Pith. sign in

REVIEW 4 major objections 4 minor 56 references

Innocence in the Crossfire: Roles of Skip Connections in Jailbreaking Visual Language Models

T0 review · 4 major / 4 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A skip connection between two internal layers of a visual language model can substantially raise jailbreak success rates, by 18% on LLaVA-V, 55% on LLaVA-M, and 26% on MiniGPT4, even when the image is benign.

desk verdict A systematic VLM jailbreak map with a plausible but under-controlled SKIP-CON attack; the empirical grid is useful, the mechanism needs controls and transparency. read the letter →

arxiv 2507.13761 v1 pith:COMFP36I submitted 2025-07-18 cs.CL

Palash Nandi , Maithili Joshi , Tanmoy Chakraborty This is my paper
classification cs.CL
keywords visuallanguagemodelsjailbreakattacksskipconnectionstoxicitydetectionin-contextexamplesmemespromptsensitivitymultimodalsafety
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that the safety of visual language models can be broken by discrete prompt-design ingredients and by a single wiring change inside the model. It claims that a VLM separates toxic from benign inputs cleanly when it sees text alone or an image alone, but that this separation collapses when both modalities arrive together. The proposed attack, SKIP-CON, connects the layer where toxicity first becomes distinguishable to the layer where that distinction is most pronounced, and this one connection raises jailbreak success rates by 18%, 55%, and 26% for LLaVA-V, LLaVA-M, and MiniGPT4, even for benign images. The result matters because it locates the vulnerability in the model's internal safety representations rather than only in prompt wording.

What carries the argument

The central mechanism is layer-wise separability of hidden states plus a skip connection that exploits it. The authors extract the final token's hidden state at each layer, project it to two dimensions, and read off the layer where toxic and benign clusters first form and the layer where separation is strongest. SKIP-CON then injects the early-layer self-attention and MLP outputs into the corresponding submodules of the later layer at weight $\lambda = 0.01$, effectively short-circuiting the model's normal residual stream. The evaluation machinery is the two-stage attack success rate: first check for absence of thirteen refusal phrases, then ask Llama-Guard-3-1B whether the generated text is unsafe; both conditions must hold for a successful jailbreak.

What would settle it

Run SKIP-CON with random layer pairs and with several values of $\lambda$ on the same models and datasets; if random pairs or very different weights produce the same improvement in the two-stage attack success rate, the claimed mechanism is not what causes the jailbreak. A more direct test is to train a linear probe on the safety-relevant direction at the connected layers and check whether SKIP-CON actually reduces probe separability when outputs become unsafe; if the probe still separates cleanly, the attack works through some other effect.

Watch

Extended reading notes

Core claim

On the paper's own terms, SKIP-CON is a white-box intervention that takes the hidden-state output of the self-attention and MLP submodules at an early layer $i$, where toxic and benign inputs first separate, and adds those activations, scaled by $\lambda = 0.01$, into the same submodules at a later layer $j$, where the separation is already pronounced. The authors claim this bypasses the collapse of toxicity separation that occurs in multimodal inputs, so the model loses the internal signal it would otherwise use to refuse. Their two-stage metric counts a jailbreak only when the output contains no denial phrase and is classified unsafe by Llama-Guard; under that metric, SKIP-CON raises success rates across all three models and across benign, toxic, and meme images, with the largest gains often on benign images. The paper also claims that each of the three prompt factors, visual description, in-context examples, and a positive-start phrase, can independently trigger jailbreaks, and that three toxic in-context examples are enough to shift generation.

Load-bearing premise

The load-bearing premise is that the layer indices are correctly read from 2D projections of hidden states, and that injecting early activations at strength $0.01$ disrupts the safety distinction specifically rather than degrading the model's output generically.

Editorial extensions

If this is right

  • White-box access to layer internals turns benign images into viable jailbreak triggers on open VLMs such as LLaVA-V, LLaVA-M, and MiniGPT4.
  • Prompt design alone, without any adversarial token optimization, can shift a VLM toward harmful output because each of the three studied factors works independently.
  • A small number of in-context toxic examples, as few as three, steers generation toward inappropriate content, so safety alignment can be undone at the prompt level.
  • Meme images, which look humorous and harmless, can be as effective as explicitly toxic images at eliciting unsafe output once other prompt factors are present.
  • Multimodal combination itself, not the image content, is the factor that collapses the model's internal toxicity distinction.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • My inference: the layer indices are selected by eye from 2D projections, so a sharper test would use linear probes or causal interventions at every layer; that would show whether the mechanism is specifically the collapse of safety separation or simply generic activation perturbation.
  • My inference: the same skip-connection idea could be run in reverse as a safety control, injecting or amplifying the early separation signal at later layers might restore refusal behaviour or enable steering of safety-related directions.
  • My inference: because the paper says text dominates visual information in these models, a natural extension is to test whether skip connections between vision-encoder layers or cross-modal alignment layers behave differently, and whether the attack transfers to closed or much larger VLMs.
  • My inference: since the two-stage metric conflates refusal suppression with unsafe classification, a follow-up should measure whether the outputs are actually more harmful or simply less polite, separating the attack's effect on safety from its effect on style.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The manuscript studies three prompt-design factors in jailbreaking visual language models (VLMs): inclusion of visual descriptions, in-context examples, and positively framed response starters. It reports layer-wise 2D projections of hidden states to argue that VLMs separate toxic from benign inputs in unimodal settings but lose this separation in multimodal inputs. The authors then propose SKIP-CON, a white-box skip connection that injects early-layer activations into a later layer at a fixed weight λ=0.01, and evaluate it with a two-stage Attack Success Rate (2-ASR) metric across LLaVA-V, LLaVA-M, and MiniGPT4 under many factor combinations. The headline claims are that each factor independently contributes to jailbreaks, that SKIP-CON raises 2-ASR by 18%, 55%, and 26% for the three models, and that meme images are as effective as toxic images.

Significance. If the causal mechanism were convincingly established, the paper would be a useful contribution: the with/without-SKIP-CON comparison is clean in principle, the 2-ASR metric is external to the paper's own mechanism, the evaluation spans three models and many factor combinations, and the authors state that code and datasets are publicly available. The layer-wise probing observations are suggestive and connect the attack design to an interpretability analysis. However, the central causal claim currently rests on an unvalidated configuration choice: the layer indices are read by eye from projections on what appears to be the same test set, the indices are never stated numerically, and no control experiments rule out generic perturbation effects. With added controls, quantitative separability measures, and uncertainty quantification, the paper could substantiate its mechanistic story; without them, the reported gains are not yet interpretable as evidence for the proposed bridge-between-layers mechanism.

major comments (4)
  1. [§V.B, Tables I and II] The central claim that connecting the specific pair of layers (i, j) read off the probing analysis is what raises 2-ASR is untested. The experiments compare only 'w/o SC' versus 'w/ SC' at λ=0.01 for the single selected configuration. No random-layer-pair control, no alternative-λ sweep, and no ablation that removes the probing-based choice are reported. Without these controls, the observed gains could be generic degradation from injecting any early-layer activations rather than evidence for the proposed mechanism. Please add random-layer and λ controls and report the numerical values of i and j for each model and setup.
  2. [§IV, §V.B] The configuration of SKIP-CON is derived from visual inspection of 2D projections of hidden states from 100 prompts per category, and the same 100-prompt sets appear to be used for evaluation. Thresholds such as 'separation holds only up to Layer 1 and collapses at Layer 2' (Figure 5) are not backed by any quantitative separability measure, such as clustering metrics or layer-wise classification accuracy, and the indices i and j are never stated numerically. This creates a selection-on-the-test-set risk and prevents replication. Please report quantitative layer-wise separability curves, the chosen i and j per model, and evaluate the effect of SKIP-CON on a held-out prompt split.
  3. [§VII, Tables I and II] The paper states 'We report an average 2-ASR score over ten runs' (Section VII) but provides no error bars, confidence intervals, or significance tests. Many reported differences are small (e.g., Table I, LLaVA-V toxic in setup 000: 0.39 vs 0.43; setup 101: 0.48 vs 0.46), and some cells show drops (e.g., Table II, LLaVA-V meme in self-reflective setup 110: 0.60 to 0.52). The word 'significantly' in the introduction and conclusion is not supported by any statistical evidence. Please report per-run variance and paired statistical tests over the ten runs.
  4. [Introduction, §VIII.B] The headline gains '18%, 55%, and 26% for LLaVA-V, LLaVA-M and MiniGPT4, respectively' are not obtained under a common configuration. The 18% figure is Table I setup 100 benign for LLaVA-V, the 55% figure is Table II self-reflective setup 111 toxic for LLaVA-M, and the 26% figure is Table I setup 001 meme for MiniGPT4. These are best single cells under different factor combinations and image categories. Presenting them as model-level gains is misleading; either report a consistent configuration for the headline claim or explicitly label these as best-case cells with the full distribution shown.
minor comments (4)
  1. [§V.A, Eq. (6)] The notation is internally inconsistent: h^l_5 is defined as self-attention(h^l_4) even though the surrounding text says it is the output of the MLP module, and h^l_6 is also referred to as res^l_6. Since SKIP-CON injects h^i_5, the exact hook point should be clarified.
  2. [§VII.B.2] The heading 'With Context and a Positive Start but No Examples' does not match the setup 011, which includes examples, and the text in the same paragraph says 'a set of examples' is provided. Please correct the heading.
  3. [§V.B, footnote 4] The value λ=0.01 appears only in a footnote; it should be stated in the main text and justified, ideally with a sensitivity analysis (which also relates to the missing λ sweep in the major comments).
  4. [Figure 4 caption] The caption contains a typo, '5th ayer', and should read '5th layer'.

Circularity Check

1 steps flagged · score 4.0 of 10

SKIP-CON's layer pair is selected on the same test set used to report the 2-ASR gains, making the improved success rate an in-sample fit rather than an independent prediction; the external metric prevents a full definitional collapse.

  1. fitted input called prediction [Section IV (Preliminary Observation) and Section V.B (Outline of the Proposed Methodology); evaluated in Tables I-II.]
    "The hidden state of the final token from each layer is extracted and projected on a 2-D plot. It facilitates the identification of the layer at which the model begins to distinguish between toxic and benign inputs. ... We propose a novel methodology SKIP-CON that connects the layer i where distinguishability first emerges to the layer j where it becomes more pronounced. ... The value of λ is set to 0.01."

    The layer indices i and j are the configuration of SKIP-CON, and they are read by eye from 2D projections of the hidden states of the same 100 test prompts that are later scored with 2-ASR in Tables I and II (e.g., Section IV.4: 'separation holds only up to Layer 1 and collapses at Layer 2'). The paper never states the numerical values of i and j, reports no held-out split, no random-layer-pair control, and no λ sweep. Consequently, the reported 'prediction' that connecting these particular layers raises 2-ASR is a configuration selected on the evaluation data; the improvement is in-sample and cannot independently confirm the mechanistic role of the chosen layers.

full rationale

Aside from the configuration-selection issue above, the derivation is mostly self-contained. The 2-ASR metric is external to the paper's mechanism: success requires absence of 13 denial phrases and an unsafe Llama-Guard-3-1B classification, neither of which is defined in terms of the hidden-state separability plots. The self-citations [30], [31] are used only to motivate the selection of harmful memes and are not load-bearing for the central SKIP-CON claim; the meme-effectiveness result is supported by the paper's own comparisons. No uniqueness theorem or ansatz is imported from the authors' prior work. The central weakness is therefore not circular equivalence of the headline metric, but the unvalidated, same-data selection of the layer pair and the absence of controls (random layer pairs, alternative λ values), which makes the causal attribution to the specific layers untestable. That is a partial circularity in the predictive claim, not a definitional collapse; hence score 4.

Assumptions & free parameters 3 free parameters · 5 assumptions · 1 invented entities

The central claims rest on two hand-set or data-picked configuration values (lambda=0.01 and the layer pair i to j, whose indices are never stated) and on an unspecified k for the ASR experiments. The mechanism story relies on the domain assumption that eyeballed 2D cluster separation tracks safety behavior, plus the paper's own unverified hypothesis that the skip connection specifically disrupts that separation. SKIP-CON is an architecture intervention, not a new physical entity, and its effectiveness evidence is internal to this paper. No other invented entities are introduced.

free parameters (3)
  • lambda (skip-connection scale) = 0.01
    Hand-set in Section V.B (footnote 4). Scales the injected early-layer activations; the reported ASR gains depend on it, and no sensitivity analysis is given.
  • connected layer indices i and j per model = unspecified in paper
    Chosen from the layer-wise probing analysis run on the same test data used for evaluation (Sections IV and V.B). The paper never states which layers are connected, and the choice is in-sample with respect to the reported attack outcomes.
  • k-shot example count in ASR experiments = unspecified
    The abstract highlights k=3, but k=1,2,3 appear only in the representational probing (Section IV); the main ASR experiments (Section VII) never state how many in-context examples were used.
assumptions (5)
  • standard math Transformer residual-stream dynamics as specified in Section V.A (Equations 5-6)
    The paper's notation and layer equations follow Vaswani et al. [50]; standard background, not in dispute.
  • domain assumption Visual inspection of 2D projections of hidden states reliably indicates a VLM's ability to distinguish toxic from benign inputs
    Section IV bases all 'separability' and 'collapse' claims on eyeballed 2D plots of the final-token hidden state; no quantitative separability metric (e.g., linear probe accuracy) is reported.
  • domain assumption VLMs predominantly attend to textual information over visual input, so the safety distinction manifests in early layers
    Invoked in Section V to justify the layer-based mechanism, citing [49]; imported from prior literature without replication here.
  • domain assumption 2-ASR (no refusal phrase plus Llama-Guard-3-1B unsafe classification) measures jailbreak success without checking output relevance or coherence
    Section VI defines the metric; there is no human or semantic check that the generated content is a responsive, coherent answer to the harmful query, so off-topic unsafe text could be counted as a jailbreak.
  • ad hoc to paper Injecting early-layer activations into layer j at weight 0.01 disrupts the safety-relevant separation specifically rather than degrading generation generically
    This is the paper's own mechanism hypothesis (Section V.B); no control experiment tests alternative layer pairs or verifies that the separation is destroyed post-intervention.
invented entities (1)
  • SKIP-CON skip connection
    purpose: Injects early-layer self-attention and MLP outputs into a later layer to raise jailbreak success rates
    An architectural intervention rather than a physical entity; its effectiveness evidence is internal to this paper, so it has no falsifiable handle outside the paper.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Innocence in the Crossfire: Roles of Skip Connections in Jailbreaking Visual Language Models." pith.science (2026). https://pith.science/paper/COMFP36I

@misc{pith2026250713761,
  author       = {Pith},
  title        = {Pith review of: Innocence in the Crossfire: Roles of Skip Connections in Jailbreaking Visual Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/COMFP36I}},
  note         = {Machine review of arXiv:2507.13761}
}
read the original abstract

Language models are highly sensitive to prompt formulations - small changes in input can drastically alter their output. This raises a critical question: To what extent can prompt sensitivity be exploited to generate inapt content? In this paper, we investigate how discrete components of prompt design influence the generation of inappropriate content in Visual Language Models (VLMs). Specifically, we analyze the impact of three key factors on successful jailbreaks: (a) the inclusion of detailed visual information, (b) the presence of adversarial examples, and (c) the use of positively framed beginning phrases. Our findings reveal that while a VLM can reliably distinguish between benign and harmful inputs in unimodal settings (text-only or image-only), this ability significantly degrades in multimodal contexts. Each of the three factors is independently capable of triggering a jailbreak, and we show that even a small number of in-context examples (as few as three) can push the model toward generating inappropriate outputs. Furthermore, we propose a framework that utilizes a skip-connection between two internal layers of the VLM, which substantially increases jailbreak success rates, even when using benign images. Finally, we demonstrate that memes, often perceived as humorous or harmless, can be as effective as toxic visuals in eliciting harmful content, underscoring the subtle and complex vulnerabilities of VLMs.

Figures

Figures reproduced from arXiv: 2507.13761 by the authors.

Figure 2
Figure 2. Visualization of internal representations for toxic (red) and benign (blue) prompts in LLaVA-V: (a) the first layer shows no separation, (b) by the 3rd layer clusters begin to form, (c) the seventh layer shows clearer separation, and (d) in the final layer, some benign prompts still overlap with toxic ones. red panda, (b) [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 1
Figure 1. An illustration of visual inputs along with their corresponding descriptions. While the visual inputs fall into two major categories – benign and toxic, the toxic instances are further divided into generalized toxic images and toxic meme instances. (a) An example of a benign visual input, (b) a toxic visual input related to physical assault, and (c) a toxic meme that specifically targets the African Americans commun… view at source ↗
Figure 3
Figure 3. (a)) and 19th layer (c.f [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (8 more)
Figure 4
Figure 4. Figure 4: Demonstration of visual input influence on safe queries for LLaVA-V: (a)–(b) In the zero-shot case (k = 0), separation holds until 5th layer but collapses at 6th layer. (c)–(h) For k = 1 to k = 3, distinguishability persists up to 4th layer but breaks down at 5th ayer.…
Figure 6
Figure 6. Figure 6: Illustration of SKIP-CON within the decoder of VLMs, connecting layers i and j: the link starts at layer i, where distinguishability first appears, and extends to layer j, where it becomes more pronounced. Components of SKIP-CON are highlighted in blue. res l 0 = h l 0…
Figure 2
Figure 2. Figure 2: An illustration of internal representations for toxic (red) and benign (blue) prompts in LLaVA-M: (a) the first layer doesn’t exhibit any separation, (b) by the 3rd layer distinct clusters corresponding to the benign and toxic prompts begin to emerge; (c) surprisingly …
Figure 3
Figure 3. Figure 3: An illustration of internal representations for toxic (red) and benign (blue) prompts in MiniGPT4: (a) the initial layer fails to differentiate benign prompts from the toxic ones, (b) by the 3rd layer respective clusters for both the benign and toxic prompts starts to …
Figure 4
Figure 4. Figure 4: An illustration of the internal representations of toxic (red) and benign (blue) visual inputs for the model LLaVA-V, across various targeted communities. Subfigures (a)–(b) dis￾tinguish between toxic memes targeting women and benign images; (c)–(d) present similar con…
Figure 5
Figure 5. Figure 5: An illustration of internal representations of toxic (red) and benign (blue) visual inputs (only) for model LLaVA-M across different targeted communities: (a)–(b) show the dis￾tinction between toxic memes targeting the women and benign images, (c)–(d) illustrate a simi…
Figure 7
Figure 7. Figure 7: An illustration of the influence of visual inputs on attention scores when prompted with unsafe queries for LLaVA-V: (a) shows the average cross-attention scores elicited by unsafe textual prompts when paired with either benign or toxic images , (b) demonstrates the sa…
Figure 8
Figure 8. Figure 8: An illustration of the influence of visual inputs on attention scores when prompted with unsafe queries for LLaVA-M: (a) shows the average cross-attention scores elicited by unsafe textual prompts when paired with either benign or toxic images , (b) demonstrates the sa…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

56 extracted references · 25 canonical work pages

  1. [1]

    Emu3: Next-token prediction is all you need,

    X. Wang, X. Zhang, Z. Luo, Q. Sun, Y . Cui, J. Wang, F. Zhang, Y . Wang, Z. Li, Q. Yu et al., “Emu3: Next-token prediction is all you need,” arXiv preprint arXiv:2409.18869, 2024

    arXiv 2024

  2. [2]

    Chameleon: Mixed-modal early-fusion foundation models,

    C. Team, “Chameleon: Mixed-modal early-fusion foundation models,” arXiv preprint arXiv:2405.09818 , 2024

    arXiv 2024

  3. [3]

    Vision-language models for vision tasks: A survey,

    J. Zhang, J. Huang, S. Jin, and S. Lu, “Vision-language models for vision tasks: A survey,” IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 46, no. 8, pp. 5625–5644, 2024

    2024

  4. [4]

    Gpt-4 technical report,

    J. Achiam, S. Adler, S. Agarwal, L. Ahmad, I. Akkaya, F. L. Aleman, D. Almeida, J. Altenschmidt, S. Altman, S. Anadkat et al. , “Gpt-4 technical report,” arXiv preprint arXiv:2303.08774 , 2023

    arXiv 2023

  5. [5]

    Ruart: A novel text-centered solution for text-based visual question answering,

    Z.-X. Jin, H. Wu, C. Yang, F. Zhou, J. Qin, L. Xiao, and X.-C. Yin, “Ruart: A novel text-centered solution for text-based visual question answering,” IEEE Transactions on Multimedia, vol. 25, pp. 1–12, 2023

    work page 2023

  6. [6]

    Linin: Logic integrated neural inference network for explanatory visual question answering,

    D. Xue, S. Qian, Q. Fang, and C. Xu, “Linin: Logic integrated neural inference network for explanatory visual question answering,” IEEE Transactions on Multimedia , vol. 27, pp. 16–27, 2025

    work page 2025

  7. [7]

    Expllm: Towards chain of thought for facial expression recognition,

    X. Lan, J. Xue, J. Qi, D. Jiang, K. Lu, and T.-S. Chua, “Expllm: Towards chain of thought for facial expression recognition,” IEEE Transactions on Multimedia, pp. 1–14, 2025

    work page 2025

  8. [8]

    Universal and transferable adversarial attacks on aligned language models,

    A. Zou, Z. Wang, N. Carlini, M. Nasr, J. Z. Kolter, and M. Fredrikson, “Universal and transferable adversarial attacks on aligned language models,” arXiv preprint arXiv:2307.15043 , 2023

    arXiv 2023

Show all 56 references
  1. [9]

    Knowledge enhanced vision and language model for multi-modal fake news detec- tion,

    X. Gao, X. Wang, Z. Chen, W. Zhou, and S. C. H. Hoi, “Knowledge enhanced vision and language model for multi-modal fake news detec- tion,” IEEE Transactions on Multimedia , vol. 26, pp. 8312–8322, 2024

    2024

  2. [10]

    Llavanext: Improved reasoning, ocr, and world knowledge,

    H. Liu, C. Li, Y . Li, B. Li, Y . Zhang, S. Shen, and Y . J. Lee, “Llavanext: Improved reasoning, ocr, and world knowledge,” 2024

    2024

  3. [11]

    Qwen-vl: A versatile vision-language model for understanding, localization,

    J. Bai, S. Bai, S. Yang, S. Wang, S. Tan, P. Wang, J. Lin, C. Zhou, and J. Zhou, “Qwen-vl: A versatile vision-language model for understanding, localization,” Text Reading, and Beyond , vol. 2, 2023. IEEE TRANSACTIONS ON MULTIMEDIA, VOL. 26, 2025 10

    2023

  4. [12]

    Minicpm: Unveiling the potential of small language models with scalable training strategies,

    S. Hu, Y . Tu, X. Han, C. He, G. Cui, X. Long, Z. Zheng, Y . Fang, Y . Huang, W. Zhao et al. , “Minicpm: Unveiling the potential of small language models with scalable training strategies,” arXiv preprint arXiv:2404.06395, 2024

    2024 arXiv

  5. [13]

    Single-stream multi-level alignment for vision-language pretraining,

    Z. Khan, B. Vijay Kumar, X. Yu, S. Schulter, M. Chandraker, and Y . Fu, “Single-stream multi-level alignment for vision-language pretraining,” in European Conference on Computer Vision . Springer, 2022, pp. 735– 751

    2022

  6. [14]

    Vilbert: Pretraining task-agnostic visiolinguistic representations for vision-and-language tasks,

    J. Lu, D. Batra, D. Parikh, and S. Lee, “Vilbert: Pretraining task-agnostic visiolinguistic representations for vision-and-language tasks,” Advances in neural information processing systems , vol. 32, 2019

    2019

  7. [15]

    Vision-language pretrain- ing: Current trends and the future,

    A. Agrawal, D. Teney, and A. Nematzadeh, “Vision-language pretrain- ing: Current trends and the future,” in Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics: Tutorial Abstracts, 2022, pp. 38–43

    2022

  8. [16]

    A survey of vision-language pre-trained models,

    Y . Du, Z. Liu, J. Li, and W. X. Zhao, “A survey of vision-language pre-trained models,” arXiv preprint arXiv:2202.10936 , 2022

    2022 arXiv

  9. [17]

    Transformers in vision: A survey,

    S. Khan, M. Naseer, M. Hayat, S. W. Zamir, F. S. Khan, and M. Shah, “Transformers in vision: A survey,” ACM computing surveys (CSUR) , vol. 54, no. 10s, pp. 1–41, 2022

    2022

  10. [18]

    Cross- lingual adaptation for vision-language model via multimodal semantic distillation,

    Y . Weng, W. He, J. Dong, Chaomurilige, X. Liu, and Z. Liu, “Cross- lingual adaptation for vision-language model via multimodal semantic distillation,” IEEE Transactions on Multimedia , pp. 1–14, 2025

    2025

  11. [19]

    Vlattack: Multimodal adversarial attacks on vision-language tasks via pre-trained models,

    Z. Yin, M. Ye, T. Zhang, T. Du, J. Zhu, H. Liu, J. Chen, T. Wang, and F. Ma, “Vlattack: Multimodal adversarial attacks on vision-language tasks via pre-trained models,” Advances in Neural Information Process- ing Systems, vol. 36, pp. 52 936–52 956, 2023

    2023

  12. [20]

    Can llms’ tuning methods work in medical multimodal domain?

    J. Chen, Y . Jiang, D. Yang, M. Li, J. Wei, Z. Qian, and L. Zhang, “Can llms’ tuning methods work in medical multimodal domain?” in International Conference on Medical Image Computing and Computer- Assisted Intervention. Springer, 2024, pp. 112–122

    2024

  13. [21]

    Are aligned neural networks adversarially aligned?

    N. Carlini, M. Nasr, C. A. Choquette-Choo, M. Jagielski, I. Gao, P. W. W. Koh, D. Ippolito, F. Tramer, and L. Schmidt, “Are aligned neural networks adversarially aligned?” Advances in Neural Information Processing Systems, vol. 36, pp. 61 478–61 500, 2023

    2023

  14. [22]

    On copyright risks of text-to-image diffusion models,

    Y . Zhang, T. T. Tzun, L. W. Hern, H. Wang, and K. Kawaguchi, “On copyright risks of text-to-image diffusion models,” arXiv preprint arXiv:2311.12803, 2023

    2023 arXiv

  15. [23]

    Model extraction and ad- versarial transferability, your bert is vulnerable!

    X. He, L. Lyu, Q. Xu, and L. Sun, “Model extraction and ad- versarial transferability, your bert is vulnerable!” arXiv preprint arXiv:2103.10013, 2021

    2021 arXiv

  16. [24]

    Expanding scope: Adapting english adver- sarial attacks to chinese,

    H. Liu, C. Cai, and Y . Qi, “Expanding scope: Adapting english adver- sarial attacks to chinese,” arXiv preprint arXiv:2306.04874 , 2023

    2023 arXiv

  17. [25]

    Using adversarial attacks to reveal the statistical bias in machine reading comprehension models,

    J. Lin, J. Zou, and N. Ding, “Using adversarial attacks to reveal the statistical bias in machine reading comprehension models,” arXiv preprint arXiv:2105.11136, 2021

    2021 arXiv

  18. [26]

    Adversarial attacks on deep-learning models in natural language processing: A survey,

    W. E. Zhang, Q. Z. Sheng, A. Alhazmi, and C. Li, “Adversarial attacks on deep-learning models in natural language processing: A survey,”ACM Transactions on Intelligent Systems and Technology (TIST) , vol. 11, no. 3, pp. 1–41, 2020

    2020

  19. [27]

    Many-shot jailbreaking,

    C. Anil, E. Durmus, N. Panickssery, M. Sharma, J. Benton, S. Kundu, J. Batson, M. Tong, J. Mu, D. Ford et al., “Many-shot jailbreaking,” Ad- vances in Neural Information Processing Systems , vol. 37, pp. 129 696– 129 742, 2024

    2024

  20. [28]

    Initial response selection for prompt jailbreaking using model steering,

    T. Q. Tran, K. Wataoka, and T. Takahashi, “Initial response selection for prompt jailbreaking using model steering,” in ICLR 2024 Workshop on Secure and Trustworthy Large Language Models , 2024

    2024

  21. [29]

    Beavertails: Towards improved safety alignment of llm via a human-preference dataset,

    J. Ji, M. Liu, J. Dai, X. Pan, C. Zhang, C. Bian, B. Chen, R. Sun, Y . Wang, and Y . Yang, “Beavertails: Towards improved safety alignment of llm via a human-preference dataset,” Advances in Neural Information Processing Systems, vol. 36, pp. 24 678–24 704, 2023

    2023

  22. [30]

    Recent advances in online hate speech moderation: Multimodality and the role of large models,

    M. S. Hee, S. Sharma, R. Cao, P. Nandi, P. Nakov, T. Chakraborty, and R. K.-W. Lee, “Recent advances in online hate speech moderation: Multimodality and the role of large models,” in Findings of the Association for Computational Linguistics: EMNLP 2024 , Y . Al- Onaizan, M. Ba...

    2024

  23. [31]

    Safe-meme: Structured reasoning framework for robust hate speech detection in memes,

    P. Nandi, S. Sharma, and T. Chakraborty, “Safe-meme: Structured reasoning framework for robust hate speech detection in memes,” arXiv preprint arXiv:2412.20541, 2024

    2024 arXiv

  24. [32]

    Visual instruction tuning,

    H. Liu, C. Li, Q. Wu, and Y . J. Lee, “Visual instruction tuning,” Advances in neural information processing systems, vol. 36, pp. 34 892– 34 916, 2023

    2023

  25. [33]

    Improved baselines with visual instruction tuning,

    H. Liu, C. Li, Y . Li, and Y . J. Lee, “Improved baselines with visual instruction tuning,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2024, pp. 26 296–26 306

    2024

  26. [34]

    Minigpt-4: Enhancing vision-language understanding with advanced large language models,

    D. Zhu, J. Chen, X. Shen, X. Li, and M. Elhoseiny, “Minigpt-4: Enhancing vision-language understanding with advanced large language models,” arXiv preprint arXiv:2304.10592 , 2023

    2023 arXiv

  27. [35]

    Autodan: interpretable gradient-based adversarial attacks on large language models,

    S. Zhu, R. Zhang, B. An, G. Wu, J. Barrow, Z. Wang, F. Huang, A. Nenkova, and T. Sun, “Autodan: interpretable gradient-based adversarial attacks on large language models,” arXiv preprint arXiv:2310.15140, 2023

    2023 arXiv

  28. [36]

    Automatically auditing large language models via discrete optimization,

    E. Jones, A. Dragan, A. Raghunathan, and J. Steinhardt, “Automatically auditing large language models via discrete optimization,” in Interna- tional Conference on Machine Learning . PMLR, 2023, pp. 15 307– 15 329

    2023

  29. [37]

    Sensitivity of adversarial perturbation in fast gradient sign method,

    Y . Liu, S. Mao, X. Mei, T. Yang, and X. Zhao, “Sensitivity of adversarial perturbation in fast gradient sign method,” in 2019 IEEE Symposium Series on Computational Intelligence (SSCI) , 2019, pp. 433–436

    2019

  30. [38]

    Jailbreak in pieces: Compositional adversarial attacks on multi-modal language models,

    E. Shayegani, Y . Dong, and N. Abu-Ghazaleh, “Jailbreak in pieces: Compositional adversarial attacks on multi-modal language models,” arXiv preprint arXiv:2307.14539 , 2023

    2023 arXiv

  31. [39]

    Make them spill the beans! coercive knowledge extraction from (production) llms,

    Z. Zhang, G. Shen, G. Tao, S. Cheng, and X. Zhang, “Make them spill the beans! coercive knowledge extraction from (production) llms,” arXiv preprint arXiv:2312.04782, 2023

    2023 arXiv

  32. [40]

    Analyzing the inherent response tendency of llms: Real-world instructions-driven jailbreak,

    Y . Du, S. Zhao, M. Ma, Y . Chen, and B. Qin, “Analyzing the inherent response tendency of llms: Real-world instructions-driven jailbreak,” arXiv preprint arXiv:2312.04127 , 2023

    2023 arXiv

  33. [41]

    Shadow alignment: The ease of subverting safely-aligned language models,

    X. Yang, X. Wang, Q. Zhang, L. Petzold, W. Y . Wang, X. Zhao, and D. Lin, “Shadow alignment: The ease of subverting safely-aligned language models,” arXiv preprint arXiv:2310.02949 , 2023

    2023 arXiv

  34. [42]

    Fine-tuning aligned language models compromises safety, even when users do not intend to!

    X. Qi, Y . Zeng, T. Xie, P.-Y . Chen, R. Jia, P. Mittal, and P. Henderson, “Fine-tuning aligned language models compromises safety, even when users do not intend to!” arXiv preprint arXiv:2310.03693 , 2023

    2023 arXiv

  35. [43]

    Lora fine-tuning effi- ciently undoes safety training in llama 2-chat 70b,

    S. Lermen, C. Rogers-Smith, and J. Ladish, “Lora fine-tuning effi- ciently undoes safety training in llama 2-chat 70b,” arXiv preprint arXiv:2310.20624, 2023

    2023 arXiv

  36. [44]

    Deepinception: Hypnotize large language model to be jailbreaker,

    X. Li, Z. Zhou, J. Zhu, J. Yao, T. Liu, and B. Han, “Deepinception: Hypnotize large language model to be jailbreaker,” arXiv preprint arXiv:2311.03191, 2023

    2023 arXiv

  37. [45]

    A wolf in sheep’s clothing: Generalized nested jailbreak prompts can fool large language models easily,

    P. Ding, J. Kuang, D. Ma, X. Cao, Y . Xian, J. Chen, and S. Huang, “A wolf in sheep’s clothing: Generalized nested jailbreak prompts can fool large language models easily,” arXiv preprint arXiv:2311.08268 , 2023

    2023 arXiv

  38. [46]

    Jailbreak and guard aligned language models with only few in-context demonstrations,

    Z. Wei, Y . Wang, A. Li, Y . Mo, and Y . Wang, “Jailbreak and guard aligned language models with only few in-context demonstrations,” arXiv preprint arXiv:2310.06387 , 2023

    2023 arXiv

  39. [47]

    Adversarial demonstration attacks on large language models,

    J. Wang, Z. Liu, K. H. Park, Z. Jiang, Z. Zheng, Z. Wu, M. Chen, and C. Xiao, “Adversarial demonstration attacks on large language models,” arXiv preprint arXiv:2305.14950 , 2023

    2023 arXiv

  40. [48]

    The hateful memes challenge: Detecting hate speech in multimodal memes,

    D. Kiela, H. Firooz, A. Mohan, V . Goswami, A. Singh, P. Ringshia, and D. Testuggine, “The hateful memes challenge: Detecting hate speech in multimodal memes,” Advances in neural information processing systems, vol. 33, pp. 2611–2624, 2020

    2020

  41. [49]

    Words or vision: Do vision-language models have blind faith in text?

    A. Deng, T. Cao, Z. Chen, and B. Hooi, “Words or vision: Do vision-language models have blind faith in text?” arXiv preprint arXiv:2503.02199, 2025

    2025 arXiv

  42. [50]

    Attention is all you need,

    A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, Ł. Kaiser, and I. Polosukhin, “Attention is all you need,” Advances in neural information processing systems , vol. 30, 2017

    2017

  43. [51]

    Layer normalization,

    J. L. Ba, J. R. Kiros, and G. E. Hinton, “Layer normalization,” arXiv preprint arXiv:1607.06450, 2016

    2016 arXiv

  44. [52]

    Prosa: Assessing and understanding the prompt sensitivity of llms,

    J. Zhuo, S. Zhang, X. Fang, H. Duan, D. Lin, and K. Chen, “Prosa: Assessing and understanding the prompt sensitivity of llms,” arXiv preprint arXiv:2410.12405, 2024

    2024 arXiv

  45. [53]

    How susceptible are llms to influence in prompts?

    S. Anagnostidis and J. Bulian, “How susceptible are llms to influence in prompts?” arXiv preprint arXiv:2408.11865 , 2024

    2024 arXiv

  46. [54]

    Jailbroken: How does llm safety training fail?

    A. Wei, N. Haghtalab, and J. Steinhardt, “Jailbroken: How does llm safety training fail?” Advances in Neural Information Processing Sys- tems, vol. 36, pp. 80 079–80 110, 2023

    2023

  47. [55]

    Refusal in language models is mediated by a single direction,

    A. Arditi, O. Obeso, A. Syed, D. Paleka, N. Panickssery, W. Gurnee, and N. Nanda, “Refusal in language models is mediated by a single direction,” arXiv preprint arXiv:2406.11717 , 2024

    2024 arXiv

  48. [56]

    The llama 3 family of models,

    A. . M. Llama Team, “The llama 3 family of models,” https://github.com/meta-llama/PurpleLlama/blob/main/Llama-Guard3/ 1B/MODEL CARD.md, 2024. IEEE TRANSACTIONS ON MULTIMEDIA, VOL. 26, 2025 11 SUPPLEMENTARY INFORMATION A. Preliminary Observations on Distinguishability of Benign...

    2024

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.