.LG

keywords vision-languagemodelssafetyalignmentoverrefusalchain-of-thoughtreasoningrefusalbehaviorfine-tuningmultimodaldata-efficient

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

SafeCoT asks whether the safety-usefulness trade-off of vision-language models can be improved by the minimal addition of a short, explicit reasoning step: when the model refuses, it first states in one or two sentences why the input is unsafe, then emits a fixed refusal phrase. The paper claims this lightweight supervision, built from off-the-shelf risk categories already attached to unsafe image-text datasets, reduces overrefusals and generalizes to out-of-distribution and ambiguous inputs, even when the safety training set is shrunk to 100 examples. If true, safety alignment for multimodal models would not need large-scale annotations, complex modeling, or frontier-model reasoning data, and refusal decisions would become inspectable. The argument is carried by a comparison across four vision-language models, each fine-tuned three ways: direct refusals, template-supervised reasoning, and image-grounded prompted reasoning.

What carries the argument

The central object is the refusal chain-of-thought: a one-to-three-sentence rationale of the form 'this content involves {risk category}, so I cannot assist,' trained as the first part of the model's response before a fixed refusal phrase from a small template list. Two generations of this CoT are studied: rule-based templates, which fill in the risk category without looking at the image, and rule-based prompting, in which a medium open-source vision-language model of about 11 billion parameters is asked to write a brief refusal explanation using the image, the query, and the category, with the category provided directly in the prompt to avoid hallucination. The work the CoT does is to decouple the refusal decision from the refusal expression: the model learns to associate visual and textual evidence with the risk category instead of learning that unfamiliar input implies refusal. Training mixes safety data and general instruction data one-to-one.

What would settle it

Train SafeCoT exactly as described but on only two risk categories, such as 'sexual' and 'violence,' then test on a category absent from training, such as self-harm or medical misinformation, using paired safe and unsafe images; if correct refusal and acceptance rates on the held-out category fall back toward the v0 baseline of blanket rejection, the category-driven rationales are not transferring and the generalization claim fails. A second, cheaper check: take a random sample of SIUO, obtain human accept-reject labels for it, and recompute the reported accuracy, since the paper scores SIUO while describing it as unlabeled.

Watch

Extended reading notes

Core claim

The paper's central claim is that supervising a vision-language model to verbalize a brief chain of thought justifying a refusal, before emitting a fixed rejection phrase, teaches a more general 'safe versus unsafe' boundary than training the same model to refuse directly. Models fine-tuned with direct refusal labels (v0) reject nearly everything on unseen data, including safe inputs; models trained with rule-based template rationales (v1) and with image-grounded prompted rationales (v2) refuse genuine unsafe inputs while accepting safe ones, and this holds on the in-distribution benchmarks, on MSSBench's paired safe and unsafe images, and on the unlabeled real-world SIUO collection. The authors further report that shrinking the unsafe training data from 2,030 to 100 samples does not degrade the approach; correct acceptance of safe inputs improves as data shrinks, which they interpret as evidence that minimal, structured reasoning, not data volume, is what carries the safety behavior.

Load-bearing premise

The method assumes that the coarse risk categories already attached to an unsafe image-text dataset, and the short rationales built from them, are general enough that the refusal boundary learned from them transfers to unseen, ambiguous images.

Editorial extensions

If this is right

Safety fine-tuning of a vision-language model can be done without frontier-model CoT data: rule-based rationales sourced from the dataset's own risk labels are enough to reduce overrefusal, so the pipeline is cheap to reproduce.
Because the refusal reason is verbalized before the refusal, a deployed model's rejections become inspectable: an operator can read why an input was refused and audit the boundary, not just the outcome.
Under a one-to-one mix with general instruction data, the safety behavior does not come at the cost of instruction-following; in-distribution and MSSBench results show the fine-tuned variants keep helping on safe inputs.
Models trained with direct refusal labels without reasoning collapse to blanket refusals on out-of-distribution inputs, so the presence of the reasoning step, not merely the refusal training itself, is what preserves usefulness.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

An untested implication: because the v1 template rationales ignore the image entirely, the improvement from v0 to v1 suggests much of the boundary can be learned from the query text and category alone; the image-grounded v2 adds further gains, implying the visual channel contributes a separable, smaller share of the safety signal.
A testable extension would be to hold out a risk category entirely, such as training only on 'violence' and 'sexual' categories and testing on 'self-harm' or 'medical advice,' to measure how far the category-driven rationales generalize, since the paper's out-of-distribution sets still overlap in themes with the trained categories.
The reported correlation that smaller safety datasets improve correct acceptance hints at a regularization effect, where fewer refusal examples may prevent the model from anchoring on refusal as the default response, but the paper does not test whether the trend continues below 100 samples or whether it trades away refusal rate on the long tail of unsafe inputs.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The core result is real: training a VLM to verbalize a short category-conditioned refusal rationale before declining (v1/v2) clearly beats training it to just emit a fixed refusal (v0) on the MSSBench safe/unsafe balance, across Llama, Qwen, SmolVLM, and LLaVA. That is the right control, and the method is genuinely lightweight—rule-based templates or a medium open VLM generate the CoT labels, no frontier models needed. The extension of Deliberate Alignment to VLMs with this minimal-reasoning twist is legitimate, and the limitations section is honest about dependence on training data quality.

But the paper has a load-bearing evaluation gap. The SIUO accuracy numbers in Table 2 are undefined. Section 4.2 explicitly says SIUO is "unlabeled, real-world image-text pairs" with no risk annotations, yet the table reports accuracy values like 98.91. No labeling procedure is described. The LM judge used for evaluation only classifies responses as accept/reject; it cannot supply ground-truth safety labels. So the large SIUO improvements—the main evidence for "enhances generalization" in the abstract—cannot be interpreted. The MSSBench results are valid and carry the paper's weight, but the open-world claim is not established as written. The stress-test note is correct on this point.

Other soft spots are more moderate but still matter. There are no error bars or seed repetitions anywhere, which is concerning for a fine-tuning study with small training sets. Table 3's small-data result—smaller datasets yielding higher accuracy—is counterintuitive and given no subsampling details or analysis; it might be a real effect or an artifact. The v2 (prompted CoTs) results are sometimes worse than v1 (rule templates), which the paper notes but does not explain. And the method depends on off-the-shelf risk categories from training benchmarks; the paper acknowledges this in Section 6, but it deserves a sharper statement as a boundary condition.

This is a paper for people working on VLM safety alignment who want a practical alternative to large annotation campaigns. It deserves a serious referee: the central direction holds, but publication should require SIUO labels (or removal of the uninterpretable accuracy column), repeated runs with significance, and a closer look at the small-data effect. I would send it to review, not desk-reject it, and ask for a solid revision.

Referee Report

4 major / 3 minor

Summary. The paper proposes SafeCoT, a lightweight fine-tuning framework that trains vision-language models (VLMs) to emit a brief chain-of-thought (CoT) justifying a refusal before producing the refusal response. The CoT supervision is generated either by rule-based templates based on off-the-shelf risk categories (v1) or by prompting a medium-sized open VLM (LLaMA3.2-11B-Vision) with the image, query, and risk category (v2). The authors compare these variants against a direct-refusal baseline (v0) across four VLMs (Llama-3.2-11B, Qwen2-VL-7B, SmolVLM, LLaVA-1.5-7B) on in-distribution safety and helpfulness data (MMsafetyBench, ShareGPT4V) and on out-of-distribution refusal benchmarks (MSSBench, SIUO), and they also report a data-size ablation. The central claim is that SafeCoT reduces overrefusal and improves generalization, even with very limited training data.

Significance. If the central claim is established, SafeCoT would be a useful, low-cost recipe: it avoids frontier-model-generated CoT data and relies only on publicly available unsafe-image datasets with coarse risk categories, making the safety alignment of open VLMs more accessible and interpretable. The paper has several strengths: it evaluates four different open VLM families, contrasts template-based vs prompted rationales, includes a direct-refusal (v0) control, and provides a data-size ablation. The MSSBench results provide partial evidence that CoT supervision can reduce the total-refusal failure mode of v0. However, the open-world generalization claim rests on SIUO, whose accuracy scores are not computable from the information given (the dataset is described as unlabeled and no labeling protocol is supplied), and no experimental repeats or variance estimates are reported. These gaps currently prevent the abstract's stronger conclusions from being accepted.

major comments (4)

[§4.2, Table 2] The SIUO test set is described as 'unlabeled, real-world image-text pairs collected from the web' with 'no explicit risk annotations,' yet Table 2 reports Accuracy values for SIUO in both the language-model and template evaluations. Accuracy is defined in §4.2 as (A+D)/(A+B+C+D), which requires a known safe/unsafe label for every input. The manuscript never explains how ground-truth labels for SIUO were obtained; no annotation protocol, external judge, or source of labels is mentioned. Without such labels the SIUO accuracy numbers are undefined and cannot support the abstract's claim that SafeCoT 'enhances generalization' in open-world scenarios. Please provide the labeling/annotation procedure for SIUO (including how safe and unsafe are defined) and report inter-annotator agreement if human annotation was used, or remove the SIUO accuracy claims and adjust the generalization conclusions accordingly.
[§4.4, Table 3 and all tables] No experimental repeats, random seeds, or variance estimates appear in any experiment. The abstract and §5 state that SafeCoT 'significantly reduces overrefusal' and 'significantly outperforms baselines,' but no statistical tests are conducted and the results appear to be from a single run per configuration. In Table 3, for example, the Llama language-model accuracy at 1,000, 500, 200, and 100 training samples is 62.32, 62.97, 64.82, and 68.70, respectively; differences of a few points may easily fall within run-to-run variation. Please report means and standard deviations across at least three seeds for the main comparisons (at least for Table 3 and for the v0/v1/v2 comparisons on MSSBench), and use an appropriate significance test if the word 'significantly' is retained.
[§4.1, Table 3] The data-size ablation is underspecified regarding the training protocol. The paper does not state the number of epochs, optimization steps, learning rate, or whether the total compute budget was held constant when the unsafe training set was reduced from 2,030 to 100 samples (with a constant 1:1 mix of general data). If epochs are held fixed, smaller datasets are trained for fewer steps; if steps are held fixed, smaller datasets involve repeated epochs. Both choices could drive the surprising result that smaller data 'perform better.' Without this information, the claim that SafeCoT 'remains effective even with limited training data' is not yet established. Please specify the exact training configuration for Table 3 and, ideally, include a matched-compute comparison where the number of optimization steps is held constant.
[§3.2, §4.4] The v1 'Rule-based Template' condition generates refusal rationales from a fixed set of templates that are independent of the image and query (Appendix B.1). Consequently, the improvement of v1 over v0 could be attributed to the model being conditioned on a coarse risk category (e.g., 'physical harm') rather than to the model engaging in input-dependent reasoning. The paper's framing that SafeCoT helps models 'reason about safety risks' (Abstract, §1) is therefore only directly supported by the v2 condition. Please add a control that uses generic, non-category-specific refusal rationales (e.g., a fixed 'I cannot assist with this request' explanation that is the same for all categories), or revise the interpretation of v1 so that it is not presented as evidence of reasoning about the specific input.

minor comments (3)

[§3.1, §4.3, Appendix A] There are several typos and formatting issues: 'the corresponding CoT data can is generated' should be 'can be generated'; 'overrefuing' should be 'overrefusing'; 'Multitrst' should be 'MultiTrust' in Appendix A; and '2030' in Table 3 should be '2,030'.
[§4.2, Appendix C.1] The language-model evaluator (LLaMA-3-8B-Instruct) is used without any reported validation against human labels. Since the template evaluation is also affected by the undefined SIUO labels, it would strengthen the paper to report the judge's agreement with human annotations on a small labeled subset (e.g., from MSSBench) or to rely primarily on the template evaluation for the safe/unsafe comparison.
[Appendix C.2] The refusal-phrase list contains generic expressions such as 'I am unable to', 'Unfortunately', and 'I'm afraid', which can also appear in helpful responses (e.g., 'Unfortunately, I don't have access to that data, but here is what I know...'). The template evaluation may therefore misclassify some non-refusals as refusals; please report the precision/recall of the phrase list or use a more robust refusal classifier.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: SafeCoT's CoT supervision is built from external risk categories and evaluated on held-out/out-of-distribution refusal behavior; the SIUO unlabeled-accuracy issue is a validity concern, not circularity.

full rationale

The paper's claimed derivation chain is: use off-the-shelf risk categories from unsafe vision-language datasets to construct minimal chain-of-thought supervision (via templates or prompted LLaMA3.2-11B), fine-tune a VLM to verbalize that reasoning before a refusal, and evaluate refusal/acceptance behavior on held-in and out-of-distribution benchmarks. None of these steps reduces to its own output. The CoT labels are generated from risk categories that come from the training data, not from the target refusal labels on the evaluation sets; no parameter is fitted to the evaluation data, and the reported generalization is measured on external or held-out benchmarks (MSSBench, SIUO, the 10% split of training data). The only overlap with author identity is that MMsafetyBench (used as training/in-distribution data) and the Dong et al. survey share co-authors with this paper, but neither citation is load-bearing for the central claim: the dataset is used as training input, not as evidence for the method's validity. The SIUO Accuracy numbers are indeed difficult to interpret because Section 4.2 describes SIUO as 'unlabeled, real-world image-text pairs collected from the web' with 'no explicit risk annotations', yet Table 2 reports Accuracy values for it; however, this is an evaluation-validity or reproducibility concern, not a circularity of the derivation. The core claim that SafeCoT improves refusal balance under minimal supervision is supported by a self-contained supervised fine-tuning procedure with externally sourced supervision, so no circular reduction is present.

Assumptions & free parameters 1 free parameters · 3 assumptions · 0 invented entities

The paper introduces no new theoretical entities or fitted constants. Its central claim rests on domain assumptions about the sufficiency of risk-category annotations, the 1:1 training mix, and the faithfulness of the CoT generator. The single hand-chosen free parameter is the data mix ratio; no sensitivity analysis is provided.

free parameters (1)

Safety-to-general data mix ratio = 1:1
Hand-chosen in Section 4.1; no sensitivity analysis, and the reported "less data is better" trend undercuts the choice.

assumptions (3)

domain assumption Risk category annotations in MMsafetyBench and MultiTrust are sufficient and reliable for generating refusal CoTs that teach a generalizable safety boundary.
Invoked in Section 3.2 to justify building CoTs from category alone; if wrong, the rationales may not capture image-specific risks.
domain assumption Fine-tuning on a 1:1 mix of safety CoT data and general instruction data preserves instruction following while learning refusal behavior.
Section 4.1 states the mix without sensitivity analysis; the balance is load-bearing for the overrefusal result.
domain assumption The base VLM, e.g., LLaMA3.2-11B-Vision, produces faithful refusal rationales when prompted with the image and the risk category.
Section 3.2, Rule-based Prompting; the quality of v2 CoTs depends on the generator not hallucinating risk factors.

how reviews work

0 comments

Cite this review

Pith. "Pith review of SafeCoT: Improving VLM Safety with Minimal Reasoning." pith.science (2026). https://pith.science/paper/QW74DFPW

@misc{pith2026250608399,
  author       = {Pith},
  title        = {Pith review of: SafeCoT: Improving VLM Safety with Minimal Reasoning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/QW74DFPW}},
  note         = {Machine review of arXiv:2506.08399}
}

read the original abstract

Ensuring safe and appropriate responses from vision-language models (VLMs) remains a critical challenge, particularly in high-risk or ambiguous scenarios. We introduce SafeCoT, a lightweight, interpretable framework that leverages rule-based chain-of-thought (CoT) supervision to improve refusal behavior in VLMs. Unlike prior methods that rely on large-scale safety annotations or complex modeling, SafeCoT uses minimal supervision to help models reason about safety risks and make context-aware refusals. Experiments across multiple benchmarks show that SafeCoT significantly reduces overrefusal and enhances generalization, even with limited training data. Our approach offers a scalable solution for aligning VLMs with safety-critical objectives.

Figures

Figures reproduced from arXiv: 2506.08399 by the authors.

**Figure 1.** SAFECOT framework. frontier VLMs for CoT data generation—CoT data can be sourced from rule-based templates or generated using medium-sized open-source VLMs (e.g., LLaMA3.2-11B-Vision (Grattafiori et al., 2024)). By making refusal reasoning explicit and interpretable, SAFECOT helps models generalize their decision boundaries between “safe” and “unsafe” inputs with minimal reasoning. Experiments show that SAFECOT re… view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

30 extracted references · 4 canonical work pages

[1]

online" 'onlinestring :=

ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block STRING...
[2]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...
[3]

Shuai Bai, Keqin Chen, Xuejing Liu, Jialin Wang, Wenbin Ge, Sibo Song, Kai Dang, Peng Wang, Shijie Wang, Jun Tang, and 1 others. 2025. Qwen2. 5-vl technical report. arXiv preprint arXiv:2502.13923

arXiv 2025
[4]

Lang Cao. 2023. Learn to refuse: Making large language models more controllable and reliable through knowledge scope limitation and refusal mechanism. arXiv preprint arXiv:2311.01041

arXiv 2023
[5]

Lin Chen, Jinsong Li, Xiaoyi Dong, Pan Zhang, Conghui He, Jiaqi Wang, Feng Zhao, and Dahua Lin. 2024. Sharegpt4v: Improving large multi-modal models with better captions. In European Conference on Computer Vision, pages 370--387. Springer

2024
[6]

Yangyi Chen, Karan Sikka, Michael Cogswell, Heng Ji, and Ajay Divakaran. 2023. Measuring and improving chain-of-thought reasoning in vision-language models. arXiv preprint arXiv:2309.04461

arXiv 2023
[7]

Xiaoxue Cheng, Junyi Li, Wayne Xin Zhao, and Ji-Rong Wen. 2024. Chainlm: Empowering large language models with improved chain-of-thought prompting. arXiv preprint arXiv:2403.14312

work page Pith review arXiv 2024
[8]

Justin Cui, Wei-Lin Chiang, Ion Stoica, and Cho-Jui Hsieh. 2024. Or-bench: An over-refusal benchmark for large language models. arXiv preprint arXiv:2405.20947

arXiv 2024

Show all 30 references

[9]

Zhichen Dong, Zhanhui Zhou, Chao Yang, Jing Shao, and Yu Qiao. 2024. Attacks, defenses and evaluations for llm conversation safety: A survey. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Te...

2024
[10]

Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, and 1 others. 2024. The llama 3 herd of models. arXiv preprint arXiv:2407.21783

2024 arXiv
[11]

Melody Y Guan, Manas Joglekar, Eric Wallace, Saachi Jain, Boaz Barak, Alec Helyar, Rachel Dias, Andrea Vallone, Hongyu Ren, Jason Wei, and 1 others. 2024. Deliberative alignment: Reasoning enables safer language models. arXiv preprint arXiv:2412.16339

2024 arXiv
[12]

Batuhan K Karaman, Ishmam Zabir, Alon Benhaim, Vishrav Chaudhary, Mert R Sabuncu, and Xia Song. 2024. Porover: Improving safety and reducing overrefusal in large language models with overgeneration and preference optimization. arXiv preprint arXiv:2410.12999

2024 arXiv
[13]

Bo Li, Yuanhan Zhang, Dong Guo, Renrui Zhang, Feng Li, Hao Zhang, Kaichen Zhang, Peiyuan Zhang, Yanwei Li, Ziwei Liu, and 1 others. 2024. Llava-onevision: Easy visual task transfer. arXiv preprint arXiv:2408.03326

2024 arXiv
[14]

Haotian Liu, Chunyuan Li, Yuheng Li, and Yong Jae Lee. 2024 a . Improved baselines with visual instruction tuning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 26296--26306

2024
[15]

Xin Liu, Yichen Zhu, Jindong Gu, Yunshi Lan, Chao Yang, and Yu Qiao. 2024 b . Mm-safetybench: A benchmark for safety evaluation of multimodal large language models. In European Conference on Computer Vision, pages 386--403. Springer

2024
[16]

Zhendong Liu, Yuanbi Nie, Yingshui Tan, Xiangyu Yue, Qiushi Cui, Chongjun Wang, Xiaoyong Zhu, and Bo Zheng. 2024 c . Safety alignment for vision language models. arXiv preprint arXiv:2405.13581

2024 arXiv
[17]

Andr \'e s Marafioti, Orr Zohar, Miquel Farr \'e , Merve Noyan, Elie Bakouch, Pedro Cuenca, Cyril Zakka, Loubna Ben Allal, Anton Lozhkov, Nouamane Tazi, and 1 others. 2025. Smolvlm: Redefining small and efficient multimodal models. arXiv preprint arXiv:2504.05299

2025 arXiv
[18]

Paul R \"o ttger, Hannah Rose Kirk, Bertie Vidgen, Giuseppe Attanasio, Federico Bianchi, and Dirk Hovy. 2023. Xstest: A test suite for identifying exaggerated safety behaviours in large language models. arXiv preprint arXiv:2308.01263

2023 arXiv
[19]

selective prediction

Tejas Srinivasan, Jack Hessel, Tanmay Gupta, Bill Yuchen Lin, Yejin Choi, Jesse Thomason, and Khyathi Raghavi Chandu. 2024. Selective" selective prediction": Reducing unnecessary abstention in vision-language reasoning. arXiv preprint arXiv:2402.15610

2024 arXiv
[20]

Gemma Team, Aishwarya Kamath, Johan Ferret, Shreya Pathak, Nino Vieillard, Ramona Merhej, Sarah Perrin, Tatiana Matejovicova, Alexandre Ram \'e , Morgane Rivi \`e re, and 1 others. 2025. Gemma 3 technical report. arXiv preprint arXiv:2503.19786

2025 arXiv
[21]

Gemma Team, Morgane Riviere, Shreya Pathak, Pier Giuseppe Sessa, Cassidy Hardin, Surya Bhupatiraju, L \'e onard Hussenot, Thomas Mesnard, Bobak Shahriari, Alexandre Ram \'e , and 1 others. 2024. Gemma 2: Improving open language models at a practical size. arXiv preprint arXiv:...

2024 arXiv
[22]

Lei Wang, Wanyu Xu, Yihuai Lan, Zhiqiang Hu, Yunshi Lan, Roy Ka-Wei Lee, and Ee-Peng Lim. 2023. Plan-and-solve prompting: Improving zero-shot chain-of-thought reasoning by large language models. arXiv preprint arXiv:2305.04091

2023 arXiv
[23]

Peng Wang, Shuai Bai, Sinan Tan, Shijie Wang, Zhihao Fan, Jinze Bai, Keqin Chen, Xuejing Liu, Jialin Wang, Wenbin Ge, and 1 others. 2024. Qwen2-vl: Enhancing vision-language model's perception of the world at any resolution. arXiv preprint arXiv:2409.12191

2024 arXiv
[24]

Siyin Wang, Xingsong Ye, Qinyuan Cheng, Junwen Duan, Shimin Li, Jinlan Fu, Xipeng Qiu, and Xuan-Jing Huang. 2025. Safe inputs but unsafe output: Benchmarking cross-modality safety alignment of large vision-language models. In Findings of the Association for Computational Lingu...

2025
[25]

Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Fei Xia, Ed Chi, Quoc V Le, Denny Zhou, and 1 others. 2022. Chain-of-thought prompting elicits reasoning in large language models. Advances in neural information processing systems, 35:24824--24837

2022
[26]

Yichi Zhang, Yao Huang, Yitong Sun, Chang Liu, Zhe Zhao, Zhengwei Fang, Yifan Wang, Huanran Chen, Xiao Yang, Xingxing Wei, and 1 others. 2024. Multitrust: A comprehensive benchmark towards trustworthy multimodal large language models. Advances in Neural Information Processing ...

2024
[27]

Zhexin Zhang, Leqi Lei, Lindong Wu, Rui Sun, Yongkang Huang, Chong Long, Xiao Liu, Xuanyu Lei, Jie Tang, and Minlie Huang. 2023. Safetybench: Evaluating the safety of large language models. arXiv preprint arXiv:2309.07045

2023 arXiv
[28]

Haozhe Zhao, Shuzheng Si, Liang Chen, Yichi Zhang, Maosong Sun, Mingjia Zhang, and Baobao Chang. 2024. Looking beyond text: Reducing language bias in large vision-language models via multimodal dual-attention and soft-image guidance. arXiv preprint arXiv:2411.14279

2024 arXiv
[29]

Kaiwen Zhou, Chengzhi Liu, Xuandong Zhao, Anderson Compalas, Dawn Song, and Xin Eric Wang. 2024. Multimodal situational safety. arXiv preprint arXiv:2410.06172

2024 arXiv
[30]

Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. 2023. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043

2023 arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.

[1] [1]

online" 'onlinestring :=

ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block STRING...

[2] [2]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

[3] [3]

Shuai Bai, Keqin Chen, Xuejing Liu, Jialin Wang, Wenbin Ge, Sibo Song, Kai Dang, Peng Wang, Shijie Wang, Jun Tang, and 1 others. 2025. Qwen2. 5-vl technical report. arXiv preprint arXiv:2502.13923

arXiv 2025

[4] [4]

Lang Cao. 2023. Learn to refuse: Making large language models more controllable and reliable through knowledge scope limitation and refusal mechanism. arXiv preprint arXiv:2311.01041

arXiv 2023

[5] [5]

Lin Chen, Jinsong Li, Xiaoyi Dong, Pan Zhang, Conghui He, Jiaqi Wang, Feng Zhao, and Dahua Lin. 2024. Sharegpt4v: Improving large multi-modal models with better captions. In European Conference on Computer Vision, pages 370--387. Springer

2024

[6] [6]

Yangyi Chen, Karan Sikka, Michael Cogswell, Heng Ji, and Ajay Divakaran. 2023. Measuring and improving chain-of-thought reasoning in vision-language models. arXiv preprint arXiv:2309.04461

arXiv 2023

[7] [7]

Xiaoxue Cheng, Junyi Li, Wayne Xin Zhao, and Ji-Rong Wen. 2024. Chainlm: Empowering large language models with improved chain-of-thought prompting. arXiv preprint arXiv:2403.14312

work page Pith review arXiv 2024

[8] [8]

Justin Cui, Wei-Lin Chiang, Ion Stoica, and Cho-Jui Hsieh. 2024. Or-bench: An over-refusal benchmark for large language models. arXiv preprint arXiv:2405.20947

arXiv 2024